Administration

Manages users, groups, service tokens, and OIDC clients.

📄️ Reset Resource Metadata

Clear resource synchronization state so the next synchronization pass reprocesses resource metadata.

📄️ List Users

List users after administrator authentication. Use `category` to limit results to a category such as `service_account`.

📄️ Create User

Create a new user. Requires admin authentication.

📄️ Get User Versions

Get user versions. Requires admin authentication.

📄️ Get User

Get a specific user. Requires admin authentication.

📄️ Update User

Update a user. Requires admin authentication.

📄️ Delete User

Permanently remove a user account. Administrator authentication is required, and the deleted account can no longer authenticate.

📄️ List User Permissions

List the permission grants a user directly holds. Requires admin. The inverse of ``GET /permissions`` (subjects for a resource): this returns the resources ``user_id`` was granted a role on — used to review a service account's access. Only directly-written grants are returned (model-implied and collection-inherited roles are excluded), so each is revocable.

📄️ Reset User Password

Reset a user's password. Requires admin authentication.

📄️ List Groups

List all groups. Requires admin authentication.

📄️ Create Group

Create a new group. Requires admin authentication.

📄️ Get Group Versions

Get group version history. Requires admin authentication.

📄️ Get Group

Get a specific group. Requires admin authentication.

📄️ Update Group

Partially update a group. Requires admin authentication.

📄️ Delete Group

Permanently remove a group. Administrator authentication is required, and memberships granted through the group stop applying.

📄️ List Group Members

List members of a group. Works for both local and OIDC groups.

📄️ Add Group Member

Add a member to a local group. OIDC groups are read-only.

📄️ Remove Group Member

Remove a member from a local group. OIDC groups are read-only.

📄️ List Providers

List identity providers and report each provider's configuration status and support for user and group management.

📄️ List OIDC Users

List IdP users for OIDC registration workflow.

📄️ List OIDC Groups

List IdP groups for OIDC registration workflow.

📄️ Sync User

Sync user data from IdP.

📄️ Sync Group

Sync group data from IdP.

📄️ List OIDC Clients

List all OIDC clients. Requires admin authentication.

📄️ Create OIDC Client

Create an OIDC client. Returns the plaintext client_secret exactly once for confidential clients. If lost, use rotate-secret to generate a new one.

📄️ Get OIDC Client

Get an OIDC client by its public client_id.

📄️ Update OIDC Client

Update an OIDC client. client_id and client_type are immutable.

📄️ Delete OIDC Client

Permanently delete an OIDC client registration so its client credentials can no longer be used. Administrator authentication is required.

📄️ Rotate OIDC Client Secret

Rotate the client_secret for a confidential OIDC client. Returns the new plaintext secret exactly once.

📄️ Create Service Token

Create a service token for a service account.

📄️ List Service Tokens

List service tokens with optional filters.

📄️ Revoke Service Token

Revoke a service token so it can no longer authenticate API requests. Administrator authentication is required.