Skip to content
Authrim

Show where a Mapping Set is used.

GET
/api/admin/identity-mapping/usage
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/identity-mapping/usage?set_id=example' \
  --header 'Authorization: Bearer <token>'

Lists what names a Mapping Set: the platform’s default and the tenants’ default (identity_mapping.oidc_default_set_id), apps (OIDC clients), SAML providers, federation trust sources (runtimeResolution.idpFieldMappingSetId and spFieldMappingSetId), credential profile versions, and the tenant’s SCIM inbound provisioning. It is the search the operations that delete, deactivate, roll back or replace a set run before they are refused, so the answer says whether such a change would be refused now (blocksChange). The set is the calling tenant’s or the platform’s; a set another tenant owns, or one that does not exist, answers 404. The caller sees its own tenant’s references in full. For a set the platform owns, only a caller who holds the wildcard permission through a global assignment has the other tenants’ databases read and their references given in full; for the others only the calling tenant’s databases are read, what the Admin database holds of other tenants is given as a count (usage.otherTenants, with scanned false), and usage.unscanned lists the other tenants as not looked at. Places that could not be checked are listed in usage.unscanned, and usage.scanComplete is false. How far the search looks is set by the platform (identity_mapping.reference_scan_tenant_limit, identity_mapping.reference_scan_row_limit, identity_mapping.reference_scan_concurrency and identity_mapping.reference_display_limit of the identity-mapping category; a place with more rows than the limit is cut off and the count is a lower bound). The endpoint is rate limited with the strict profile.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
set_id
required
string
<= 200 characters

Mapping Set identifier.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Where a Mapping Set is used.

Media type application/json
object
setId
required
string
owner
required
string
Allowed values: tenant platform
usage
required
object
count
required

Everything found, other tenants’ included.

integer
countIsLowerBound
required

True when a place held more rows than were read.

boolean
items
required

The first references the caller may see in full.

Array<object>
object
kind
required
string
Allowed values: platform_default tenant_default client saml_provider credential_profile federation_trust_source scim
tenantId

The tenant the reference is in. Absent for the platform’s own default.

string
clientId
string
providerId
string
providerType
string
entityId

The entity ID of the SAML partner the provider is configured for.

string
profileId
string
versionId
string
versionLifecycleState
string
credentialConfigurationId
string
trustSourceId

A federation trust source whose runtime resolution names the set.

string
federationRole
string
Allowed values: saml_idp saml_sp
role
string
Allowed values: issuance verification
pinnedVersionId

A Mapping Set version the reference pins.

string
pinnedSnapshotHash

The compiled snapshot a credential profile version was published with.

string
viaMappingSetId

When asked about a Destination Profile, the Mapping Set the reference is through.

string
key
additional properties
itemsTruncated
required
boolean
otherTenants

References in other tenants the caller may not see, as counts only.

object
referenceCount
required
integer
tenantCount
required
integer
scanned
required

False when the other tenants’ Core databases were not read (the caller has no global authority): the counts then hold only what the Admin database knows.

boolean
key
additional properties
scanComplete
required
boolean
unscanned
required
object
count
required
integer
items
required
Array<object>
object
area
required
string
Allowed values: platform_settings tenant_settings credential_profiles federation_trust_sources tenant_clients tenant_saml scim_settings tenant_directory tenant_limit other_tenants
tenantId

Given only for the caller’s own tenant, or to a caller with global authority.

string
reason
required

A fixed code (for example core_database_unavailable, no_such_table).

string
key
additional properties
key
additional properties
violation

Only on would_break_references, the condition the version would fail.

object
code
string
Allowed values: destination_profile_invalid platform_set_unsafe snapshot_inactive pinned_version_replaced activation_scope_mismatch saml_destination_policy_mismatch saml_attribute_descriptor_renames_field
message
string
key
additional properties
key
additional properties
blocksChange
required

Whether deleting, deactivating, rolling back or replacing the set would be refused now (it is named, or could not be checked everywhere). Null when it is not known: the other tenants of a platform set were not looked at and nothing else is in the way.

boolean
nullable
key
additional properties
Example 
{
  "owner": "tenant",
  "usage": {
    "items": [
      {
        "kind": "platform_default",
        "federationRole": "saml_idp",
        "role": "issuance"
      }
    ],
    "unscanned": {
      "items": [
        {
          "area": "platform_settings"
        }
      ]
    },
    "violation": {
      "code": "destination_profile_invalid"
    }
  }
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}