Identity API

GET/api/identity/access-review-contract

request access

Access review contract.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionEnabled": false,
  "endpoints": []
}

GET/api/identity/access-review-recertification-contract

request access

Identity access review.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review-recertification-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review-recertification-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "reviewMode": "<string>",
  "providerCallsEnabled": false,
  "liveDirectoryChangesAllowed": false,
  "liveServiceNowChangesAllowed": false,
  "rawUserDataAllowed": false,
  "rawGroupDataAllowed": false,
  "principalIdentifiersAllowed": false,
  "tenantIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "reviewScopes": [],
  "reviewSignals": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": [],
  "requiredEvidence": [],
  "rules": []
}

POST/api/identity/access-review/campaign

execute access

Create access campaign.

Permissions

HTTP request

POST https://<your-host>/api/identity/access-review/campaign

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AccessCampaignCreateRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"name":"<string>","reviewType":"<string>","reviewerGroup":"<string>","days":0}' \
  'https://<your-host>/api/identity/access-review/campaign'

GET/api/identity/access-review/campaign/{id}

audit access

Get access campaign.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/campaign/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/campaign/<id>'

GET/api/identity/access-review/campaigns

audit access

List access campaigns.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/campaigns

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Returns a paginated JSON object with total/limit/offset keys.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/campaigns'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "count": null,
  "total": null,
  "limit": null,
  "offset": null,
  "campaigns": null
}

GET/api/identity/access-review/due

audit access

Access reviews due.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/due

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/due'

GET/api/identity/access-review/expiring

audit access

Access reviews expiring.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/expiring

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/expiring'

GET/api/identity/access-review/review/{id}

audit access

Get access review.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/review/{id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/review/<id>'

GET/api/identity/access-review/reviews

audit access

List access reviews.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/reviews

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Returns a paginated JSON object with total/limit/offset keys.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/reviews'

GET/api/identity/access-review/summary

audit access

Access review summary.

Permissions

HTTP request

GET https://<your-host>/api/identity/access-review/summary

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/access-review/summary'

POST/api/identity/access-review/{id}/approve

approve access

Approve access review.

Permissions

HTTP request

POST https://<your-host>/api/identity/access-review/{id}/approve

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AccessReviewActionRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{}' \
  'https://<your-host>/api/identity/access-review/<id>/approve'

POST/api/identity/access-review/{id}/exempt

approve access

Access review exempt.

Permissions

HTTP request

POST https://<your-host>/api/identity/access-review/{id}/exempt

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AccessReviewExemptRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"justification":"<string>","exemptionExpiry":"<string>"}' \
  'https://<your-host>/api/identity/access-review/<id>/exempt'

POST/api/identity/access-review/{id}/revoke

approve access

Revoke access review.

Permissions

HTTP request

POST https://<your-host>/api/identity/access-review/{id}/revoke

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AccessReviewActionRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{}' \
  'https://<your-host>/api/identity/access-review/<id>/revoke'

POST/api/identity/access-review/{id}/start

approve access

Start access review.

Permissions

HTTP request

POST https://<your-host>/api/identity/access-review/{id}/start

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/access-review/<id>/start'

GET/api/identity/ad-computer-contract

request access

Ad computer contract.

Permissions

HTTP request

GET https://<your-host>/api/identity/ad-computer-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/ad-computer-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionAllowed": false,
  "dryRunRequired": false,
  "lifecycleModes": [],
  "computerStatuses": [],
  "supportedOs": [],
  "validSites": null,
  "namingPattern": "<string>",
  "validRoles": [],
  "namespacePolicyVersion": null,
  "ouAuthority": "<string>",
  "siteScopedOuClasses": [],
  "quarantineRecoveryGuards": [],
  "requiredInputs": [],
  "blockedReasons": [],
  "examples": null
}

GET/api/identity/ad-computer-lifecycle-contract

request access

Identity ad computer.

