Security settings API

6 endpoints, generated from packages/core/openapi/v1.snapshot.json (OpenAPI 3.1.0, contract version 1.0). Conventions for lists, errors, money and authentication are on the API conventions page.

POST/api/v1/security/providers

Add a single sign-on provider

Fetches and checks the discovery document before saving. Secrets are encrypted at rest and never returned.

Access

Permission security_settings:update

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Request body

application/json, object, required

• kindenumrequired

  one of "google", "entra", "singpass", "oidc"

• displayNamestring

  min length 1 · max length 60

• clientIdstring

  min length 1 · max length 500

• clientSecretstring

  min length 1 · max length 2000

• issuerstring (uri)

  max length 500

• tenantIdstring

  max length 100

• allowedDomainsarray of string
• environmentenum

  one of "staging", "production"

• privateJwksobject

  • keysarray of objectrequired

    • ktystringrequired
• jitEnabledboolean
• enabledboolean

Responses

201 Success. object

• idstring (uuid)required
• kindenumrequired

  one of "google", "entra", "singpass", "oidc"

• displayNamestringrequired
• issuerstringrequired
• clientIdstringrequired
• clientSecretSetbooleanrequired
• privateKeysSetbooleanrequired
• tenantIdstring | nullrequired
• allowedDomainsarray of stringrequired
• environmentenum or nullrequired

  one of "staging", "production"

• jitEnabledbooleanrequired
• enabledbooleanrequired
• configuredbooleanrequired
• lastTestOkAtstring (date-time) or nullrequired
• callbackUrlstringrequired
• jwksUrlstring | nullrequired

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, forbidden, mfa_enrolment_required, reauth_required
• 409 conflict

GET/api/v1/security/providers/{id}

Get a single sign-on provider (secrets are never returned)

Access

Permission security_settings:read

Parameters

Name	In	Type	Required
id	path	string (uuid)	yes

Responses

200 Success. object

• idstring (uuid)required
• kindenumrequired

  one of "google", "entra", "singpass", "oidc"

• displayNamestringrequired
• issuerstringrequired
• clientIdstringrequired
• clientSecretSetbooleanrequired
• privateKeysSetbooleanrequired
• tenantIdstring | nullrequired
• allowedDomainsarray of stringrequired
• environmentenum or nullrequired

  one of "staging", "production"

• jitEnabledbooleanrequired
• enabledbooleanrequired
• configuredbooleanrequired
• lastTestOkAtstring (date-time) or nullrequired
• callbackUrlstringrequired
• jwksUrlstring | nullrequired

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 forbidden, mfa_enrolment_required
• 404 not_found

PATCH/api/v1/security/providers/{id}

Change a single sign-on provider

Access

Permission security_settings:update

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Parameters

Name	In	Type	Required
id	path	string (uuid)	yes

Request body

application/json, object, required

• displayNamestring

  min length 1 · max length 60

• clientIdstring

  min length 1 · max length 500

• clientSecretstring

  min length 1 · max length 2000

• issuerstring (uri)

  max length 500

• tenantIdstring

  max length 100

• allowedDomainsarray of string
• environmentenum

  one of "staging", "production"

• privateJwksobject

  • keysarray of objectrequired

    • ktystringrequired
• jitEnabledboolean
• enabledboolean

Responses

200 Success. object

• idstring (uuid)required
• kindenumrequired

  one of "google", "entra", "singpass", "oidc"

• displayNamestringrequired
• issuerstringrequired
• clientIdstringrequired
• clientSecretSetbooleanrequired
• privateKeysSetbooleanrequired
• tenantIdstring | nullrequired
• allowedDomainsarray of stringrequired
• environmentenum or nullrequired

  one of "staging", "production"

• jitEnabledbooleanrequired
• enabledbooleanrequired
• configuredbooleanrequired
• lastTestOkAtstring (date-time) or nullrequired
• callbackUrlstringrequired
• jwksUrlstring | nullrequired

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, forbidden, mfa_enrolment_required, reauth_required
• 404 not_found
• 409 conflict

DELETE/api/v1/security/providers/{id}

Remove a single sign-on provider

Linked identities are removed with it.

Access

Permission security_settings:update

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Parameters

Name	In	Type	Required
id	path	string (uuid)	yes

Responses

204 No content.

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, forbidden, mfa_enrolment_required, reauth_required
• 404 not_found
• 409 conflict

GET/api/v1/security/settings

Sign-in methods, MFA policy and session timeouts

Access

Permission security_settings:read

Responses

200 Success. object

• passwordEnabledbooleanrequired
• mfaRequiredRolesarray of enumrequired
• idleTimeoutMinintegerrequired

  min -9007199254740991

• absoluteTimeoutHintegerrequired

  min -9007199254740991

• deviceIdleDaysintegerrequired

  min -9007199254740991

• insecureTransportbooleanrequired
• emailConfiguredbooleanrequired
• demoModebooleanrequired
• providersarray of objectrequired

  • idstring (uuid)required
  • kindenumrequired

    one of "google", "entra", "singpass", "oidc"

  • displayNamestringrequired
  • issuerstringrequired
  • clientIdstringrequired
  • clientSecretSetbooleanrequired
  • privateKeysSetbooleanrequired
  • tenantIdstring | nullrequired
  • allowedDomainsarray of stringrequired
  • environmentenum or nullrequired

    one of "staging", "production"

  • jitEnabledbooleanrequired
  • enabledbooleanrequired
  • configuredbooleanrequired
  • lastTestOkAtstring (date-time) or nullrequired
  • callbackUrlstringrequired
  • jwksUrlstring | nullrequired

• 401 session_expired, session_revoked, unauthenticated
• 403 forbidden, mfa_enrolment_required

PATCH/api/v1/security/settings

Change security settings

Password sign-in can be turned off only once an SSO method is enabled and has passed a test sign-in. Owners keep break-glass password sign-in.

Access

Permission security_settings:update

Re-authentication

Signed in within the last 10 minutes, otherwise 403 reauth_required

Request body

application/json, object, required

• passwordEnabledboolean
• mfaRequiredRolesarray of enum
• idleTimeoutMininteger

  min 15 · max 240

• absoluteTimeoutHinteger

  min 1 · max 24

• deviceIdleDaysinteger

  min 1 · max 90

Responses

200 Success. object

• passwordEnabledbooleanrequired
• mfaRequiredRolesarray of enumrequired
• idleTimeoutMinintegerrequired

  min -9007199254740991

• absoluteTimeoutHintegerrequired

  min -9007199254740991

• deviceIdleDaysintegerrequired

  min -9007199254740991

• insecureTransportbooleanrequired
• emailConfiguredbooleanrequired
• demoModebooleanrequired
• providersarray of objectrequired

  • idstring (uuid)required
  • kindenumrequired

    one of "google", "entra", "singpass", "oidc"

  • displayNamestringrequired
  • issuerstringrequired
  • clientIdstringrequired
  • clientSecretSetbooleanrequired
  • privateKeysSetbooleanrequired
  • tenantIdstring | nullrequired
  • allowedDomainsarray of stringrequired
  • environmentenum or nullrequired

    one of "staging", "production"

  • jitEnabledbooleanrequired
  • enabledbooleanrequired
  • configuredbooleanrequired
  • lastTestOkAtstring (date-time) or nullrequired
  • callbackUrlstringrequired
  • jwksUrlstring | nullrequired

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 csrf_rejected, forbidden, mfa_enrolment_required, reauth_required
• 409 conflict