Skip to content
Authrim

Preview what a change of a Mapping Set's content would do, app by app.

POST
/api/admin/identity-mapping/sets/{id}/preview-change
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/identity-mapping/sets/example/preview-change \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "content": {}, "sample": { "test_user_id": "example" } }'

Nothing is written. The draft (content, as a PUT sends it) is checked as a save checks it and refused with the save’s 400 when a save would refuse it. changes are the set’s changes by claim: added, removed, renamed (another claim from the same attributes through the same Destination Profile), profile_changed, source_changed, transform_changed (the steps or their order), type_changed (what the claim reads has another catalog type), and validation_changed (a validation definition was added, removed or changed). A changed critical validation is may_reject: it may reject the whole app’s issuance, regardless of the validated field’s namespace or release scopes. Noncritical-only changes are validation_only, listed at the set level and omitted from app changes and scope restrictions. References are read as the runtime reads them. apps are the apps that use the set, with why (tier: the app’s own choice, the tenant default, the platform default), decided by the runtime’s selection; each has the changes it would see with the scopes it is registered for (a change counts when the claim reached the app before or reaches it after), and held_back those its scopes hold back (by the scope that would release them; null for a claim the profile does not list). references is counted as the PUT counts it: send that count back as confirm_impact. A set the platform owns needs the settings read and the clients read permissions for every tenant: without tenant_id the answer counts, tenant by tenant (at most 100), the apps that use it and those that would see a change, and lists no apps; with tenant_id it lists that tenant’s apps. sample is always null for now; when sample is asked for, sample_unavailable is draft_not_compiled. Needs the settings read and the clients read permissions. Rate limited with the strict profile.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string

Query Parameters

Section titled “Query Parameters ”
tenant_id
string

For a set the platform owns, the tenant whose apps to list.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
content
required

The draft content, as a PUT of the set sends it.

object
sample
object
test_user_id
required
string
key
additional properties
key
additional properties
Example generated
{
  "content": {},
  "sample": {
    "test_user_id": "example"
  }
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

What a change of the set’s content would do.

Media type application/json
object
setId
required
string
owner
required
string
Allowed values: tenant platform
changes
required
Array<object>
object
kind
required

profile_field_*: the set’s one Destination Profile is switched for another, and the new one lists a claim the old did not (or no longer lists it, or with other scopes, surfaces or requirement), even one no edge writes (the standard claims pass the profile too). validation_changed names the validated field, not necessarily a released claim; its validation_change and validation_effect describe the definition change and whether it may reject an app’s whole issuance.

string
Allowed values: added removed renamed profile_changed source_changed transform_changed type_changed validation_changed profile_field_added profile_field_removed profile_field_changed
claim
required
string
namespace
required

The namespace the claim is written in; the runtime releases an app’s claims from oidc.claim, or from the namespace the app’s own choice names.

string
previous_namespace

renamed: the namespace before, when it differs.

string
previous_claim

renamed: the claim’s name before.

string
type_before

Catalog type summary; multiple source types are separated by |.

string
type_after

Catalog type summary; multiple source types are separated by |.

string
source_types_before

For a type change involving multiple sources, each source’s catalog type before. Unknown types are null. Source names are namespace and path separated by a colon.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
source_types_after

Each source’s catalog type after, when source_types_before is present.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
validation_change

For validation_changed, whether the validated field gained, lost, or changed its validation definitions. Rule parameters and attribute values are never returned.

string
Allowed values: added removed changed
validation_effect

May_reject means a critical validation definition changed, so issuance can fail or recover independently of release scopes and namespace. It appears in every app’s changes. validation_only means only noncritical definitions changed, so it is listed only in the set’s changes and never in held_back. Omitted severity is stored as error.

string
Allowed values: may_reject validation_only
profile_id
required
string | null
previous_profile_id

profile_changed: the profile before.

string | null
key
additional properties
references
required
object
count
required
integer
count_is_lower_bound
required
boolean
scan_complete
required
boolean
key
additional properties
usage_complete
required
boolean
apps
required
Array<object>
object
tenant_id
required
string
client_id
required
string
name
required
string
tier
required
string
Allowed values: client tenant_default platform_default
changes
required
Array<object>
object
kind
required

profile_field_*: the set’s one Destination Profile is switched for another, and the new one lists a claim the old did not (or no longer lists it, or with other scopes, surfaces or requirement), even one no edge writes (the standard claims pass the profile too). validation_changed names the validated field, not necessarily a released claim; its validation_change and validation_effect describe the definition change and whether it may reject an app’s whole issuance.

string
Allowed values: added removed renamed profile_changed source_changed transform_changed type_changed validation_changed profile_field_added profile_field_removed profile_field_changed
claim
required
string
namespace
required

The namespace the claim is written in; the runtime releases an app’s claims from oidc.claim, or from the namespace the app’s own choice names.

string
previous_namespace

renamed: the namespace before, when it differs.

string
previous_claim

renamed: the claim’s name before.

string
type_before

Catalog type summary; multiple source types are separated by |.

string
type_after

Catalog type summary; multiple source types are separated by |.

string
source_types_before

For a type change involving multiple sources, each source’s catalog type before. Unknown types are null. Source names are namespace and path separated by a colon.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
source_types_after

Each source’s catalog type after, when source_types_before is present.

Array<object>
object
source
required
string
type
required
string | null
key
additional properties
validation_change

For validation_changed, whether the validated field gained, lost, or changed its validation definitions. Rule parameters and attribute values are never returned.

string
Allowed values: added removed changed
validation_effect

May_reject means a critical validation definition changed, so issuance can fail or recover independently of release scopes and namespace. It appears in every app’s changes. validation_only means only noncritical definitions changed, so it is listed only in the set’s changes and never in held_back. Omitted severity is stored as error.

string
Allowed values: may_reject validation_only
profile_id
required
string | null
previous_profile_id

profile_changed: the profile before.

string | null
key
additional properties
held_back
required
Array<object>
object
claim
required
string
scope
required
string | null
key
additional properties
key
additional properties
apps_truncated
required
boolean
defaults_unavailable

The tenant’s defaults could not be read: apps lists the apps that name the set themselves, not those that follow the defaults.

string
Allowed values: settings_unreadable
tenants

For a set the platform owns, asked without tenant_id: the tenants with apps that use it (or that could not be read).

Array<object>
object
tenant_id
required
string
apps_using
required
integer | null
apps_changed
required
integer | null
apps_count_is_lower_bound
boolean
unavailable
string
Allowed values: core_database_unavailable query_failed settings_unreadable
key
additional properties
tenants_truncated
boolean
sample
required

A test user’s values before and after; not given yet.

null
sample_unavailable
string
Allowed values: draft_not_compiled
key
additional properties
Example 
{
  "owner": "tenant",
  "changes": [
    {
      "kind": "added",
      "validation_change": "added",
      "validation_effect": "may_reject"
    }
  ],
  "apps": [
    {
      "tier": "client",
      "changes": [
        {
          "kind": "added",
          "validation_change": "added",
          "validation_effect": "may_reject"
        }
      ]
    }
  ],
  "defaults_unavailable": "settings_unreadable",
  "tenants": [
    {
      "unavailable": "core_database_unavailable"
    }
  ],
  "sample_unavailable": "draft_not_compiled"
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

429

Section titled “429 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}