{ "openapi": "3.1.0", "info": { "title": "My Account", "version": "1.0", "description": "The Auth0 My Account API provides a dedicated set of endpoints for users to manage their own account information. Customers can use these APIs to build self-service experiences in their applications or progressively add details to a user account.\n\nThe My Account API operates within the context of the currently logged-in user and can be used directly within user-facing applications.\n\n:::tip Using Auth0 domain vs. custom domain\n\nThe My Account API supports using your canonical Auth0 domain or your custom domain, but you must use the same one throughout the entire process, including:\n\n- Getting an access token\n- Setting the audience value\n- Calling the My Account API endpoint\n\nFor more information, read [Custom Domains](https://auth0.com/docs/customize/custom-domains).\n\n:::\n\n## Activate the My Account API\n\nYou can activate the My Account API for your tenant in the Auth0 Dashboard:\n\n1. Navigate to Authentication > APIs.\n2. Locate the MyAccount API banner.\n3. Select Activate.\n\n![](https://images.ctfassets.net/cdy7uua7fh8z/DGkDQNIHcegN8vtQyEvF3/a2e98b06867701a66fa1f1b3df1c996b/My_Account_API_-_Activate.png)\n\nBy default, the My Account API is created with the following application API access policies:\n\n`require_client_grant` for user flows\n\n`deny_all` for client (machine-to-machine) flows\n\nFor an application to access the My Account API on the user's behalf, you must explicitly create a client grant for that application, which allows you to define the maximum scopes the application can request. Alternatively, you can change the policy for user access flows to allow_all, which allows any application in your tenant to request any scope from the My Account API.\n\nBecause the My Account API exposes sensitive information and operations, Auth0 does not recommend using allow_all for user access flows. You should follow a least privilege principle with the My Account API to ensure applications only get access to what they truly need, minimizing potential security risks.\n\nThe final permissions granted to the application will be determined by the intersection of the scopes allowed by the application API access policy, the Role-Based Access Control (RBAC) permissions assigned to the end user, and any user consent given (if applicable).\n\n:::info Supported flows\n\nYou cannot update the application API policy for client access to the My Account API, which means you cannot access the My Account API using the Client Credentials Flow.\n\n:::\n\nTo learn more about how to manage application API access policies and their associated client grants, read [Application Access to APIs: Client Grants](https://auth0.com/docs/get-started/applications/application-access-to-apis-client-grants).\n\n## Get an access token\n\nYou can get an access token for the My Account API in the same way you'd get an access token for one of your own APIs.\n\n:::info  \nIf you're going to allow the My Account API to perform sensitive operations (such as enrolling an authentication method), we strongly recommend that you use [step-up authentication](https://auth0.com/docs/secure/multi-factor-authentication/step-up-authentication) to enforce additional security policies through [multi-factor authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication).\n:::\n\nIf you're using Universal Login, read the following articles:\n\n- [Call Your API Using the Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/call-your-api-using-the-authorization-code-flow)\n- [Call Your API Using the Authorization Code Flow with PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce)\n\nIf you're using embedded login, read the following articles:\n\n- [Call Your API Using Resource Owner Password Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/call-your-api-using-resource-owner-password-flow)\n- [Login Flow with Native Passkeys API](https://auth0.com/docs/native-passkeys-api#login-flow)\n\n## Examples\n\n### Universal Login with authorization code flow\n\n**Step 1: Request authorization code**\n\n```\ncurl --request GET \\\n --url 'https://{yourDomain}/authorize?response_type=code&client_id={yourClientId}&redirect_uri=%7ByourRedirectUri%7D&scope=create%3Ame%3Aauthentication_methods&offline_access=&audience=https%3A%2F%2F{yourDomain}%2Fme%2F'\n```\n\n**Step 2: Exchange code for access token**\n\n```\ncurl --request POST \\\n --url 'https://{yourDomain}/oauth/token' \\\n --header 'content-type: application/json' \\\n --data '{\"grant_type\": \"authorization_code\",\"client_id\": \"{yourClientId}\",\"client_secret\": \"{yourClientSecret}\",\"code\": \"{yourAuthorizationCode}\",\"redirect_uri\": \"{yourRedirectUri}\",\"audience\": \"{yourAudience}\",\"scope\": \"create:me:authentication_methods\",\"offline_access\": \"\"}'\n```\n\n### Embedded login with native passkeys\n\n**Step 1: Request login challenge**\n\n```\ncurl --request POST \\\n --url 'https://{yourDomain}/passkey/challenge' \\\n --header 'content-type: application/json' \\\n --data '{\"client_id\": \"{yourClientId}\"}'\n```\n\n**Step 2: Authenticate existing user**\n\n```\ncurl --request POST \\\n --url 'https://{yourDomain}/oauth/token' \\\n --header 'content-type: application/json' \\\n --data '{ \"grant_type\": \"urn:okta:params:oauth:grant-type:webauthn\", \"client_id\": \"{yourClientId}\", \"scope\": \"create:me:authentication_methods offline_access\", \"audience\": \"https://{yourDomain}/me/\", \"auth_session\": \"{sessionIdFromTheFirstRequest}\", \"authn_response\": \"{authenticatorResponse}\"}'\n```" }, "servers": [ { "url": "https://{host}/me/v1", "variables": { "host": { "default": "auth0.auth0.com", "description": "Custom or canonical host name" } } } ], "security": [], "tags": [ { "name": "factors", "description": "Factors", "x-displayName": "Factors" }, { "name": "connected-accounts", "description": "Connected Accounts", "x-displayName": "Connected Accounts" }, { "name": "authentication-methods", "description": "Authentication Methods", "x-displayName": "Authentication Methods" }, { "name": "consents", "description": "Consents", "x-displayName": "Consents" }, { "name": "organizations", "description": "Organizations", "x-displayName": "Organizations" }, { "name": "profile", "description": "Profile", "x-displayName": "Profile" } ], "paths": { "/factors": { "get": { "description": "List of factors enabled for the Auth0 tenant and available for enrollment by this user.", "operationId": "getFactors", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListFactorsResponseContent" } } }, "description": "Successfully retrieved enabled factors", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:factors" ] } ], "tags": [ "factors" ], "summary": "Get the status of all factors", "x-release-lifecycle": "EA", "x-operation-group": "Factors", "x-operation-name": "list", "x-codeSamples": [ { "lang": "typescript", "label": "Get the status of all factors", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.factors.list();\n}\nmain();\n" }, { "lang": "javascript", "label": "Get the status of all factors", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.factors.list();\n}\nmain();\n" } ] } }, "/authentication-methods": { "get": { "description": "Retrieve detailed list of authentication methods belonging to the authenticated user.", "operationId": "getAuthenticationMethods", "parameters": [ { "$ref": "#/components/parameters/AuthenticationMethodTypeQueryParameter" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListAuthenticationMethodsResponseContent" }, "examples": { "multiple-methods": { "summary": "User with multiple authentication methods enrolled", "value": { "authentication_methods": [ { "id": "email|dev_XXXXXXXXXXXXXXXX", "type": "email", "confirmed": true, "email": "user@example.com", "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" }, { "id": "phone|dev_YYYYYYYYYYYYYYYY", "type": "phone", "confirmed": true, "phone_number": "+15551234567", "preferred_authentication_method": "sms", "usage": [ "secondary" ], "created_at": "2025-01-16T14:00:00.000Z" }, { "id": "totp|dev_ZZZZZZZZZZZZZZZZ", "type": "totp", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-02-01T09:15:00.000Z" }, { "id": "passkey|dev_AAAAAAAAAAAAAAAA", "type": "passkey", "credential_device_type": "multi_device", "credential_backed_up": true, "identity_user_id": "auth0|507f1f77bcf86cd799439011", "key_id": "dGVzdC1rZXktaWQ", "public_key": "pQECAyYgASFYI...", "transports": [ "internal" ], "user_agent": "Chrome 131.0.0 / Mac OS X 10.15.7", "user_handle": "YXV0aDB8NTA3ZjFmNzdiY2Y4NmNkNzk5NDM5MDEx", "relying_party_id": "example.auth0.com", "usage": [ "primary" ], "created_at": "2025-03-10T08:00:00.000Z" }, { "id": "password|dXNlci0xMjM", "type": "password", "identity_user_id": "auth0|507f1f77bcf86cd799439011", "usage": [ "primary" ], "created_at": "2024-06-01T12:00:00.000Z" }, { "id": "webauthn-platform|dev_BBBBBBBBBBBBBBBB", "type": "webauthn-platform", "confirmed": true, "key_id": "dGVzdC1wbGF0Zm9ybS1rZXk", "public_key": "pQECAyYgASFYI...", "usage": [ "secondary" ], "created_at": "2025-02-20T11:00:00.000Z" }, { "id": "webauthn-roaming|dev_CCCCCCCCCCCCCCCC", "type": "webauthn-roaming", "confirmed": true, "key_id": "dGVzdC1yb2FtaW5nLWtleQ", "public_key": "pQECAyYgASFYI...", "usage": [ "secondary" ], "created_at": "2025-02-25T16:45:00.000Z" } ] } } } } }, "description": "Successfully retrieved authentication methods", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Get a list of authentication methods", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "list", "x-operation-request-parameters-name": "ListAuthenticationMethodsRequestParameters", "x-codeSamples": [ { "lang": "typescript", "label": "Get a list of authentication methods", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.list({\n type: \"password\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Get a list of authentication methods", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.list({\n type: \"password\",\n });\n}\nmain();\n" } ] }, "post": { "description": "Start the enrollment of a supported authentication method.", "operationId": "createAuthenticationMethod", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" }, { "$ref": "#/components/parameters/HeaderRequestLanguage" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAuthenticationMethodRequestContent" }, "examples": { "phone": { "summary": "Enroll a phone number for SMS/voice OTP", "value": { "type": "phone", "phone_number": "+15551234567", "preferred_authentication_method": "sms" } }, "email": { "summary": "Enroll an email address for OTP", "value": { "type": "email", "email": "user@example.com" } }, "totp": { "summary": "Enroll a TOTP authenticator app", "value": { "type": "totp" } }, "push-notification": { "summary": "Enroll a push notification authenticator", "value": { "type": "push-notification" } }, "recovery-code": { "summary": "Generate a recovery code", "value": { "type": "recovery-code" } }, "password": { "summary": "Enroll a password credential", "value": { "type": "password" } }, "passkey": { "summary": "Enroll a passkey", "value": { "type": "passkey" } } } } } }, "responses": { "202": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateAuthenticationMethodResponseContent" }, "examples": { "phone": { "summary": "Phone enrollment started", "value": { "id": "phone|dev_XXXXXXXXXXXXXXXX", "auth_session": "Fe26.2**05c400ed..." } }, "email": { "summary": "Email enrollment started", "value": { "id": "email|dev_XXXXXXXXXXXXXXXX", "auth_session": "Fe26.2**05c400ed..." } }, "totp": { "summary": "TOTP enrollment started — includes QR code data", "value": { "id": "totp|dev_XXXXXXXXXXXXXXXX", "auth_session": "Fe26.2**05c400ed...", "barcode_uri": "otpauth://totp/my-tenant:auth0%7C507f1f77bcf86cd799439011?secret=JBSWY3DPEHPK3PXP&issuer=my-tenant&algorithm=SHA1&digits=6&period=30", "manual_input_code": "JBSWY3DPEHPK3PXP" } }, "push-notification": { "summary": "Push notification enrollment started — includes QR code data", "value": { "id": "push-notification|dev_XXXXXXXXXXXXXXXX", "auth_session": "Fe26.2**05c400ed...", "barcode_uri": "otpauth://totp/my-tenant:auth0%7C507f1f77bcf86cd799439011?secret=JBSWY3DPEHPK3PXP&issuer=my-tenant&algorithm=SHA1&digits=6&period=30" } }, "recovery-code": { "summary": "Recovery code generated", "value": { "id": "recovery-code|dev_XXXXXXXXXXXXXXXX", "auth_session": "Fe26.2**05c400ed...", "recovery_code": "ABCDEFGHIJKLMNOPQRSTUVWX" } }, "password": { "summary": "Password enrollment started — includes password policy", "value": { "id": "password|new", "auth_session": "Fe26.2**05c400ed...", "policy": { "complexity": { "min_length": 8, "character_types": [ "lowercase", "uppercase", "number", "special" ], "character_type_rule": "three_of_four", "identical_characters": "block", "sequential_characters": "block", "max_length_exceeded": "truncate" }, "profile_data": { "active": true, "blocked_fields": [ "name", "email" ] }, "history": { "active": true, "size": 5 }, "dictionary": { "active": true, "default": "en_10k" } } } }, "passkey": { "summary": "Passkey enrollment started — includes WebAuthn creation options", "value": { "auth_session": "Fe26.2**05c400ed...", "authn_params_public_key": { "challenge": "dGVzdC1jaGFsbGVuZ2U", "timeout": 60000, "rp": { "id": "example.auth0.com", "name": "My Application" }, "user": { "id": "YXV0aDB8NTA3ZjFmNzdiY2Y4NmNkNzk5NDM5MDEx", "name": "user@example.com", "displayName": "User" }, "pubKeyCredParams": [ { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 } ], "authenticatorSelection": { "residentKey": "required", "userVerification": "preferred" } } } } } } }, "description": "Enrollment started", "headers": { "Location": { "$ref": "#/components/headers/LocationHeader" }, "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "create:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Start the enrollment of a supported authentication method.", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "create", "x-codeSamples": [ { "lang": "typescript", "label": "Start the enrollment of a supported authentication method.