Permissions

HTTP request

GET https://<your-host>/api/identity/ad-computer-lifecycle-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/ad-computer-lifecycle-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "lifecycleMode": "<string>",
  "providerCallsEnabled": false,
  "workerExecutionAllowed": false,
  "liveDirectoryChangesAllowed": false,
  "computerPrestageAllowed": false,
  "computerMoveAllowed": false,
  "computerDisableAllowed": false,
  "computerDeleteAllowed": false,
  "computerRecoverAllowed": false,
  "rawComputerDataAllowed": false,
  "principalIdentifiersAllowed": false,
  "platformStateQuarantineRecoveryReviewAllowed": false,
  "quarantineRecoveryRequiresMakerChecker": false,
  "distinguishedNamesAllowed": false,
  "domainIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "securityIdentifiersAllowed": false,
  "computerIdentifiersAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "lifecycleActions": [],
  "lifecycleSignals": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": [],
  "requiredEvidence": []
}

GET/api/identity/ad/computer/{name}

audit access

Fetch a single AD computer by its unique name (#39).

The write-by-name handlers (move/disable/enable/delete) all read the same row first; this exposes that lookup as a first-class read so an operator can inspect one computer without a bulk reconcile scan. 404 when unknown, 503 when no DB. Authn-gated and site-scoped (#2): a principal scoped to another site gets a 404 (no existence oracle), consistent with the AD write-by-name handlers (move/disable/enable/delete).

Permissions

HTTP request

GET https://<your-host>/api/identity/ad/computer/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/ad/computer/<name>'

POST/api/identity/ad/delete/{name}

identity.ad-computer.delete access

Delete ad.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/delete/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/ad/delete/<name>'

POST/api/identity/ad/disable/{name}

execute access

Disable ad.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/disable/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AdDisableRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"reason":"<string>"}' \
  'https://<your-host>/api/identity/ad/disable/<name>'

POST/api/identity/ad/enable/{name}

execute access

Enable ad.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/enable/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/ad/enable/<name>'

POST/api/identity/ad/move/{name}

execute access

Ad move.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/move/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AdMoveRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"targetOu":"<string>"}' \
  'https://<your-host>/api/identity/ad/move/<name>'

GET/api/identity/ad/orphaned

audit access

Ad orphaned.

Permissions

HTTP request

GET https://<your-host>/api/identity/ad/orphaned

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/ad/orphaned'

POST/api/identity/ad/prestage

execute access

Ad prestage.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/prestage

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AdPrestageRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"name":"<string>","site":"<string>","ouPath":"<string>"}' \
  'https://<your-host>/api/identity/ad/prestage'

POST/api/identity/ad/quarantine-recovery/apply/{review_id}

execute access

Apply a separately approved review.

The computer CAS, review state change, and security audit append share one transaction; the DB trigger independently rejects every other Quarantined -> non-Quarantined transition.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/quarantine-recovery/apply/{review_id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/ad/quarantine-recovery/apply/<review_id>'

POST/api/identity/ad/quarantine-recovery/approve/{review_id}

execute access

Approve a fresh recovery review.

Admin authority is checked before any lookup, and maker-checker separation is repeated in SQL.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/quarantine-recovery/approve/{review_id}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/ad/quarantine-recovery/approve/<review_id>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "reviewId": null,
  "state": null,
  "approvedAt": null,
  "dryRun": false
}

POST/api/identity/ad/quarantine-recovery/review/{name}

execute access

Create the maker side of an AD quarantine recovery review.

The ordinary execute-capable operator may request recovery, but cannot approve or apply it. Actor provenance is always taken from the verified session.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/quarantine-recovery/review/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AdQuarantineRecoveryRequest.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"reason":"<string>"}' \
  'https://<your-host>/api/identity/ad/quarantine-recovery/review/<name>'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "reviewId": null,
  "state": null,
  "expiresAt": null,
  "dryRun": false
}

GET/api/identity/ad/reconcile

audit access

Ad reconcile.

Permissions

HTTP request

GET https://<your-host>/api/identity/ad/reconcile

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/ad/reconcile'

POST/api/identity/ad/validate

execute access

Validate ad.

Permissions

HTTP request

POST https://<your-host>/api/identity/ad/validate

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: AdValidateRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"name":"<string>"}' \
  'https://<your-host>/api/identity/ad/validate'

GET/api/identity/entra-rbac-approval-readiness-contract

request access

Identity entra rbac.

