Skip to content
Authrim

Compare the claims of two Mapping Sets.

GET
/api/admin/identity-mapping/sets/compare
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/identity-mapping/sets/compare?a=example&b=example' \
  --header 'Authorization: Bearer <token>'

How the claims of set b differ from those of set a (each the calling tenant’s or the platform’s; another tenant’s, and one that does not exist, are 404): the changes a change preview gives (added, removed, renamed, profile_changed, source_changed, transform_changed, type_changed, validation_changed, and profile_field_*), read as the runtime reads the sets. Validation changes name the field and effect without returning rule parameters or attribute values. Type changes preserve each source’s type. Needs the settings read permission. Rate limited with the moderate profile.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
a
required
string
>= 1 characters <= 200 characters
b
required
string
>= 1 characters <= 200 characters

Responses

Section titled “ Responses ”

200

Section titled “200 ”

The changes of the claims of set b against set a.

Media type application/json
object
a
required
object
setId
required
string
owner
required
string
Allowed values: tenant platform
key
additional properties
b
required
object
setId
required
string
owner
required
string
Allowed values: tenant platform
key
additional properties
changes
required
Array<object>
object
kind
required

profile_field_*: the set’s one Destination Profile is switched for another, and the new one lists a claim the old did not (or no longer lists it, or with other scopes, surfaces or requirement), even one no edge writes (the standard claims pass the profile too). validation_changed names the validated field, not necessarily a released claim; its validation_change and validation_effect describe the definition change and whether it may reject an app’s whole issuance.

string
Allowed values: added removed renamed profile_changed source_changed transform_changed type_changed validation_changed profile_field_added profile_field_removed profile_field_changed
claim
required
string
namespace
required

The namespace the claim is written in; the runtime releases an app’s claims from oidc.claim, or from the namespace the app’s own choice names.

string
previous_namespace

renamed: the namespace before, when it differs.

string
previous_claim

renamed: the claim’s name before.

string
type_before

Catalog type summary; multiple source types are separated by |.

string
type_after

Catalog type summary; multiple source types are separated by |.

string
source_types_before

For a type change involving multiple sources, each source’s catalog type before. Unknown types are null. Source names are namespace and path separated by a colon.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
source_types_after

Each source’s catalog type after, when source_types_before is present.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
validation_change

For validation_changed, whether the validated field gained, lost, or changed its validation definitions. Rule parameters and attribute values are never returned.

string
Allowed values: added removed changed
validation_effect

May_reject means a critical validation definition changed, so issuance can fail or recover independently of release scopes and namespace. It appears in every app’s changes. validation_only means only noncritical definitions changed, so it is listed only in the set’s changes and never in held_back. Omitted severity is stored as error.

string
Allowed values: may_reject validation_only
profile_id
required
string | null
previous_profile_id

profile_changed: the profile before.

string | null
key
additional properties
key
additional properties
Example 
{
  "a": {
    "owner": "tenant"
  },
  "b": {
    "owner": "tenant"
  },
  "changes": [
    {
      "kind": "added",
      "validation_change": "added",
      "validation_effect": "may_reject"
    }
  ]
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

429

Section titled “429 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}