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.create({\n type: \"phone\",\n phone_number: \"phone_number\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Start the enrollment of a supported authentication method.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.create({\n type: \"phone\",\n phone_number: \"phone_number\",\n });\n}\nmain();\n" } ] } }, "/authentication-methods/{authentication_method_id}": { "get": { "description": "Retrieves a single authentication method belonging to the authenticated user.", "operationId": "getAuthenticationMethod", "parameters": [ { "$ref": "#/components/parameters/PathAuthenticationMethodId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAuthenticationMethodResponseContent" }, "examples": { "phone": { "summary": "Phone authentication method", "value": { "id": "phone|dev_XXXXXXXXXXXXXXXX", "type": "phone", "confirmed": true, "phone_number": "+15551234567", "preferred_authentication_method": "sms", "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "email": { "summary": "Email authentication method", "value": { "id": "email|dev_XXXXXXXXXXXXXXXX", "type": "email", "confirmed": true, "email": "user@example.com", "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "totp": { "summary": "TOTP authentication method", "value": { "id": "totp|dev_XXXXXXXXXXXXXXXX", "type": "totp", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "push-notification": { "summary": "Push notification authentication method", "value": { "id": "push-notification|dev_XXXXXXXXXXXXXXXX", "type": "push-notification", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "recovery-code": { "summary": "Recovery code authentication method", "value": { "id": "recovery-code|dev_XXXXXXXXXXXXXXXX", "type": "recovery-code", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "password": { "summary": "Password authentication method", "value": { "id": "password|dXNlci0xMjM", "type": "password", "identity_user_id": "auth0|507f1f77bcf86cd799439011", "usage": [ "primary" ], "created_at": "2024-06-01T12:00:00.000Z" } }, "passkey": { "summary": "Passkey authentication method", "value": { "id": "passkey|dev_XXXXXXXXXXXXXXXX", "type": "passkey", "credential_device_type": "multi_device", "credential_backed_up": true, "identity_user_id": "auth0|507f1f77bcf86cd799439011", "key_id": "dGVzdC1jcmVkZW50aWFsLWlk", "public_key": "pQECAyYgASFYI...", "transports": [ "internal" ], "user_agent": "Chrome 131.0.0 / Mac OS X 10.15.7", "user_handle": "YXV0aDB8NTA3ZjFmNzdiY2Y4NmNkNzk5NDM5MDEx", "relying_party_id": "example.auth0.com", "usage": [ "primary" ], "created_at": "2025-03-10T08:00:00.000Z" } }, "webauthn-platform": { "summary": "WebAuthn platform authenticator (e.g. Touch ID, Windows Hello)", "value": { "id": "webauthn-platform|dev_XXXXXXXXXXXXXXXX", "type": "webauthn-platform", "confirmed": true, "key_id": "dGVzdC1wbGF0Zm9ybS1rZXk", "public_key": "pQECAyYgASFYI...", "usage": [ "secondary" ], "created_at": "2025-02-20T11:00:00.000Z" } }, "webauthn-roaming": { "summary": "WebAuthn roaming authenticator (e.g. security key)", "value": { "id": "webauthn-roaming|dev_XXXXXXXXXXXXXXXX", "type": "webauthn-roaming", "confirmed": true, "key_id": "dGVzdC1yb2FtaW5nLWtleQ", "public_key": "pQECAyYgASFYI...", "usage": [ "secondary" ], "created_at": "2025-02-25T16:45:00.000Z" } } } } }, "description": "Successfully retrieved authentication method", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Get an authentication method by ID", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "get", "x-codeSamples": [ { "lang": "typescript", "label": "Get an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.get(\"authentication_method_id\");\n}\nmain();\n" }, { "lang": "javascript", "label": "Get an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.get(\"authentication_method_id\");\n}\nmain();\n" } ] }, "delete": { "description": "Deletes a single authentication method belonging to the authenticated user.", "operationId": "deleteAuthenticationMethod", "parameters": [ { "$ref": "#/components/parameters/PathAuthenticationMethodId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "204": { "description": "Authentication method successfully deleted", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "409": { "$ref": "#/components/responses/Conflict" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "delete:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Delete an authentication method by ID", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "delete", "x-codeSamples": [ { "lang": "typescript", "label": "Delete an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.delete(\"authentication_method_id\");\n}\nmain();\n" }, { "lang": "javascript", "label": "Delete an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.delete(\"authentication_method_id\");\n}\nmain();\n" } ] }, "patch": { "description": "Updates a single authentication method", "operationId": "updateAuthenticationMethod", "parameters": [ { "$ref": "#/components/parameters/PathAuthenticationMethodId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateAuthenticationMethodRequestContent" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateAuthenticationMethodResponseContent" } } }, "description": "Successfully updated authentication method", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "update:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Update details of an authentication method by ID", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "update", "x-codeSamples": [ { "lang": "typescript", "label": "Update details of an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.update(\"authentication_method_id\", {});\n}\nmain();\n" }, { "lang": "javascript", "label": "Update details of an authentication method by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.update(\"authentication_method_id\", {});\n}\nmain();\n" } ] } }, "/authentication-methods/{authentication_method_id}/verify": { "post": { "description": "Confirm the enrollment of a supported authentication method.", "operationId": "confirmAuthenticationMethod", "parameters": [ { "$ref": "#/components/parameters/PathAuthenticationMethodId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyAuthenticationMethodRequestContent" }, "examples": { "phone": { "summary": "Verify phone enrollment with OTP code", "value": { "auth_session": "Fe26.2**05c400ed...", "otp_code": "123456" } }, "email": { "summary": "Verify email enrollment with OTP code", "value": { "auth_session": "Fe26.2**05c400ed...", "otp_code": "123456" } }, "totp": { "summary": "Verify TOTP enrollment with code from authenticator app", "value": { "auth_session": "Fe26.2**05c400ed...", "otp_code": "123456" } }, "push-notification": { "summary": "Verify push notification enrollment", "value": { "auth_session": "Fe26.2**05c400ed..." } }, "recovery-code": { "summary": "Verify recovery code enrollment", "value": { "auth_session": "Fe26.2**05c400ed..." } }, "password": { "summary": "Verify password enrollment by setting the new password", "value": { "auth_session": "Fe26.2**05c400ed...", "new_password": "MySecureP@ssw0rd!" } }, "passkey": { "summary": "Verify passkey enrollment with authenticator attestation response", "value": { "auth_session": "Fe26.2**05c400ed...", "authn_response": { "id": "dGVzdC1jcmVkZW50aWFsLWlk", "rawId": "dGVzdC1jcmVkZW50aWFsLWlk", "type": "public-key", "response": { "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YQ...", "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hh..." }, "clientExtensionResults": {} } } } } } } }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyAuthenticationMethodResponseContent" }, "examples": { "phone": { "summary": "Phone authentication method confirmed", "value": { "id": "phone|dev_XXXXXXXXXXXXXXXX", "type": "phone", "confirmed": true, "phone_number": "+15551234567", "preferred_authentication_method": "sms", "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "email": { "summary": "Email authentication method confirmed", "value": { "id": "email|dev_XXXXXXXXXXXXXXXX", "type": "email", "confirmed": true, "email": "user@example.com", "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "totp": { "summary": "TOTP authentication method confirmed", "value": { "id": "totp|dev_XXXXXXXXXXXXXXXX", "type": "totp", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "push-notification": { "summary": "Push notification authentication method confirmed", "value": { "id": "push-notification|dev_XXXXXXXXXXXXXXXX", "type": "push-notification", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "recovery-code": { "summary": "Recovery code authentication method confirmed", "value": { "id": "recovery-code|dev_XXXXXXXXXXXXXXXX", "type": "recovery-code", "confirmed": true, "usage": [ "secondary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "password": { "summary": "Password authentication method confirmed", "value": { "id": "password|dXNlci0xMjM", "type": "password", "identity_user_id": "auth0|507f1f77bcf86cd799439011", "usage": [ "primary" ], "created_at": "2025-01-15T10:30:00.000Z" } }, "passkey": { "summary": "Passkey authentication method confirmed", "value": { "id": "passkey|dev_XXXXXXXXXXXXXXXX", "type": "passkey", "credential_device_type": "multi_device", "credential_backed_up": true, "identity_user_id": "auth0|507f1f77bcf86cd799439011", "key_id": "dGVzdC1jcmVkZW50aWFsLWlk", "public_key": "pQECAyYgASFYI...", "transports": [ "internal" ], "user_agent": "Chrome 131.0.0 / Mac OS X 10.15.7", "user_handle": "YXV0aDB8NTA3ZjFmNzdiY2Y4NmNkNzk5NDM5MDEx", "relying_party_id": "example.auth0.com", "usage": [ "primary" ], "created_at": "2025-01-15T10:30:00.000Z" } } } } }, "description": "Authentication method verified", "headers": { "Location": { "$ref": "#/components/headers/LocationHeader" }, "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "create:me:authentication_methods" ] } ], "tags": [ "authentication-methods" ], "summary": "Confirm the enrollment of a supported authentication method.", "x-release-lifecycle": "GA", "x-operation-group": "AuthenticationMethods", "x-operation-name": "verify", "x-codeSamples": [ { "lang": "typescript", "label": "Confirm the enrollment of a supported authentication method.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.verify(\"authentication_method_id\", {\n auth_session: \"Fe26.2**05c400ed...\",\n otp_code: \"123456\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Confirm the enrollment of a supported authentication method.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.authenticationMethods.verify(\"authentication_method_id\", {\n auth_session: \"Fe26.2**05c400ed...\",\n otp_code: \"123456\",\n });\n}\nmain();\n" } ] } }, "/connected-accounts/connect": { "post": { "description": "Start an authorization flow to link the authenticated user's account with an external identity provider.", "operationId": "createConnectedAccountRequest", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" }, { "$ref": "#/components/parameters/HeaderRequestLanguage" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateConnectedAccountsRequestContent" } } }, "required": true }, "responses": { "201": { "$ref": "#/components/responses/CreateConnectedAccountsResponse" }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "tags": [ "connected-accounts" ], "summary": "Create a connected account request", "x-release-lifecycle": "GA", "x-operation-group": "ConnectedAccounts", "x-operation-name": "create", "security": [ { "Bearer-DPoP": [ "create:me:connected_accounts" ] } ], "x-codeSamples": [ { "lang": "typescript", "label": "Create a connected account request", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.create({\n connection: \"connection\",\n redirect_uri: \"redirect_uri\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Create a connected account request", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.create({\n connection: \"connection\",\n redirect_uri: \"redirect_uri\",\n });\n}\nmain();\n" } ] } }, "/connected-accounts/complete": { "post": { "description": "Complete a previously started authorization flow to link the authenticated user's account with an external identity provider.", "operationId": "completeConnectedAccountRequest", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" }, { "$ref": "#/components/parameters/HeaderRequestLanguage" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompleteConnectedAccountsRequestContent" } } }, "required": true }, "responses": { "201": { "$ref": "#/components/responses/CompleteConnectedAccountsResponse" }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "409": { "$ref": "#/components/responses/Conflict" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "tags": [ "connected-accounts" ], "summary": "Complete a connected account request", "x-release-lifecycle": "GA", "x-operation-group": "ConnectedAccounts", "x-operation-name": "complete", "security": [ { "Bearer-DPoP": [ "create:me:connected_accounts" ] } ], "x-codeSamples": [ { "lang": "typescript", "label": "Complete a connected account request", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.complete({\n auth_session: \"auth_session\",\n connect_code: \"connect_code\",\n redirect_uri: \"redirect_uri\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Complete a connected account request", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.complete({\n auth_session: \"auth_session\",\n connect_code: \"connect_code\",\n redirect_uri: \"redirect_uri\",\n });\n}\nmain();\n" } ] } }, "/connected-accounts/accounts": { "get": { "description": "Retrieve connected accounts belonging to the authenticated user.", "operationId": "getConnectedAccounts", "parameters": [ { "$ref": "#/components/parameters/ConnectionQueryParameter" }, { "$ref": "#/components/parameters/FromQueryParameter" }, { "$ref": "#/components/parameters/TakeQueryParameter" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListConnectedAccountsResponseContent" } } }, "description": "Successfully retrieved connected accounts", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:connected_accounts" ] } ], "tags": [ "connected-accounts" ], "summary": "Get a list of connected