Permissions

HTTP request

GET https://<your-host>/api/identity/entra-rbac-approval-readiness-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/entra-rbac-approval-readiness-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "readinessMode": "<string>",
  "identityProvider": "<string>",
  "configuredForProduction": false,
  "localMockAuthAllowed": false,
  "providerCallsEnabled": false,
  "liveAuthenticationEnabled": false,
  "tokenValidationEnabled": false,
  "graphCallsAllowed": false,
  "entraGroupLookupAllowed": false,
  "appRegistrationChangesAllowed": false,
  "roleAssignmentChangesAllowed": false,
  "approvalExecutionAllowed": false,
  "serviceNowApprovalChangesAllowed": false,
  "rawUserDataAllowed": false,
  "rawClaimPayloadsAllowed": false,
  "rawGroupRowsAllowed": false,
  "tenantIdentifiersAllowed": false,
  "appIdentifiersAllowed": false,
  "clientIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "principalIdentifiersAllowed": false,
  "groupIdentifiersAllowed": false,
  "credentialValuesAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "readinessSurfaces": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": [],
  "requiredEvidence": [],
  "rules": []
}

GET/api/identity/file-share-ntfs-recertification-contract

request access

Identity file share ntfs.

Permissions

HTTP request

GET https://<your-host>/api/identity/file-share-ntfs-recertification-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/file-share-ntfs-recertification-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "recertificationMode": "<string>",
  "providerCallsEnabled": false,
  "workerExecutionAllowed": false,
  "evidenceIngestionEnabled": false,
  "staticFixtureEvidenceCanSatisfyCompliance": false,
  "liveDirectoryChangesAllowed": false,
  "liveShareChangesAllowed": false,
  "liveNtfsAclChangesAllowed": false,
  "liveServiceNowChangesAllowed": false,
  "adGroupMembershipChangeAllowed": false,
  "sharePermissionChangeAllowed": false,
  "ntfsAclChangeAllowed": false,
  "inheritanceChangeAllowed": false,
  "ownerChangeAllowed": false,
  "rawShareDataAllowed": false,
  "rawAclRowsAllowed": false,
  "rawMembershipRowsAllowed": false,
  "rawPathDataAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "principalIdentifiersAllowed": false,
  "shareIdentifiersAllowed": false,
  "pathValuesAllowed": false,
  "credentialValuesAllowed": false,
  "authenticatedDecisionAttributionRequired": false,
  "recertificationActions": [],
  "recertificationScopes": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "decisionStatuses": [],
  "complianceRule": "<string>",
  "blockedReasons": []
}

GET/api/identity/gmsa-contract

request access

Gmsa contract.

Permissions

HTTP request

GET https://<your-host>/api/identity/gmsa-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/gmsa-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "providerCallsEnabled": false,
  "liveExecutionAllowed": false,
  "dryRunRequired": false,
  "supportedWorkflows": [],
  "validStatuses": [],
  "namingConvention": "<string>",
  "namespaceOwnerResolution": "<string>",
  "currentOwnerAuthority": "<string>",
  "reactivationPolicy": "<string>",
  "namespacePolicyVersion": null,
  "requiredInputs": [],
  "blockedReasons": []
}

GET/api/identity/gmsa-lifecycle-contract

request access

Identity gmsa lifecycle.

Permissions

HTTP request

GET https://<your-host>/api/identity/gmsa-lifecycle-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/gmsa-lifecycle-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "lifecycleMode": "<string>",
  "providerCallsEnabled": false,
  "workerExecutionAllowed": false,
  "liveDirectoryChangesAllowed": false,
  "gmsaCreationAllowed": false,
  "gmsaAssignmentAllowed": false,
  "gmsaValidationAllowed": false,
  "gmsaRetireAllowed": false,
  "passwordRetrievalAllowed": false,
  "managedPasswordMaterialAllowed": false,
  "spnChangeAllowed": false,
  "delegationChangeAllowed": false,
  "rawServiceAccountDataAllowed": false,
  "rawLogContentAllowed": false,
  "rawRowsAllowed": false,
  "serialNumbersAllowed": false,
  "rawRecipientDataAllowed": false,
  "principalIdentifiersAllowed": false,
  "distinguishedNamesAllowed": false,
  "domainIdentifiersAllowed": false,
  "objectIdentifiersAllowed": false,
  "securityIdentifiersAllowed": false,
  "targetIdentifiersAllowed": false,
  "credentialValuesAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "lifecycleActions": [],
  "lifecycleSignals": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

POST/api/identity/gmsa/assign/{name}/{host}

execute access

Gmsa assign.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/assign/{name}/{host}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/gmsa/assign/<name>/<host>'

POST/api/identity/gmsa/create

execute access

Create gmsa.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/create

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: GmsaCreateRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"name":"<string>","hosts":[],"spns":[],"site":"<string>"}' \
  'https://<your-host>/api/identity/gmsa/create'

GET/api/identity/gmsa/expiring

audit access

Gmsa expiring.

