Accept saved attributes after repairing failed user writes and recalculate

POST

/api/admin/service-groups/subjects/{userId}/recover

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/service-groups/subjects/example/recover \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "acceptSavedAttributes": true, "boundaryIds": [ "example" ] }'

Requires admin:users:write. The operator must review and repair saved user attributes first. Accepts only the specified failed write boundaries for this tenant and user, records an audit entry, and recalculates current membership. This does not roll back or repeat the original write. Active writing boundaries cannot be cleared. Partial recovery can be retried by fetching the remaining unsettledWrites from the subject snapshot. No authorization is granted.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

userId

required

string

<= 128 characters

Header Parameters

X-Tenant-Id

string

Tenant selector for multi-tenant admin requests.

Request Body ^required

Media type application/json

object

acceptSavedAttributes

required

boolean

boundaryIds

required

Array<string>

>= 1 items <= 50 items unique items

Responses

200

Successful operation.

Media type application/json

object

tenantId

required

string

userId

required

string

ruleVersion

required

integer

generation

required

integer

evaluatedAt

Unix milliseconds.

integer

nullable

freshness

required

string

Allowed values: fresh stale pending failed

inputVersion

required

object

route

Opaque account routing generation.

string

core

integer

pii

integer

metadata

integer

epoch

integer

evaluation

required

object

groups

object

key

additional properties

object

member

One of:

boolean

boolean

string

string

Allowed values: unknown

dynamic

One of:

boolean

boolean

string

string

Allowed values: unknown

sources

Array<string>

Allowed values: manual scim dynamic

nodes

object

key

additional properties

evaluatedNodes

integer

explanation

Array<object>

object

compare

string

Allowed values: eq in contains lt lte gt gte

expected

One of:

string

string

number

number

boolean

boolean

Array

Array

children

IDs of child condition results

Array<string>

node

string

operator

string

field

string

groupId

string

result

One of:

boolean

boolean

string

string

Allowed values: unknown

unsettledWrites

Up to 50 outstanding writes per storage source. Active writers cannot be recovered here.

Array<object>

object

id

string

operation

string

status

string

Allowed values: writing failed

created_at

integer

error

string

nullable

Example

{
  "freshness": "fresh",
  "evaluation": {
    "groups": {
      "additionalProperty": {
        "member": "unknown",
        "dynamic": "unknown",
        "sources": [
          "manual"
        ]
      }
    }
  },
  "explanation": [
    {
      "compare": "eq",
      "result": "unknown"
    }
  ],
  "unsettledWrites": [
    {
      "status": "writing"
    }
  ]
}

400

Invalid condition, reference, subject, or unavailable stable input.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

401

Authentication required.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

403

Insufficient tenant-scoped permissions.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

404

Group not found.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

409

Rule version conflict or concurrent evaluation.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

503

Input storage unavailable. No partial result was published.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}