accounts", "x-release-lifecycle": "GA", "x-operation-group": "ConnectedAccounts", "x-operation-name": "list", "x-operation-request-parameters-name": "ListConnectedAccountsRequestParameters", "x-codeSamples": [ { "lang": "typescript", "label": "Get a list of connected accounts", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.list({\n connection: \"connection\",\n from: \"from\",\n take: 1,\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Get a list of connected accounts", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.list({\n connection: \"connection\",\n from: \"from\",\n take: 1,\n });\n}\nmain();\n" } ] } }, "/connected-accounts/connections": { "get": { "description": "Retrieve available connections that can be used for account linking by the authenticated user.", "operationId": "getConnectedAccountsConnections", "parameters": [ { "$ref": "#/components/parameters/FromQueryParameter" }, { "$ref": "#/components/parameters/TakeQueryParameter" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListConnectedAccountsConnectionsResponseContent" } } }, "description": "Successfully retrieved available connections", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:connected_accounts" ] } ], "tags": [ "connected-accounts" ], "summary": "Get a list of available connections for connected accounts", "x-release-lifecycle": "GA", "x-operation-group": [ "ConnectedAccounts", "Connections" ], "x-operation-name": "list", "x-operation-request-parameters-name": "ListConnectedAccountsConnectionsRequestParameters", "x-codeSamples": [ { "lang": "typescript", "label": "Get a list of available connections for connected accounts", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.connections.list({\n from: \"from\",\n take: 1,\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Get a list of available connections for connected accounts", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.connections.list({\n from: \"from\",\n take: 1,\n });\n}\nmain();\n" } ] } }, "/connected-accounts/accounts/{id}": { "delete": { "description": "Delete a connected account belonging to the authenticated user.", "operationId": "deleteConnectedAccount", "parameters": [ { "$ref": "#/components/parameters/ConnectedAccountIdParameter" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "204": { "description": "Connected account successfully deleted", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "delete:me:connected_accounts" ] } ], "tags": [ "connected-accounts" ], "summary": "Delete a connected account by ID", "x-release-lifecycle": "GA", "x-operation-group": "ConnectedAccounts", "x-operation-name": "delete", "x-codeSamples": [ { "lang": "typescript", "label": "Delete a connected account by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.delete(\"id\");\n}\nmain();\n" }, { "lang": "javascript", "label": "Delete a connected account by ID", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.connectedAccounts.delete(\"id\");\n}\nmain();\n" } ] } }, "/consents": { "get": { "description": "Retrieve the list of consents for the authenticated user.", "operationId": "getConsents", "x-operation-request-parameters-name": "GetConsentsRequestParameters", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListConsentsResponseContent" } } }, "description": "Successfully retrieved consents", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:consents" ] } ], "tags": [ "consents" ], "summary": "List user consents", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "list", "x-codeSamples": [] } }, "/consents/{consent_id}": { "get": { "description": "Retrieve a specific consent for the authenticated user by ID.", "operationId": "getConsent", "x-operation-request-parameters-name": "GetConsentRequestParameters", "parameters": [ { "$ref": "#/components/parameters/PathConsentId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetConsentResponseContent" } } }, "description": "Successfully retrieved consent", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:consents" ] } ], "tags": [ "consents" ], "summary": "Get a consent by ID", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "get", "x-codeSamples": [] } }, "/consents/{consent_id}/decide": { "post": { "description": "Approve or deny a pending consent for the authenticated user. When `signature` and `kid` are supplied, the consents service verifies the JWS signature against the user's registered consent signing key before recording the decision.", "operationId": "decideConsent", "x-operation-request-parameters-name": "DecideConsentRequestParameters", "parameters": [ { "$ref": "#/components/parameters/PathConsentId" }, { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecideConsentRequestContent" }, "examples": { "approve": { "summary": "Approve a consent", "value": { "decision": "approve" } }, "approveWithSignature": { "summary": "Approve a consent with non-repudiation", "value": { "decision": "approve", "signature": "", "kid": "csk_72jbvv7LfRKYp59gtRLtkn" } }, "approveWithChallengeResponse": { "summary": "Approve a push notification consent", "value": { "decision": "approve", "signature": "", "kid": "csk_72jbvv7LfRKYp59gtRLtkn", "challenge_response": "" } }, "deny": { "summary": "Deny a consent", "value": { "decision": "deny" } } } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecideConsentResponseContent" } } }, "description": "The consent decision was recorded successfully.", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "create:me:consents" ] } ], "tags": [ "consents" ], "summary": "Decide on a consent", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "decide", "x-codeSamples": [] } }, "/consent-signing-keys": { "get": { "description": "Retrieve the list of consent signing keys registered for the authenticated user.", "operationId": "listConsentSigningKeys", "x-operation-request-parameters-name": "ListConsentSigningKeysRequestParameters", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListSigningKeysConsentResponseContent" } } }, "description": "Successfully retrieved consent signing keys", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:consent_signing_keys" ] } ], "tags": [ "consents" ], "summary": "List consent signing keys", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "listSigningKeys", "x-codeSamples": [] }, "post": { "description": "Register a consent signing key for the authenticated user. The key is used to verify signed consent decisions. Only the public key is supplied; the corresponding private key must never leave the device.", "operationId": "createConsentSigningKey", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateConsentSigningKeyRequestContent" } } }, "required": true }, "responses": { "201": { "$ref": "#/components/responses/CreateConsentSigningKeyResponse" }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "422": { "$ref": "#/components/responses/UnprocessableEntity" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "create:me:consent_signing_keys" ] } ], "tags": [ "consents" ], "summary": "Register a consent signing key", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "createSigningKey", "x-codeSamples": [] } }, "/consent-signing-keys/{kid}": { "get": { "description": "Retrieve a specific consent signing key for the authenticated user by its key identifier.", "operationId": "getConsentSigningKey", "x-operation-request-parameters-name": "GetConsentSigningKeyRequestParameters", "parameters": [ { "$ref": "#/components/parameters/PathSigningKeyKid" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetSigningKeyConsentResponseContent" } } }, "description": "Successfully retrieved consent signing key", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:consent_signing_keys" ] } ], "tags": [ "consents" ], "summary": "Get a consent signing key", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "getSigningKey", "x-codeSamples": [] }, "delete": { "description": "Delete a consent signing key registered by the authenticated user. Succeeds whether or not a key with the given identifier exists. Access tokens issued before the deletion remain verifiable, because the public key is embedded in the token at issuance.", "operationId": "deleteConsentSigningKey", "x-operation-request-parameters-name": "DeleteConsentSigningKeyRequestParameters", "parameters": [ { "$ref": "#/components/parameters/PathSigningKeyKid" } ], "responses": { "204": { "description": "Consent signing key deletion request processed", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "delete:me:consent_signing_keys" ] } ], "tags": [ "consents" ], "summary": "Delete a consent signing key", "x-release-lifecycle": "planned", "x-operation-group": "Consents", "x-operation-name": "deleteSigningKey", "x-codeSamples": [] } }, "/organizations": { "get": { "description": "Retrieve the list of organizations the authenticated user belongs to.", "operationId": "getOrganizations", "x-operation-request-parameters-name": "ListOrganizationsRequestParameters", "parameters": [ { "$ref": "#/components/parameters/FromQueryParameter" }, { "$ref": "#/components/parameters/OrganizationsTakeQueryParameter" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListOrganizationsResponseContent" } } }, "description": "Successfully retrieved organizations", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:organizations" ] } ], "tags": [ "organizations" ], "summary": "List user organizations", "x-release-lifecycle": "planned", "x-operation-group": "Organizations", "x-operation-name": "list", "x-codeSamples": [] }, "post": { "description": "Create an organization governed by the tenant's default organization profile and add the authenticated user as its first member.", "operationId": "createOrganization", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrganizationRequestContent" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrganizationResponseContent" } } }, "description": "Organization created successfully", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "409": { "$ref": "#/components/responses/Conflict" }, "415": { "$ref": "#/components/responses/UnsupportedMediaType" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "create:me:organizations" ] } ], "tags": [ "organizations" ], "summary": "Create an organization", "x-release-lifecycle": "planned", "x-operation-group": "Organizations", "x-operation-name": "create", "x-codeSamples": [] } }, "/profile": { "patch": { "description": "Update the authenticated user's writable profile attributes.", "operationId": "patchProfile", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchProfileRequestContent" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchProfileResponseContent" } } }, "description": "Profile updated successfully.", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "410": { "$ref": "#/components/responses/Gone" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "update:me:profile" ] } ], "tags": [ "profile" ], "summary": "Update the authenticated user's profile.", "x-release-lifecycle": "beta", "x-operation-group": "Profile", "x-operation-name": "patch", "x-codeSamples": [ { "lang": "typescript", "label": "Update the authenticated user's profile.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.profile.patch({});\n}\nmain();\n" }, { "lang": "javascript", "label": "Update the authenticated user's profile.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.profile.patch({});\n}\nmain();\n" } ] }, "get": { "description": "Retrieve the authenticated user's profile attributes available for self-service management, with a per-field access policy indicating read/write eligibility.", "operationId": "getProfile", "parameters": [ { "$ref": "#/components/parameters/HeaderCorrelationId" }, { "$ref": "#/components/parameters/HeaderTraceparent" }, { "$ref": "#/components/parameters/QueryFields" }, { "$ref": "#/components/parameters/QueryIncludeFields" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetProfileResponseContent" } } }, "description": "Successfully retrieved profile.", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "410": { "$ref": "#/components/responses/Gone" }, "429": { "$ref": "#/components/responses/TooManyRequests" } }, "security": [ { "Bearer-DPoP": [ "read:me:profile" ] } ], "tags": [ "profile" ], "summary": "Get the authenticated user's profile.", "x-release-lifecycle": "beta", "x-operation-group": "Profile", "x-operation-name": "get", "x-operation-request-parameters-name": "GetProfileRequestParameters", "x-codeSamples": [ { "lang": "typescript", "label": "Get the authenticated user's profile.