Permissions

HTTP request

GET https://<your-host>/api/identity/gmsa/expiring

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/gmsa/expiring'

GET/api/identity/gmsa/inventory

audit access

Gmsa inventory.

Permissions

HTTP request

GET https://<your-host>/api/identity/gmsa/inventory

Path parameters

This operation has no path parameters.

Query parameters

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

200 response headers

Returns a bare JSON array; the filtered total is exposed via the X-Total-Count response header.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/gmsa/inventory'

POST/api/identity/gmsa/remove/{name}/{host}

execute access

Gmsa remove.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/remove/{name}/{host}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/gmsa/remove/<name>/<host>'

POST/api/identity/gmsa/rotate/{name}

execute access

Gmsa rotate.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/rotate/{name}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/gmsa/rotate/<name>'

POST/api/identity/gmsa/test/{name}/{host}

execute access

Test gmsa.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/test/{name}/{host}

Path parameters

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  'https://<your-host>/api/identity/gmsa/test/<name>/<host>'

POST/api/identity/gmsa/validate

execute access

Validate gmsa.

Permissions

HTTP request

POST https://<your-host>/api/identity/gmsa/validate

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

JSON structure: GmsaValidateRequest.

Response

For 200, the known response body type is Value. Its field schema is unavailable, so no JSON shape is inferred.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '{"name":"<string>"}' \
  'https://<your-host>/api/identity/gmsa/validate'

GET/api/identity/local-privilege-access-contract

request access

Identity local privilege.

Permissions

HTTP request

GET https://<your-host>/api/identity/local-privilege-access-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.

Errors

JSON failures use one of the platform error envelopes and include the request correlation metadata when routing reaches the API middleware. See Errors for the exact shapes, authentication failures, retry guidance, and transport-level exceptions.

Examples

Request

curl --silent --show-error --globoff \
  --request GET \
  --header 'Authorization: Bearer <token>' \
  'https://<your-host>/api/identity/local-privilege-access-contract'

Schematic response body

Illustrative shape generated from the extracted field types, not a recorded live response. Values are placeholders; null marks a field whose type could not be resolved.

Success status: 200

{
  "source": "<string>",
  "accessReviewMode": "<string>",
  "providerCallsEnabled": false,
  "workerExecutionAllowed": false,
  "liveDirectoryChangesAllowed": false,
  "liveLocalAdminChangesAllowed": false,
  "liveSudoersChangesAllowed": false,
  "liveServiceNowChangesAllowed": false,
  "adGroupMembershipChangeAllowed": false,
  "sudoersFileChangeAllowed": false,
  "privilegeGrantAllowed": false,
  "privilegeRemovalAllowed": false,
  "rawUserDataAllowed": false,
  "rawGroupDataAllowed": false,
  "rawMembershipRowsAllowed": false,
  "rawSudoersContentAllowed": false,
  "rawRequestPayloadsAllowed": false,
  "rawProviderPayloadsAllowed": false,
  "principalIdentifiersAllowed": false,
  "targetIdentifiersAllowed": false,
  "privilegeHostIdentifiersAllowed": false,
  "credentialValuesAllowed": false,
  "accessActions": [],
  "accessScopes": [],
  "requiredInputs": [],
  "requiredGuards": [],
  "planSections": [],
  "blockedReasons": []
}

GET/api/identity/rbac-approval-model-contract

request access

Identity rbac approval model.

Permissions

HTTP request

GET https://<your-host>/api/identity/rbac-approval-model-contract

Path parameters

This operation has no path parameters.

Query parameters

This operation has no query parameters.

Request headers

Request body

This operation does not accept a request body.

Response

200 response body

Structure: Value.