Skip to content
Authrim

List every tenant with the source of its Mapping Set and how its apps choose.

GET
/api/admin/platform/identity-mapping/tenants
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/platform/identity-mapping/tenants?limit=50' \
  --header 'Authorization: Bearer <token>'

For the operator, before and after a bulk apply of the default Mapping Set or a change of the platform default. Each tenant (a deleted one is left out) is one row: tenant_default is what the tenant’s level says (unset, set, none, invalid), and effective is what an app of the tenant that names no Mapping Set gets, from the same selection the effective endpoint and the release of claims run (bound with the level that decided it, none with the reason, or failed with the level that failed). apps counts the tenant’s apps by how they choose, each stored identity_mapping read the way the selection reads it: following_default (no choice of their own), own_set (they name a Mapping Set), opted_out ({"mode":"none"}) and unusable (a value that is not a choice, for which the selection fails); the four add up to total. A tenant whose apps cannot be counted keeps its row with apps: null and apps_unavailable; one whose settings cannot be read keeps its row with tenant_default: null and a failed selection (settings_unreadable). The platform’s own default is given once (platform_default). Tenants are in the order of their IDs, a page at a time. Needs the settings read permission for every tenant (a global assignment, or a machine token for every tenant); a tenant’s administrator and an Agent are refused. Counts, IDs and names of tenants and sets only. Each tenant is a settings read and a query on its Core database, so the endpoint is rate limited with the strict profile.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
limit
integer
default: 50 >= 1 <= 100

How many tenants a page holds.

cursor
string

The next_cursor of the page before.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

A page of tenants, each with the source of its Mapping Set and its app counts.

Media type application/json
object
platform_default
required
object
tier
required
string
Allowed values: client tenant_default platform_default
state
required

What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.

string
Allowed values: unset set none invalid not_consulted
setId

The set the level names, when state is set.

string
source

For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.

string
Allowed values: kv platform tenant env default
setFound

Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.

boolean
setName
string
setOwner
string
Allowed values: tenant platform
setLifecycleState
string
tenants
required
Array<object>
object
tenant_id
required
string
display_name
required
string
lifecycle_state
required

The tenant’s state in the directory (never deleted).

string
tenant_default
required
One of:
object
tier
required
string
Allowed values: client tenant_default platform_default
state
required

What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.

string
Allowed values: unset set none invalid not_consulted
setId

The set the level names, when state is set.

string
source

For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.

string
Allowed values: kv platform tenant env default
setFound

Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.

boolean
setName
string
setOwner
string
Allowed values: tenant platform
setLifecycleState
string
effective
required
One of:
object
kind
required
string
Allowed values: bound
tier
required
string
Allowed values: client tenant_default platform_default
setId
required
string
pinnedVersionId

The version the app’s own choice pins, if it does.

string
setFound
boolean
setName
string
setOwner
string
Allowed values: tenant platform
setLifecycleState
string
apps
required
object
total
required
integer
following_default
required
integer
own_set
required
integer
opted_out
required
integer
unusable
required
integer
key
additional properties
apps_unavailable

Given with apps: null, why the apps could not be counted.

string
Allowed values: core_database_unavailable query_failed
key
additional properties
next_cursor
required

Null on the last page.

string | null
generated_at
required
string format: date-time
key
additional properties
Example 
{
  "platform_default": {
    "tier": "client",
    "state": "unset",
    "source": "kv",
    "setOwner": "tenant"
  },
  "tenants": [
    {
      "tenant_default": {
        "tier": "client",
        "state": "unset",
        "source": "kv",
        "setOwner": "tenant"
      },
      "effective": {
        "kind": "bound",
        "tier": "client",
        "setOwner": "tenant"
      },
      "apps_unavailable": "core_database_unavailable"
    }
  ]
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

429

Section titled “429 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}