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.profile.get({\n fields: [\n \"given_name\",\n ],\n include_fields: \"true\",\n });\n}\nmain();\n" }, { "lang": "javascript", "label": "Get the authenticated user's profile.", "source": "import { MyAccountClient } from \"@auth0/myaccount-js\";\n\nasync function main() {\n const client = new MyAccountClient({\n domain: \"{YOUR_DOMAIN}\",\n token: \"\",\n });\n await client.profile.get({\n fields: [\n \"given_name\",\n ],\n include_fields: \"true\",\n });\n}\nmain();\n" } ] } } }, "components": { "securitySchemes": { "Bearer-DPoP": { "type": "http", "scheme": "bearer", "description": "Bearer and DPoP tokens are supported depending on the API configuration" } }, "parameters": { "HeaderCorrelationId": { "in": "header", "name": "x-correlation-id", "required": false, "schema": { "type": "string" }, "x-sdk-ignore": true, "description": "A client-provided unique identifier for a single operation, used to correlate the request across Auth0 systems. The value is surfaced under `references.correlation_id` in tenant logs and echoed back on the response's `x-correlation-id` header. Invalid or oversized values are silently dropped and replaced by a generated UUID v4. Avoid including personally identifiable information (PII)." }, "HeaderTraceparent": { "in": "header", "name": "traceparent", "required": false, "schema": { "type": "string" }, "x-sdk-ignore": true, "description": "A [W3C Trace Context](https://www.w3.org/TR/trace-context/) header used to correlate the request across distributed traces. When supplied, the inbound trace is continued and a fresh child span is echoed back on the response's `traceparent` header; the trace ID is also surfaced under `references.trace_id` in tenant logs. Malformed values are ignored." }, "AuthenticationMethodTypeQueryParameter": { "name": "type", "in": "query", "description": "Filter authentication methods by type", "required": false, "schema": { "$ref": "#/components/schemas/FactorTypeEnum" } }, "HeaderRequestLanguage": { "in": "header", "name": "x-request-language", "required": false, "schema": { "type": "string" }, "x-sdk-ignore": true, "description": "Specifies the language used for localized content generated while handling the request (such as OTP email or SMS messages), using one of the tenant's configured Supported Languages." }, "PathAuthenticationMethodId": { "name": "authentication_method_id", "in": "path", "description": "Authentication Method ID. This value is part of the Location header returned when creating an authentication method. It should be used as it is, without any modifications.", "required": true, "schema": { "$ref": "#/components/schemas/PathAuthenticationMethodId" } }, "ConnectionQueryParameter": { "name": "connection", "in": "query", "description": "Filter connected accounts by connection names", "required": false, "schema": { "$ref": "#/components/schemas/ConnectionNamesFilter" }, "style": "form", "explode": true }, "FromQueryParameter": { "name": "from", "in": "query", "description": "Cursor for pagination - start retrieving results from this point", "required": false, "schema": { "type": "string" } }, "TakeQueryParameter": { "name": "take", "in": "query", "description": "Number of results to return (1-20)", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 10 } }, "ConnectedAccountIdParameter": { "name": "id", "in": "path", "description": "The unique identifier of the connected account", "required": true, "schema": { "$ref": "#/components/schemas/ConnectedAccountId" } }, "PathConsentId": { "in": "path", "name": "consent_id", "required": true, "schema": { "type": "string" }, "description": "The ID of the consent to retrieve" }, "PathSigningKeyKid": { "in": "path", "name": "kid", "required": true, "schema": { "type": "string", "maxLength": 128 }, "description": "The identifier of the consent signing key. This value is returned as `kid` when the key is registered." }, "OrganizationsTakeQueryParameter": { "name": "take", "in": "query", "description": "Number of results to return (1-100)", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 50 } }, "QueryFields": { "name": "fields", "in": "query", "required": false, "description": "Comma-separated list of field names to include or exclude (depending on include_fields).", "style": "form", "explode": false, "schema": { "$ref": "#/components/schemas/ProfileFields" } }, "QueryIncludeFields": { "name": "include_fields", "in": "query", "required": false, "description": "When true (default), return only the fields named in fields. When false, return all fields except those named in fields. Ignored when fields is absent.", "schema": { "$ref": "#/components/schemas/IncludeFieldsEnum" } } }, "headers": { "XRateLimitLimitHeader": { "required": true, "description": "The maximum number of requests permissible during the limit’s window window", "schema": { "type": "number" } }, "XRateLimitResetHeader": { "required": true, "description": "The anticipated time (as a UNIX timestamp, in seconds) when the bucket will be replenished", "schema": { "type": "number" } }, "XRateLimitRemainingHeader": { "required": true, "description": "The number of remaining requests remaining in the current window until requests are rejected", "schema": { "type": "number" } }, "CorrelationIdHeader": { "required": false, "description": "Echoes the validated `x-correlation-id` supplied on the request, or a generated UUID v4 when none was supplied.", "schema": { "type": "string" } }, "TraceparentHeader": { "required": false, "description": "A [W3C Trace Context](https://www.w3.org/TR/trace-context/) header echoing the inbound trace ID with a fresh child span ID.", "schema": { "type": "string" } }, "RetryAfterHeader": { "required": true, "description": "The number of seconds the client should wait before making a new request", "schema": { "type": "number" } }, "XAuth0ErrorKindHeader": { "description": "An indicator that the rate limit exceeded a is global (per tenant) limit.", "schema": { "type": "string", "const": "global-rate-limit" } }, "LocationHeader": { "required": true, "description": "URL of the authentication method resource.", "schema": { "type": "string", "format": "uri" }, "examples": { "verify": { "summary": "Location URL for a newly verified passkey authentication method", "value": "https://auth0.auth0.com/me/v1/authentication-methods/passkey%7Cdev_XXXXXXXXXXXXXXXX" }, "create": { "summary": "Location URL for a newly created but not verified passkey authentication method", "value": "https://auth0.auth0.com/me/v1/authentication-methods/passkey%7Cnew" } } }, "ConsentSigningKeyLocationHeader": { "required": true, "description": "URL of the registered consent signing key resource.", "schema": { "type": "string", "format": "uri" }, "examples": { "create": { "summary": "Location URL for a newly registered consent signing key", "value": "https://auth0.auth0.com/me/v1/consent-signing-keys/csk_72jbvv7LfRKYp59gtRLtkn" } } } }, "schemas": { "FactorTypeEnum": { "description": "Authentication method type (factor)", "enum": [ "password", "passkey", "webauthn-platform", "webauthn-roaming", "totp", "phone", "email", "push-notification", "recovery-code" ], "type": "string" }, "UsageEnum": { "description": "Usage type for authentication factors", "enum": [ "primary", "secondary" ], "type": "string" }, "Usage": { "description": "Primary and/or secondary factor", "type": "array", "items": { "$ref": "#/components/schemas/UsageEnum" } }, "Factor": { "type": "object", "properties": { "type": { "$ref": "#/components/schemas/FactorTypeEnum" }, "usage": { "$ref": "#/components/schemas/Usage" } }, "required": [ "type" ] }, "ListFactorsResponseContent": { "type": "object", "properties": { "factors": { "type": "array", "items": { "$ref": "#/components/schemas/Factor" } } }, "additionalProperties": false, "required": [ "factors" ] }, "ValidationError": { "type": "object", "properties": { "detail": { "type": "string" }, "field": { "type": "string" }, "pointer": { "type": "string" }, "source": { "type": "string" } }, "required": [ "detail" ], "additionalProperties": false }, "ErrorResponse": { "properties": { "type": { "type": "string" }, "status": { "type": "number" }, "title": { "type": "string" }, "detail": { "type": "string" }, "validation_errors": { "type": "array", "items": { "$ref": "#/components/schemas/ValidationError" } } }, "required": [ "type", "status", "title", "detail" ], "type": "object", "additionalProperties": false }, "AuthenticationMethodBase": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the authentication method" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the authentication method was created" }, "usage": { "$ref": "#/components/schemas/Usage" } }, "required": [ "id", "created_at", "usage" ] }, "AuthenticationMethodPassword": { "title": "Password Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodBase" }, { "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "default": "password", "type": "string", "const": "password" }, "identity_user_id": { "type": "string", "description": "The ID of the user identity linked with the authentication method" }, "last_password_reset": { "type": "string", "format": "date-time", "description": "The date of the last password reset" } }, "required": [ "type", "identity_user_id" ] } ] }, "CredentialDeviceTypeEnum": { "description": "Credential device type for passkey authentication methods", "enum": [ "multi_device", "single_device" ], "type": "string" }, "AuthenticationMethodPasskey": { "title": "Passkey Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodBase" }, { "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "default": "passkey", "type": "string", "const": "passkey" }, "credential_backed_up": { "type": "boolean", "description": "Whether the credential was backed up" }, "credential_device_type": { "$ref": "#/components/schemas/CredentialDeviceTypeEnum" }, "identity_user_id": { "type": "string", "description": "The ID of the user identity linked with the authentication method" }, "key_id": { "type": "string", "description": "The ID of the credential" }, "public_key": { "type": "string", "description": "The public key" }, "transports": { "example": [ "internal" ], "items": { "type": "string" }, "type": "array", "description": "The transports used by clients to communicate with the authenticator" }, "user_agent": { "example": "Chrome 131.0.0 / Mac OS X 10.15.7", "type": "string", "description": "The user-agent of the browser used to create the passkey" }, "user_handle": { "type": "string", "description": "The user handle of the user identity" }, "aaguid": { "type": "string", "description": "Authenticator Attestation Globally Unique Identifier" }, "relying_party_id": { "type": "string", "description": "Relying Party Identifier" }, "last_auth_at": { "type": "string", "format": "date-time", "description": "The date and time when the authentication method was last used" } }, "required": [ "type", "credential_backed_up", "credential_device_type", "identity_user_id", "key_id", "public_key", "user_handle" ] } ] }, "AuthenticationMethodMfaBase": { "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodBase" }, { "type": "object", "properties": { "confirmed": { "type": "boolean", "description": "The authentication method status" }, "last_auth_at": { "type": "string", "format": "date-time", "description": "The date and time when the authentication method was last used" } }, "required": [ "confirmed" ] } ] }, "AuthenticationMethodMfaRecoveryCode": { "title": "Recovery Code Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "type": { "const": "recovery-code", "description": "Authentication method type (factor)", "default": "recovery-code", "type": "string" } }, "required": [ "type" ] } ] }, "AuthenticationMethodMfaPushNotification": { "title": "Push Notification Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "name": { "type": "string", "description": "The friendly name of the authentication method" }, "type": { "const": "push-notification", "description": "Authentication method type (factor)", "default": "push-notification", "type": "string" } }, "required": [ "type" ] } ] }, "AuthenticationMethodMfaTotp": { "title": "TOTP Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "name": { "type": "string", "description": "The friendly name of the authentication method" }, "type": { "const": "totp", "description": "Authentication method type (factor)", "default": "totp", "type": "string" } }, "required": [ "type" ] } ] }, "AuthenticationMethodWebAuthn": { "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "name": { "type": "string", "description": "The friendly name of the authentication method" }, "key_id": { "type": "string", "description": "The ID of the credential" }, "public_key": { "type": "string", "description": "The public key" } }, "required": [] } ] }, "AuthenticationMethodWebAuthnPlatform": { "title": "WebAuthn Platform MFA Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodWebAuthn" }, { "type": "object", "properties": { "type": { "const": "webauthn-platform", "description": "Authentication method type (factor)", "default": "webauthn-platform", "type": "string" } }, "required": [ "type" ] } ] }, "AuthenticationMethodWebAuthnRoaming": { "title": "WebAuthn Roaming MFA Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodWebAuthn" }, { "type": "object", "properties": { "type": { "const": "webauthn-roaming", "description": "Authentication method type (factor)", "default": "webauthn-roaming", "type": "string" } }, "required": [ "type" ] } ] }, "PhoneAuthenticationMethodEnum": { "description": "Preferred authentication method for phone-based authentication", "enum": [ "sms", "voice" ], "type": "string" }, "AuthenticationMethodPhone": { "title": "Phone MFA Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "name": { "type": "string", "description": "The friendly name of the authentication method" }, "type": { "const": "phone", "description": "Authentication method type (factor)", "default": "phone", "type": "string" }, "phone_number": { "type": "string", "description": "The destination phone number used to send verification codes via text and voice." }, "preferred_authentication_method": { "$ref": "#/components/schemas/PhoneAuthenticationMethodEnum" } }, "required": [ "type", "phone_number", "preferred_authentication_method" ] } ] }, "AuthenticationMethodEmail": { "title": "Email MFA Authenticator", "allOf": [ { "$ref": "#/components/schemas/AuthenticationMethodMfaBase" }, { "type": "object", "properties": { "name": { "type": "string", "description": "The friendly name of the authentication method" }, "type": { "const": "email", "description": "Authentication method type (factor)", "default": "email", "type": "string" }, "email": { "type": "string", "description": "The email address used to send verification messages." } }, "required": [ "type", "email" ] } ] }, "AuthenticationMethod": { "oneOf": [ { "$ref": "#/components/schemas/AuthenticationMethodPassword", "title": "password" }, { "$ref": "#/components/schemas/AuthenticationMethodPasskey", "title": "passkey" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "title": "recovery-code" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaPushNotification", "title": "push-notification" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaTotp", "title": "totp" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "title": "webauthn-platform" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "title": "webauthn-roaming" }, { "$ref": "#/components/schemas/AuthenticationMethodPhone", "title": "phone" }, { "$ref": "#/components/schemas/AuthenticationMethodEmail", "title": "email" } ], "type": "object", "discriminator": { "propertyName": "type", "mapping": { "password": "#/components/schemas/AuthenticationMethodPassword", "passkey": "#/components/schemas/AuthenticationMethodPasskey", "recovery-code": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "push-notification": "#/components/schemas/AuthenticationMethodMfaPushNotification", "totp": "#/components/schemas/AuthenticationMethodMfaTotp", "webauthn-platform": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "webauthn-roaming": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "phone": "#/components/schemas/AuthenticationMethodPhone", "email": "#/components/schemas/AuthenticationMethodEmail" }, "x-openapi-typescript-ignore": true } }, "ListAuthenticationMethodsResponseContent": { "type": "object", "properties": { "authentication_methods": { "type": "array", "maxItems": 20, "items": { "$ref": "#/components/schemas/AuthenticationMethod" } } }, "required": [ "authentication_methods" ], "additionalProperties": false }, "Connection": { "description": "Name of the database connection", "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[a-zA-Z0-9-]+$" }, "IdentityUserId": { "description": "Identity provider user ID", "type": "string", "minLength": 1, "maxLength": 255, "pattern": "^\\S+$" }, "IdentityAuthenticationMethodBase": { "type": "object", "properties": { "connection": { "$ref": "#/components/schemas/Connection" }, "identity_user_id": { "$ref": "#/components/schemas/IdentityUserId" } } }, "CreatePasskeyAuthenticationMethod": { "title": "Passkey enrollment payload", "allOf": [ { "$ref": "#/components/schemas/IdentityAuthenticationMethodBase" }, { "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "passkey", "default": "passkey", "type": "string" }, "use_exclude_credentials": { "type": "boolean", "x-internal": true, "description": "When enabled, Auth0 includes the user's existing credentials in the excludeCredentials field during passkey enrollment. This prevents users from accidentally registering multiple passkeys from the same authenticator, reducing credential clutter and avoiding confusion at sign-in." } }, "required": [ "type" ] } ] }, "CreateTotpAuthenticationMethod": { "title": "TOTP enrollment payload", "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "totp", "default": "totp", "type": "string" } }, "required": [ "type" ], "additionalProperties": false }, "CreatePushNotificationAuthenticationMethod": { "title": "Push Notification enrollment payload", "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "push-notification", "default": "push-notification", "type": "string" } }, "required": [ "type" ], "additionalProperties": false }, "CreateRecoveryCodeAuthenticationMethod": { "title": "Recovery Code enrollment payload", "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "recovery-code", "default": "recovery-code", "type": "string" } }, "required": [ "type" ], "additionalProperties": false }, "CreateEmailAuthenticationMethod": { "title": "Email enrollment payload", "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "email", "default": "email", "type": "string" }, "email": { "type": "string", "description": "The email address to use for sending one-time codes." } }, "required": [ "type", "email" ], "additionalProperties": false }, "CreatePhoneAuthenticationMethod": { "title": "Phone enrollment payload", "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "phone", "default": "phone", "type": "string" }, "phone_number": { "description": "The destination phone number used to send verification codes via text and voice.", "type": "string" }, "preferred_authentication_method": { "description": "The preferred communication method.", "$ref": "#/components/schemas/PhoneAuthenticationMethodEnum" } }, "required": [ "type", "phone_number" ], "additionalProperties": false }, "CreatePasswordAuthenticationMethod": { "title": "Password authentication method creation payload", "allOf": [ { "$ref": "#/components/schemas/IdentityAuthenticationMethodBase" }, { "type": "object", "properties": { "type": { "description": "Authentication method type (factor)", "const": "password", "default": "password", "type": "string" }, "connection": true, "identity_user_id": true }, "required": [ "type" ], "additionalProperties": false } ] }, "CreateAuthenticationMethodRequestContent": { "description": "Request content for creating an authentication method", "oneOf": [ { "$ref": "#/components/schemas/CreatePasskeyAuthenticationMethod", "title": "passkey" }, { "$ref": "#/components/schemas/CreateTotpAuthenticationMethod", "title": "totp" }, { "$ref": "#/components/schemas/CreatePushNotificationAuthenticationMethod", "title": "push-notification" }, { "$ref": "#/components/schemas/CreateRecoveryCodeAuthenticationMethod", "title": "recovery-code" }, { "$ref": "#/components/schemas/CreateEmailAuthenticationMethod", "title": "email" }, { "$ref": "#/components/schemas/CreatePhoneAuthenticationMethod", "title": "phone" }, { "$ref": "#/components/schemas/CreatePasswordAuthenticationMethod", "title": "password" } ], "type": "object", "discriminator": { "propertyName": "type", "mapping": { "passkey": "#/components/schemas/CreatePasskeyAuthenticationMethod", "totp": "#/components/schemas/CreateTotpAuthenticationMethod", "push-notification": "#/components/schemas/CreatePushNotificationAuthenticationMethod", "recovery-code": "#/components/schemas/CreateRecoveryCodeAuthenticationMethod", "email": "#/components/schemas/CreateEmailAuthenticationMethod", "phone": "#/components/schemas/CreatePhoneAuthenticationMethod", "password": "#/components/schemas/CreatePasswordAuthenticationMethod" }, "x-openapi-typescript-ignore": true } }, "ResidentKeyEnum": { "type": "string", "description": "The resident key requirement", "enum": [ "required" ] }, "UserVerificationEnum": { "type": "string", "description": "The user verification requirement", "enum": [ "required", "preferred", "discouraged" ] }, "AuthenticatorSelection": { "type": "object", "properties": { "residentKey": { "$ref": "#/components/schemas/ResidentKeyEnum" }, "userVerification": { "$ref": "#/components/schemas/UserVerificationEnum" } }, "additionalProperties": false }, "PublicKeyTypeEnum": { "type": "string", "description": "The public key credential type", "enum": [ "public-key" ] }, "PublicKeyCredentialParameter": { "type": "object", "properties": { "alg": { "type": "number" }, "type": { "$ref": "#/components/schemas/PublicKeyTypeEnum" } }, "required": [ "alg", "type" ], "additionalProperties": false }, "RelyingParty": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "name" ], "additionalProperties": false }, "User": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "displayName": { "type": "string" } }, "required": [ "id", "name", "displayName" ], "additionalProperties": false }, "PublicKeyCredentialDescriptor": { "type": "object", "properties": { "id": { "type": "string", "description": "The credential ID." }, "type": { "type": "string", "const": "public-key" }, "transports": { "type": "array", "items": { "type": "string" }, "description": "Hints about the transports the authenticator may use." } }, "required": [ "id", "type" ], "additionalProperties": false }, "PublicKeyCredentialCreationOptions": { "properties": { "authenticatorSelection": { "$ref": "#/components/schemas/AuthenticatorSelection" }, "challenge": { "type": "string" }, "pubKeyCredParams": { "example": [ { "type": "public-key", "alg": -8 }, { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 } ], "items": { "$ref": "#/components/schemas/PublicKeyCredentialParameter" }, "type": "array" }, "rp": { "$ref": "#/components/schemas/RelyingParty" }, "timeout": { "type": "number", "example": 60000 }, "user": { "$ref": "#/components/schemas/User" }, "excludeCredentials": { "type": "array", "x-internal": true, "items": { "$ref": "#/components/schemas/PublicKeyCredentialDescriptor" }, "description": "Existing credentials to exclude from re-registration." } }, "required": [ "challenge", "pubKeyCredParams", "rp", "user" ], "type": "object" }, "PasskeyCreationResponse": { "title": "Passkey enrollment information", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment." }, "authn_params_public_key": { "$ref": "#/components/schemas/PublicKeyCredentialCreationOptions" } }, "required": [ "auth_session", "authn_params_public_key" ], "type": "object" }, "MfaBaseCreationResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier for the authentication method." }, "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment." } }, "required": [ "id", "auth_session" ] }, "WebAuthnCreationResponse": { "allOf": [ { "$ref": "#/components/schemas/MfaBaseCreationResponse" }, { "title": "WebAuthn enrollment information", "properties": { "authn_params_public_key": { "$ref": "#/components/schemas/PublicKeyCredentialCreationOptions" } }, "required": [ "authn_params_public_key" ], "type": "object" } ] }, "QrCodeCreationResponse": { "allOf": [ { "$ref": "#/components/schemas/MfaBaseCreationResponse" }, { "title": "TOTP/Push enrollment information", "type": "object", "properties": { "barcode_uri": { "type": "string", "description": "The URI for the QR code to be scanned by the authenticator." }, "manual_input_code": { "type": "string", "description": "The manual input code for the authenticator in case QR codes cannot be used." } }, "required": [ "barcode_uri" ] } ] }, "RecoveryCodeCreationResponse": { "allOf": [ { "$ref": "#/components/schemas/MfaBaseCreationResponse" }, { "title": "Recovery Code enrollment information", "type": "object", "properties": { "recovery_code": { "type": "string", "description": "The recovery code value." } }, "required": [ "recovery_code" ] } ] }, "PasswordCharacterTypeEnum": { "type": "string", "enum": [ "uppercase", "lowercase", "number", "special" ], "description": "Character type for password complexity requirements" }, "PasswordCharacterTypeRuleEnum": { "type": "string", "enum": [ "all", "three_of_four" ], "description": "How character types are enforced in password complexity" }, "PasswordIdenticalCharactersEnum": { "type": "string", "enum": [ "allow", "block" ], "description": "Whether to allow 3 or more consecutive identical characters" }, "PasswordSequentialCharactersEnum": { "type": "string", "enum": [ "allow", "block" ], "description": "Whether to allow sequential characters" }, "PasswordMaxLengthExceededEnum": { "type": "string", "enum": [ "truncate", "error" ], "description": "Behavior when password exceeds maximum length" }, "PasswordComplexityPolicy": { "type": "object", "description": "Password complexity requirements", "properties": { "min_length": { "type": "integer", "description": "Minimum password length" }, "character_types": { "type": "array", "items": { "$ref": "#/components/schemas/PasswordCharacterTypeEnum" }, "description": "Required character types" }, "character_type_rule": { "$ref": "#/components/schemas/PasswordCharacterTypeRuleEnum" }, "identical_characters": { "$ref": "#/components/schemas/PasswordIdenticalCharactersEnum" }, "sequential_characters": { "$ref": "#/components/schemas/PasswordSequentialCharactersEnum" }, "max_length_exceeded": { "$ref": "#/components/schemas/PasswordMaxLengthExceededEnum" } }, "required": [ "min_length", "character_types", "character_type_rule", "identical_characters", "sequential_characters", "max_length_exceeded" ], "additionalProperties": false }, "PasswordProfileDataPolicy": { "type": "object", "description": "Settings for blocking personal information in passwords", "properties": { "active": { "type": "boolean", "description": "Whether to block personal information (name, email, etc.) in passwords" }, "blocked_fields": { "type": "array", "items": { "type": "string" }, "description": "User profile fields to block from passwords (e.g., 'name', 'email', 'user_metadata.first')" } }, "required": [ "active", "blocked_fields" ], "additionalProperties": false }, "PasswordHistoryPolicy": { "type": "object", "description": "Password history enforcement settings", "properties": { "active": { "type": "boolean", "description": "Whether password history is enforced" }, "size": { "type": "integer", "description": "Number of previous passwords to remember and prevent reuse" } }, "required": [ "active", "size" ], "additionalProperties": false }, "PasswordDictionaryDefaultEnum": { "type": "string", "enum": [ "en_10k", "en_100k" ], "description": "Default dictionary to use for checking weak passwords" }, "PasswordDictionaryPolicy": { "type": "object", "description": "Dictionary checking settings to block weak or banned passwords", "properties": { "active": { "type": "boolean", "description": "Whether dictionary checking is enabled" }, "default": { "$ref": "#/components/schemas/PasswordDictionaryDefaultEnum" } }, "required": [ "active", "default" ], "additionalProperties": false }, "PasswordAuthenticationMethodPolicy": { "type": "object", "description": "The password policy configuration for the connection in flexible format.", "properties": { "complexity": { "$ref": "#/components/schemas/PasswordComplexityPolicy" }, "profile_data": { "$ref": "#/components/schemas/PasswordProfileDataPolicy" }, "history": { "$ref": "#/components/schemas/PasswordHistoryPolicy" }, "dictionary": { "$ref": "#/components/schemas/PasswordDictionaryPolicy" } }, "required": [ "complexity", "profile_data", "history", "dictionary" ], "additionalProperties": false }, "PasswordCreationResponse": { "title": "Password enrollment information", "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier for the password authentication method." }, "policy": { "$ref": "#/components/schemas/PasswordAuthenticationMethodPolicy" }, "auth_session": { "type": "string", "description": "The unique session identifier for the password change operation." } }, "required": [ "id", "policy", "auth_session" ] }, "CreateAuthenticationMethodResponseContent": { "anyOf": [ { "$ref": "#/components/schemas/PasskeyCreationResponse" }, { "$ref": "#/components/schemas/WebAuthnCreationResponse" }, { "$ref": "#/components/schemas/MfaBaseCreationResponse", "title": "Email/Phone enrollment information" }, { "$ref": "#/components/schemas/QrCodeCreationResponse" }, { "$ref": "#/components/schemas/RecoveryCodeCreationResponse" }, { "$ref": "#/components/schemas/PasswordCreationResponse" } ] }, "PathAuthenticationMethodId": { "type": "string" }, "GetAuthenticationMethodResponseContent": { "oneOf": [ { "$ref": "#/components/schemas/AuthenticationMethodPassword", "title": "password" }, { "$ref": "#/components/schemas/AuthenticationMethodPasskey", "title": "passkey" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "title": "recovery-code" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaPushNotification", "title": "push-notification" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaTotp", "title": "totp" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "title": "webauthn-platform" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "title": "webauthn-roaming" }, { "$ref": "#/components/schemas/AuthenticationMethodPhone", "title": "phone" }, { "$ref": "#/components/schemas/AuthenticationMethodEmail", "title": "email" } ], "type": "object", "discriminator": { "propertyName": "type", "mapping": { "password": "#/components/schemas/AuthenticationMethodPassword", "passkey": "#/components/schemas/AuthenticationMethodPasskey", "recovery-code": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "push-notification": "#/components/schemas/AuthenticationMethodMfaPushNotification", "totp": "#/components/schemas/AuthenticationMethodMfaTotp", "webauthn-platform": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "webauthn-roaming": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "phone": "#/components/schemas/AuthenticationMethodPhone", "email": "#/components/schemas/AuthenticationMethodEmail" }, "x-openapi-typescript-ignore": true } }, "UpdateAuthenticationMethodRequestContent": { "description": "Request content for updating an authentication method", "type": "object", "properties": { "name": { "description": "The friendly name of the authentication method", "type": "string" }, "preferred_authentication_method": { "description": "The preferred authentication method (for phone authenticators)", "$ref": "#/components/schemas/PhoneAuthenticationMethodEnum" } }, "additionalProperties": false }, "UpdateAuthenticationMethodResponseContent": { "oneOf": [ { "$ref": "#/components/schemas/AuthenticationMethodPassword", "title": "password" }, { "$ref": "#/components/schemas/AuthenticationMethodPasskey", "title": "passkey" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "title": "recovery-code" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaPushNotification", "title": "push-notification" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaTotp", "title": "totp" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "title": "webauthn-platform" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "title": "webauthn-roaming" }, { "$ref": "#/components/schemas/AuthenticationMethodPhone", "title": "phone" }, { "$ref": "#/components/schemas/AuthenticationMethodEmail", "title": "email" } ], "type": "object", "discriminator": { "propertyName": "type", "mapping": { "password": "#/components/schemas/AuthenticationMethodPassword", "passkey": "#/components/schemas/AuthenticationMethodPasskey", "recovery-code": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "push-notification": "#/components/schemas/AuthenticationMethodMfaPushNotification", "totp": "#/components/schemas/AuthenticationMethodMfaTotp", "webauthn-platform": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "webauthn-roaming": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "phone": "#/components/schemas/AuthenticationMethodPhone", "email": "#/components/schemas/AuthenticationMethodEmail" }, "x-openapi-typescript-ignore": true } }, "AuthenticatorAttachmentEnum": { "type": "string", "description": "The authenticator attachment method", "enum": [ "platform", "cross-platform" ] }, "ClientExtensionResults": { "type": "object" }, "AuthenticatorAttestationResponseData": { "type": "object", "properties": { "attestationObject": { "maxLength": 2000, "type": "string" }, "clientDataJSON": { "maxLength": 1000, "type": "string" }, "transports": { "items": { "maxLength": 100, "type": "string" }, "type": "array" } }, "required": [ "attestationObject", "clientDataJSON" ], "additionalProperties": false }, "AuthenticatorAttestationResponse": { "properties": { "authenticatorAttachment": { "$ref": "#/components/schemas/AuthenticatorAttachmentEnum" }, "clientExtensionResults": { "$ref": "#/components/schemas/ClientExtensionResults" }, "id": { "maxLength": 1364, "type": "string" }, "rawId": { "maxLength": 1364, "type": "string" }, "response": { "$ref": "#/components/schemas/AuthenticatorAttestationResponseData" }, "type": { "const": "public-key" } }, "required": [ "id", "rawId", "response", "type" ], "type": "object" }, "VerifyPasskeyAuthenticationMethod": { "title": "Passkey verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "authn_response": { "$ref": "#/components/schemas/AuthenticatorAttestationResponse" } }, "required": [ "auth_session", "authn_response" ], "additionalProperties": false }, "NoControlCharString": { "type": "string", "pattern": "^[^\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029\\u202a-\\u202e\\u2066-\\u2069]*$" }, "NewPasswordString": { "description": "The new password to set for the user", "allOf": [ { "$ref": "#/components/schemas/NoControlCharString" }, { "minLength": 1, "maxLength": 256 } ] }, "VerifyPasswordAuthenticationMethod": { "title": "Password verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the password change operation as returned by POST /authentication-methods" }, "new_password": { "$ref": "#/components/schemas/NewPasswordString" } }, "required": [ "auth_session", "new_password" ], "additionalProperties": false }, "VerifyWebAuthnPlatformAuthenticationMethod": { "title": "WebAuthn Platform verification payload", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "authn_response": { "$ref": "#/components/schemas/AuthenticatorAttestationResponse" } }, "required": [ "auth_session", "authn_response" ], "type": "object", "additionalProperties": false }, "VerifyWebAuthnRoamingAuthenticationMethod": { "title": "WebAuthn Roaming verification payload", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "authn_response": { "$ref": "#/components/schemas/AuthenticatorAttestationResponse" } }, "required": [ "auth_session", "authn_response" ], "type": "object", "additionalProperties": false }, "VerifyPushNotificationAuthenticationMethod": { "title": "Push Notification verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" } }, "required": [ "auth_session" ], "additionalProperties": false }, "VerifyRecoveryCodeAuthenticationMethod": { "title": "Recovery Code verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" } }, "required": [ "auth_session" ], "additionalProperties": false }, "VerifyEmailAuthenticationMethod": { "title": "Email verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "otp_code": { "type": "string", "description": "The one-time password code sent to the email address." } }, "required": [ "auth_session", "otp_code" ], "additionalProperties": false }, "VerifyPhoneAuthenticationMethod": { "title": "Phone verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "otp_code": { "type": "string", "description": "The one-time password code sent to the phone number." } }, "required": [ "auth_session", "otp_code" ], "additionalProperties": false }, "VerifyTotpAuthenticationMethod": { "title": "TOTP verification payload", "type": "object", "properties": { "auth_session": { "type": "string", "description": "The unique session identifier for the enrollment as returned by POST /authentication-methods" }, "otp_code": { "type": "string", "description": "The one-time password code retrieved from the TOTP application." } }, "required": [ "auth_session", "otp_code" ], "additionalProperties": false }, "VerifyAuthenticationMethodRequestContent": { "description": "Request content for verifying an authentication method", "anyOf": [ { "$ref": "#/components/schemas/VerifyPasskeyAuthenticationMethod", "x-type": "passkey" }, { "$ref": "#/components/schemas/VerifyPasswordAuthenticationMethod", "x-type": "password" }, { "$ref": "#/components/schemas/VerifyWebAuthnPlatformAuthenticationMethod", "x-type": "webauthn-platform" }, { "$ref": "#/components/schemas/VerifyWebAuthnRoamingAuthenticationMethod", "x-type": "webauthn-roaming" }, { "$ref": "#/components/schemas/VerifyPushNotificationAuthenticationMethod", "x-type": "push-notification" }, { "$ref": "#/components/schemas/VerifyRecoveryCodeAuthenticationMethod", "x-type": "recovery-code" }, { "$ref": "#/components/schemas/VerifyEmailAuthenticationMethod", "x-type": "email" }, { "$ref": "#/components/schemas/VerifyPhoneAuthenticationMethod", "x-type": "phone" }, { "$ref": "#/components/schemas/VerifyTotpAuthenticationMethod", "x-type": "totp" } ] }, "VerifyAuthenticationMethodResponseContent": { "oneOf": [ { "$ref": "#/components/schemas/AuthenticationMethodPassword", "title": "password" }, { "$ref": "#/components/schemas/AuthenticationMethodPasskey", "title": "passkey" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "title": "recovery-code" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaPushNotification", "title": "push-notification" }, { "$ref": "#/components/schemas/AuthenticationMethodMfaTotp", "title": "totp" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "title": "webauthn-platform" }, { "$ref": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "title": "webauthn-roaming" }, { "$ref": "#/components/schemas/AuthenticationMethodPhone", "title": "phone" }, { "$ref": "#/components/schemas/AuthenticationMethodEmail", "title": "email" } ], "type": "object", "discriminator": { "propertyName": "type", "mapping": { "password": "#/components/schemas/AuthenticationMethodPassword", "passkey": "#/components/schemas/AuthenticationMethodPasskey", "recovery-code": "#/components/schemas/AuthenticationMethodMfaRecoveryCode", "push-notification": "#/components/schemas/AuthenticationMethodMfaPushNotification", "totp": "#/components/schemas/AuthenticationMethodMfaTotp", "webauthn-platform": "#/components/schemas/AuthenticationMethodWebAuthnPlatform", "webauthn-roaming": "#/components/schemas/AuthenticationMethodWebAuthnRoaming", "phone": "#/components/schemas/AuthenticationMethodPhone", "email": "#/components/schemas/AuthenticationMethodEmail" }, "x-openapi-typescript-ignore": true } }, "DisplayEnum": { "enum": [ "page", "popup", "touch", "wap" ], "description": "Suggests how the IdP should display the authentication interface to the user." }, "PromptEnum": { "enum": [ "none", "login", "consent", "select_account" ], "description": "Controls whether the IdP should prompt the user for authentication or consent." }, "AuthorizationParams": { "title": "Authorization Parameters", "description": "Authorization parameters to be sent to the underlying Identity Provider (IdP) during the authorization request. These parameters influence how the IdP processes the authorization flow and what permissions are requested.", "type": "object", "properties": { "acr_values": { "type": "string", "description": "Specifies the desired Authentication Context Class Reference values, which indicate the required level of authentication (e.g., multi-factor, passwordless). The Identity Provider (IdP) may enforce a specific assurance level based on these values.", "minLength": 1, "maxLength": 1024 }, "audience": { "type": "string", "description": "Defines the intended recipient of the access token, typically indicating who the token is meant for (e.g., an API identifier).", "minLength": 1, "maxLength": 512 }, "resource": { "type": "string", "description": "Specifies which resource server the client is requesting access to (used in OAuth 2.0 Resource Indicators).", "minLength": 1, "maxLength": 512 }, "display": { "$ref": "#/components/schemas/DisplayEnum" }, "id_token_hint": { "type": "string", "description": "Provides a previously issued id_token to the IdP. It can be used to suggest which user is being authenticated or to facilitate logout requests.", "minLength": 1, "maxLength": 4096 }, "login_hint": { "type": "string", "description": "Supplies a hint about the user's identifier (like an email address or username) to pre-populate the login form.", "minLength": 1, "maxLength": 255 }, "max_age": { "type": "integer", "description": "Indicates the maximum time (in seconds) since the user's last authentication. If exceeded, the IdP forces the user to re-authenticate.", "minimum": 0, "maximum": 2147483647 }, "prompt": { "$ref": "#/components/schemas/PromptEnum" }, "ui_locales": { "type": "string", "description": "Suggests the preferred languages for the user interface, passed as a space-separated list of BCP47 language tags (e.g., 'en', 'es', 'fr').", "pattern": "^[a-zA-Z]{2}(-[a-zA-Z]{2})?(\\s[a-zA-Z]{2}(-[a-zA-Z]{2})?)*$", "minLength": 2, "maxLength": 100 } }, "additionalProperties": false }, "CreateConnectedAccountsRequestContent": { "description": "Request body for creating an account connection request.", "type": "object", "properties": { "connection": { "type": "string", "description": "The name of the connection to link the account with (e.g., 'google-oauth2', 'facebook').", "minLength": 1, "maxLength": 128 }, "redirect_uri": { "type": "string", "format": "uri", "description": "The URI to redirect to after the connection process completes.", "maxLength": 2048 }, "state": { "type": "string", "description": "An opaque value used to maintain state between the request and callback.", "minLength": 1, "maxLength": 4096 }, "code_challenge": { "type": "string", "description": "The PKCE code challenge derived from the code verifier.", "minLength": 43, "maxLength": 128 }, "code_challenge_method": { "type": "string", "description": "The method used to derive the code challenge. Required when code_challenge is provided.", "const": "S256" }, "scopes": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 255 }, "minItems": 1, "maxItems": 100, "uniqueItems": true, "description": "Defines the permissions that the client requests from the Identity Provider. Must include the standard scopes used to identify the user (e.g. 'openid', 'email', 'profile'), the scope required to obtain refresh tokens if needed (e.g. 'offline_access'), and any custom scopes the client needs to access protected resources.", "example": [ "openid", "offline_access", "read:tasks", "write:tasks" ] }, "authorization_params": { "$ref": "#/components/schemas/AuthorizationParams" } }, "required": [ "connection", "redirect_uri" ], "dependentRequired": { "code_challenge": [ "code_challenge_method" ] }, "additionalProperties": false }, "ConnectParams": { "type": "object", "description": "Parameters to be used with the connect URI.", "properties": { "ticket": { "type": "string", "description": "The ticket identifier to be used with the connection URI." } }, "required": [ "ticket" ], "additionalProperties": false }, "CreateConnectedAccountsResponseContent": { "type": "object", "properties": { "connect_uri": { "type": "string", "format": "uri", "description": "The base URI to initiate the account connection flow." }, "auth_session": { "type": "string", "description": "The authentication session identifier.", "maxLength": 64 }, "connect_params": { "$ref": "#/components/schemas/ConnectParams" }, "expires_in": { "type": "integer", "description": "The number of seconds until the ticket expires.", "minimum": 1 } }, "required": [ "connect_uri", "auth_session", "connect_params", "expires_in" ], "additionalProperties": false }, "CompleteConnectedAccountsRequestContent": { "type": "object", "properties": { "auth_session": { "type": "string", "description": "The authentication session identifier", "maxLength": 64 }, "connect_code": { "type": "string", "description": "The authorization code returned from the connect flow", "minLength": 1, "maxLength": 46 }, "redirect_uri": { "type": "string", "format": "uri", "description": "The redirect URI used in the original request", "maxLength": 2048 }, "code_verifier": { "type": "string", "description": "The PKCE code verifier", "minLength": 43, "maxLength": 128 } }, "required": [ "auth_session", "connect_code", "redirect_uri" ], "additionalProperties": false }, "AccessTypeEnum": { "type": "string", "enum": [ "offline" ], "description": "The access type, always 'offline'" }, "CompleteConnectedAccountsResponseContent": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the connected account" }, "connection": { "type": "string", "description": "The connection name" }, "access_type": { "$ref": "#/components/schemas/AccessTypeEnum" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Array of scopes granted" }, "created_at": { "type": "string", "format": "date-time", "description": "ISO date string of when the connected account was created" }, "expires_at": { "type": "string", "format": "date-time", "description": "ISO date string of when the refresh token expires (optional)" } }, "required": [ "id", "connection", "access_type", "created_at" ], "additionalProperties": false }, "ConnectionNamesFilter": { "oneOf": [ { "type": "string", "maxLength": 128 }, { "type": "array", "items": { "type": "string", "maxLength": 128 }, "minItems": 1, "maxItems": 20 } ] }, "ConnectedAccountAccessTypeEnum": { "type": "string", "description": "The access type for to the connected account.", "enum": [ "offline" ] }, "ConnectedAccount": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier for the connected account." }, "connection": { "type": "string", "description": "The name of the connection associated with the account." }, "access_type": { "$ref": "#/components/schemas/ConnectedAccountAccessTypeEnum" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "The scopes granted for this connected account." }, "created_at": { "type": "string", "format": "date-time", "description": "ISO 8601 timestamp when the connected account was created." }, "expires_at": { "type": "string", "format": "date-time", "description": "ISO 8601 timestamp when the connected account expires." }, "org_id": { "type": "string", "description": "The organization ID this connected account is scoped to. Only present for accounts bound to an organization." } }, "required": [ "id", "connection", "access_type", "scopes", "created_at" ] }, "ListConnectedAccountsResponseContent": { "type": "object", "properties": { "accounts": { "type": "array", "maxItems": 20, "items": { "$ref": "#/components/schemas/ConnectedAccount" } }, "next": { "type": "string", "description": "The token to retrieve the next page of connected accounts (if there is one)" } }, "required": [ "accounts" ], "additionalProperties": false }, "ConnectedAccountConnection": { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the connection." }, "strategy": { "type": "string", "description": "The strategy used by the connection (e.g., 'oauth2', 'oidc')." }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "The available scopes for this connection." } }, "required": [ "name", "strategy" ], "additionalProperties": false }, "ListConnectedAccountsConnectionsResponseContent": { "type": "object", "properties": { "connections": { "type": "array", "maxItems": 20, "items": { "$ref": "#/components/schemas/ConnectedAccountConnection" } }, "next": { "type": "string", "description": "The token to retrieve the next page of connections (if there is one)" } }, "required": [ "connections" ], "additionalProperties": false }, "ConnectedAccountId": { "type": "string", "description": "The unique identifier for a connected account", "pattern": "^cac_[A-Za-z0-9]+$" }, "AuthorizationDetailsItem": { "type": "object", "description": "A single authorization details object as defined by RFC 9396. Only `type` is guaranteed to be present; all remaining fields are specific to the authorization details type, so the object is intentionally open.", "properties": { "type": { "type": "string", "description": "The authorization details type identifier, as defined by RFC 9396." } }, "additionalProperties": true }, "ConsentDetails": { "type": "object", "description": "Details of the consent request", "properties": { "binding_message": { "type": "string", "description": "A human-readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user." }, "audience": { "type": "string", "description": "The audience (API identifier) that the consent was granted for." }, "scope": { "type": "array", "items": { "type": "string" }, "description": "The scopes that were requested for this consent." }, "authorization_details": { "type": "array", "items": { "$ref": "#/components/schemas/AuthorizationDetailsItem" }, "description": "The full authorization details objects associated with this consent." } }, "additionalProperties": false }, "Consent": { "type": "object", "description": "A consent record representing user authorization for a specific client and scope.", "properties": { "id": { "type": "string", "description": "The unique identifier of the consent.", "example": "cns_abc123def456" }, "client_id": { "type": "string", "description": "The client ID that the consent was granted to." }, "requested_details": { "$ref": "#/components/schemas/ConsentDetails" }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the consent was created." }, "expires_at": { "type": "string", "format": "date-time", "description": "The date and time when the consent expires." }, "challenge": { "type": "string", "description": "The MFA challenge associated with this consent when initiated via push notification. Only present when a push notification was associated." } }, "required": [ "id", "client_id", "requested_details", "created_at", "expires_at" ], "additionalProperties": false }, "ListConsentsResponseContent": { "type": "object", "properties": { "consents": { "type": "array", "description": "List of consents for the authenticated user.", "items": { "$ref": "#/components/schemas/Consent" } } }, "required": [ "consents" ], "additionalProperties": false }, "GetConsentResponseContent": { "allOf": [ { "$ref": "#/components/schemas/Consent" } ] }, "ConsentDecisionEnum": { "type": "string", "enum": [ "approve", "deny" ], "description": "The user's decision on the consent request." }, "DecideConsentRequestContent": { "type": "object", "description": "The user's decision on a pending consent request.", "properties": { "decision": { "$ref": "#/components/schemas/ConsentDecisionEnum" }, "signature": { "type": "string", "description": "Compact JWS serialization of the signed consent payload, produced by the device. Must be provided together with `kid`." }, "kid": { "type": "string", "description": "Key ID of the registered consent signing key used to produce `signature`. Must be provided together with `signature`." }, "challenge_response": { "type": "string", "description": "Challenge response JWT that the device builds with the Guardian SDK from the consent's `challenge`. Send it when the consent was initiated through a push notification, to resolve the associated MFA transaction." } }, "required": [ "decision" ], "dependentRequired": { "signature": [ "kid" ], "kid": [ "signature" ] }, "additionalProperties": false }, "ConsentDecisionStatusEnum": { "type": "string", "enum": [ "approved", "denied" ], "description": "The updated status of the consent." }, "DecideConsentResponseContent": { "type": "object", "description": "The result of a consent decision.", "properties": { "consent_id": { "type": "string", "description": "The unique identifier of the consent record." }, "status": { "$ref": "#/components/schemas/ConsentDecisionStatusEnum" } }, "required": [ "consent_id", "status" ], "additionalProperties": false }, "GetSigningKeyConsentResponseContent": { "type": "object", "description": "Summary of a consent signing key registered for a user.", "properties": { "kid": { "type": "string", "description": "The key identifier Auth0 assigned to this key.", "minLength": 1, "maxLength": 128 }, "device_identifier": { "type": "string", "description": "A human-readable label for the device holding the corresponding private key.", "minLength": 1, "maxLength": 128 }, "created_at": { "type": "string", "format": "date-time", "description": "When the key was registered." }, "expires_at": { "type": "string", "format": "date-time", "description": "When the key expires and can no longer be used to verify consent decisions." } }, "required": [ "kid", "device_identifier", "created_at", "expires_at" ], "additionalProperties": false }, "ListSigningKeysConsentResponseContent": { "type": "object", "properties": { "keys": { "type": "array", "description": "List of consent signing keys registered for the authenticated user.", "items": { "$ref": "#/components/schemas/GetSigningKeyConsentResponseContent" } } }, "required": [ "keys" ], "additionalProperties": false }, "ConsentSigningKeyEcJwkRequest": { "type": "object", "description": "A public ECDSA P-256 JWK to register for signing consent decisions. Private key material must never be supplied. The key identifier is assigned by Auth0 and must not be supplied.", "properties": { "kty": { "type": "string", "description": "The key type. Elliptic Curve.", "const": "EC" }, "crv": { "type": "string", "description": "The curve the key is defined over. Only P-256 is supported.", "const": "P-256" }, "alg": { "type": "string", "description": "The algorithm the key is intended to be used with.", "const": "ES256" }, "use": { "type": "string", "description": "The intended use of the key. The key must be a signing key.", "const": "sig" }, "x": { "type": "string", "description": "The base64url-encoded x coordinate of the public key.", "pattern": "^[A-Za-z0-9_-]{43}$" }, "y": { "type": "string", "description": "The base64url-encoded y coordinate of the public key.", "pattern": "^[A-Za-z0-9_-]{43}$" } }, "required": [ "kty", "crv", "alg", "use", "x", "y" ], "additionalProperties": false }, "ConsentSigningKeyRsaAlgorithmEnum": { "type": "string", "description": "The RSA signing algorithm the key is intended to be used with.", "enum": [ "RS256", "PS256" ] }, "ConsentSigningKeyRsaJwkRequest": { "type": "object", "description": "A public RSA JWK to register for signing consent decisions. Private key material must never be supplied. The key identifier is assigned by Auth0 and must not be supplied. RSA keys are supported but atypical for hardware-bound device keys; prefer ES256.", "properties": { "kty": { "type": "string", "description": "The key type. RSA.", "const": "RSA" }, "alg": { "$ref": "#/components/schemas/ConsentSigningKeyRsaAlgorithmEnum" }, "use": { "type": "string", "description": "The intended use of the key. The key must be a signing key.", "const": "sig" }, "n": { "type": "string", "description": "The base64url-encoded modulus of the public key. A 2048-bit modulus encodes to 342 characters, a 4096-bit one to 683. The upper bound is 1000 rather than consents-api's 1400 because this service compiles patterns with RE2, which rejects bounded repetition above 1000; 1000 still admits moduli well beyond 4096 bits.", "pattern": "^[A-Za-z0-9_-]{342,1000}$" }, "e": { "type": "string", "description": "The base64url-encoded public exponent of the public key.", "pattern": "^[A-Za-z0-9_-]{1,16}$" } }, "required": [ "kty", "alg", "use", "n", "e" ], "additionalProperties": false }, "ConsentSigningKeyJwkRequest": { "description": "A public JWK to register for signing consent decisions. ES256 (ECDSA P-256) is the expected algorithm; RS256 and PS256 are also accepted. Only public key material may be supplied, and the key identifier is assigned by Auth0.", "type": "object", "oneOf": [ { "$ref": "#/components/schemas/ConsentSigningKeyEcJwkRequest", "title": "ec" }, { "$ref": "#/components/schemas/ConsentSigningKeyRsaJwkRequest", "title": "rsa" } ], "discriminator": { "propertyName": "kty", "mapping": { "EC": "#/components/schemas/ConsentSigningKeyEcJwkRequest", "RSA": "#/components/schemas/ConsentSigningKeyRsaJwkRequest" }, "x-openapi-typescript-ignore": true } }, "CreateConsentSigningKeyRequestContent": { "description": "Request body for registering a consent signing key.", "type": "object", "properties": { "jwk": { "$ref": "#/components/schemas/ConsentSigningKeyJwkRequest" }, "device_identifier": { "type": "string", "description": "A human-readable label for the device holding the corresponding private key. This is a label only and is not a guarantee that the key is bound to that device.", "minLength": 1, "maxLength": 128 }, "expires_at": { "type": "string", "format": "date-time", "description": "When the key should expire. Optional; defaults to the maximum 2 year lifetime. Must be at least 1 hour in the future and no later than the default." } }, "required": [ "jwk", "device_identifier" ], "additionalProperties": false }, "ConsentSigningKeyEcJwk": { "type": "object", "description": "A registered public ECDSA P-256 JWK used to sign consent decisions. Private key material is never stored or returned.", "properties": { "kty": { "type": "string", "description": "The key type. Elliptic Curve.", "const": "EC" }, "crv": { "type": "string", "description": "The curve the key is defined over.", "const": "P-256" }, "alg": { "type": "string", "description": "The algorithm the key is intended to be used with.", "const": "ES256" }, "use": { "type": "string", "description": "The intended use of the key.", "const": "sig" }, "x": { "type": "string", "description": "The base64url-encoded x coordinate of the public key.", "pattern": "^[A-Za-z0-9_-]{43}$" }, "y": { "type": "string", "description": "The base64url-encoded y coordinate of the public key.", "pattern": "^[A-Za-z0-9_-]{43}$" }, "kid": { "type": "string", "description": "The key identifier Auth0 assigned to this key. Matches the top-level `kid`.", "minLength": 1, "maxLength": 128 } }, "required": [ "kty", "crv", "alg", "use", "x", "y", "kid" ], "additionalProperties": false }, "ConsentSigningKeyRsaJwk": { "type": "object", "description": "A registered public RSA JWK used to sign consent decisions. Private key material is never stored or returned.", "properties": { "kty": { "type": "string", "description": "The key type. RSA.", "const": "RSA" }, "alg": { "$ref": "#/components/schemas/ConsentSigningKeyRsaAlgorithmEnum" }, "use": { "type": "string", "description": "The intended use of the key.", "const": "sig" }, "n": { "type": "string", "description": "The base64url-encoded modulus of the public key.", "pattern": "^[A-Za-z0-9_-]{342,1000}$" }, "e": { "type": "string", "description": "The base64url-encoded public exponent of the public key.", "pattern": "^[A-Za-z0-9_-]{1,16}$" }, "kid": { "type": "string", "description": "The key identifier Auth0 assigned to this key. Matches the top-level `kid`.", "minLength": 1, "maxLength": 128 } }, "required": [ "kty", "alg", "use", "n", "e", "kid" ], "additionalProperties": false }, "ConsentSigningKeyJwk": { "description": "A registered public JWK used to sign consent decisions, including the key identifier Auth0 assigned to it.", "type": "object", "oneOf": [ { "$ref": "#/components/schemas/ConsentSigningKeyEcJwk", "title": "ec" }, { "$ref": "#/components/schemas/ConsentSigningKeyRsaJwk", "title": "rsa" } ], "discriminator": { "propertyName": "kty", "mapping": { "EC": "#/components/schemas/ConsentSigningKeyEcJwk", "RSA": "#/components/schemas/ConsentSigningKeyRsaJwk" }, "x-openapi-typescript-ignore": true } }, "ConsentSigningKey": { "type": "object", "description": "A consent signing key registered by the authenticated user.", "properties": { "kid": { "type": "string", "description": "The unique identifier of the registered signing key. Supply this when signing a consent decision so the signature can be verified against this key.", "example": "csk_72jbvv7LfRKYp59gtRLtkn" }, "jwk": { "$ref": "#/components/schemas/ConsentSigningKeyJwk" }, "device_identifier": { "type": "string", "description": "The human-readable label for the device holding the corresponding private key." }, "created_at": { "type": "string", "format": "date-time", "description": "The date and time when the signing key was registered." }, "expires_at": { "type": "string", "format": "date-time", "description": "The date and time when the signing key expires. After this point the key can no longer be used to sign consent decisions and must be replaced." } }, "required": [ "kid", "jwk", "device_identifier", "created_at", "expires_at" ], "additionalProperties": false }, "Organization": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the organization." }, "name": { "type": "string", "description": "The name (slug) of the organization." }, "display_name": { "type": "string", "description": "The human-readable display name of the organization." } }, "required": [ "id", "name" ], "additionalProperties": false }, "ListOrganizationsResponseContent": { "type": "object", "properties": { "organizations": { "type": "array", "maxItems": 100, "items": { "$ref": "#/components/schemas/Organization" } }, "next": { "type": "string", "description": "The token to retrieve the next page of organizations (if there is one)" } }, "required": [ "organizations" ], "additionalProperties": false }, "OrganizationBrandingColors": { "type": "object", "properties": { "primary": { "type": "string", "pattern": "^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$", "description": "Primary brand color as a hex value." }, "page_background": { "type": "string", "pattern": "^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$", "description": "Page background color as a hex value." } }, "required": [ "primary", "page_background" ], "additionalProperties": false }, "OrganizationBranding": { "type": "object", "properties": { "logo_url": { "type": "string", "format": "uri", "pattern": "^https.*", "minLength": 1, "maxLength": 1024, "description": "HTTPS URL of the organization logo." }, "colors": { "$ref": "#/components/schemas/OrganizationBrandingColors" } }, "additionalProperties": false }, "CreateOrganizationRequestContent": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 50, "pattern": "^[\\da-z]([\\d_a-z-]*[\\da-z])?$", "description": "The name (slug) of the organization. May contain only lowercase letters, digits, hyphens, and underscores, must start and end with a letter or digit, and cannot start with 'org_'." }, "display_name": { "type": "string", "minLength": 1, "maxLength": 255, "description": "The human-readable display name of the organization." }, "branding": { "$ref": "#/components/schemas/OrganizationBranding" } }, "required": [ "name" ], "additionalProperties": false }, "CreateOrganizationResponseContent": { "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier of the organization." }, "name": { "type": "string", "description": "The name (slug) of the organization." }, "display_name": { "type": "string", "description": "The human-readable display name of the organization." }, "branding": { "$ref": "#/components/schemas/OrganizationBranding" } }, "required": [ "id", "name" ], "additionalProperties": false }, "ProfileFieldEnum": { "type": "string", "enum": [ "given_name", "family_name", "name", "nickname", "picture", "email", "email_verified", "phone_number", "phone_verified", "username", "user_metadata", "created_at", "updated_at", "user_id", "profile_policy" ] }, "ProfileFields": { "type": "array", "items": { "$ref": "#/components/schemas/ProfileFieldEnum" } }, "IncludeFieldsEnum": { "type": "string", "enum": [ "true", "false" ], "default": "true", "description": "When true (default), return only the fields named in fields. When false, return all fields except those named in fields." }, "UserMetadata": { "type": "object", "description": "Data related to the user that does not affect the application's core functionality. Only the subset of keys accessible for self-service management is returned.", "additionalProperties": true }, "ProfileFieldAccessEnum": { "type": "string", "enum": [ "read_write", "read_only" ], "description": "Whether the authenticated user may write this field." }, "ProfileFieldSourceEnum": { "type": "string", "enum": [ "user", "idp", "system" ], "description": "Who is the authoritative source for this field's value." }, "ProfilePolicyEntry": { "type": "object", "description": "Write-eligibility descriptor for a single profile field.", "required": [ "access", "source" ], "additionalProperties": false, "properties": { "access": { "$ref": "#/components/schemas/ProfileFieldAccessEnum" }, "source": { "$ref": "#/components/schemas/ProfileFieldSourceEnum" }, "reason": { "type": "string", "description": "Present only when access is read_only. Explains why the field is not writable." } } }, "ProfilePolicy": { "type": "object", "description": "Per-field write-eligibility keyed by RFC 6901 JSON Pointer (e.g. /email).", "additionalProperties": { "$ref": "#/components/schemas/ProfilePolicyEntry" } }, "ProfileContent": { "type": "object", "additionalProperties": false, "properties": { "given_name": { "type": "string", "description": "Given name/first name/forename of this user." }, "family_name": { "type": "string", "description": "Family name/last name/surname of this user." }, "name": { "type": "string", "description": "Name of this user." }, "nickname": { "type": "string", "description": "Preferred nickname or alias of this user." }, "picture": { "type": "string", "description": "URL to picture, photo, or avatar of this user." }, "email": { "type": "string", "format": "email", "readOnly": true, "description": "Read-only. To manage email, use /me/v1/identifiers." }, "email_verified": { "type": "boolean", "readOnly": true, "description": "Read-only. Whether this user's email address has been verified." }, "phone_number": { "type": "string", "readOnly": true, "description": "Read-only. To manage phone number, use /me/v1/identifiers." }, "phone_verified": { "type": "boolean", "readOnly": true, "description": "Read-only. Whether this user's phone number has been verified." }, "username": { "type": "string", "readOnly": true, "description": "Read-only. To manage username, use /me/v1/identifiers." }, "user_metadata": { "$ref": "#/components/schemas/UserMetadata", "description": "User-defined metadata. On write, top-level keys are merged into the existing metadata." }, "created_at": { "type": "string", "format": "date-time", "readOnly": true, "description": "Date and time when this user was created." }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true, "description": "Date and time when this user was last updated/modified." }, "user_id": { "type": "string", "readOnly": true, "description": "Read-only. The unique identifier of this user." }, "profile_policy": { "$ref": "#/components/schemas/ProfilePolicy", "readOnly": true } } }, "GetProfileResponseContent": { "description": "The authenticated user's profile attributes available for self-service management, with a per-field access policy indicating read/write eligibility.", "allOf": [ { "$ref": "#/components/schemas/ProfileContent" } ] }, "SafeString150": { "allOf": [ { "$ref": "#/components/schemas/NoControlCharString" }, { "minLength": 1, "maxLength": 150, "pattern": "\\S" } ] }, "SafeString300": { "allOf": [ { "$ref": "#/components/schemas/NoControlCharString" }, { "minLength": 1, "maxLength": 300, "pattern": "\\S" } ] }, "SafeUri": { "type": "string", "format": "uri", "pattern": "^https://", "minLength": 1, "maxLength": 2048 }, "PatchProfileRequestContent": { "type": "object", "additionalProperties": false, "properties": { "given_name": { "$ref": "#/components/schemas/SafeString150" }, "family_name": { "$ref": "#/components/schemas/SafeString150" }, "name": { "$ref": "#/components/schemas/SafeString300" }, "nickname": { "$ref": "#/components/schemas/SafeString300" }, "picture": { "$ref": "#/components/schemas/SafeUri" }, "user_metadata": { "$ref": "#/components/schemas/UserMetadata", "maxProperties": 10 } } }, "PatchProfileResponseContent": { "description": "The authenticated user's updated profile attributes, with a per-field access policy indicating read/write eligibility.", "allOf": [ { "$ref": "#/components/schemas/ProfileContent" } ] } }, "responses": { "BadRequest": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Invalid input based on schema.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "Unauthorized": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Unauthorized.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "Forbidden": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Forbidden.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "TooManyRequests": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Too Many Requests.", "headers": { "retry-after": { "$ref": "#/components/headers/RetryAfterHeader" }, "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-auth0-error-kind": { "$ref": "#/components/headers/XAuth0ErrorKindHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "UnsupportedMediaType": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Unsupported Media Type.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "NotFound": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Not Found.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "Conflict": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Request conflicts with the current state of the resource.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "CreateConnectedAccountsResponse": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateConnectedAccountsResponseContent" } } }, "description": "Account connection request created successfully", "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "CompleteConnectedAccountsResponse": { "description": "Connected account request completed successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompleteConnectedAccountsResponseContent" } } }, "headers": { "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" }, "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } }, "CreateConsentSigningKeyResponse": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConsentSigningKey" } } }, "description": "Consent signing key registered successfully", "headers": { "Location": { "$ref": "#/components/headers/ConsentSigningKeyLocationHeader" }, "x-ratelimit-limit": { "$ref": "#/components/headers/XRateLimitLimitHeader" }, "x-ratelimit-reset": { "$ref": "#/components/headers/XRateLimitResetHeader" }, "x-ratelimit-remaining": { "$ref": "#/components/headers/XRateLimitRemainingHeader" } } }, "UnprocessableEntity": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "The request was well-formed but cannot be processed in the current state, for example because a resource limit has been reached." }, "Gone": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Gone.", "headers": { "x-correlation-id": { "$ref": "#/components/headers/CorrelationIdHeader" }, "traceparent": { "$ref": "#/components/headers/TraceparentHeader" } } } } } }