Request a durable restart of tenant membership reconciliation

POST

/api/admin/service-groups/reconcile

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/service-groups/reconcile \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "ifMatch": 1 }'

Service-user membership only; this operation does not grant authorization or emit token claims. Tenant scope is required. Reads require admin:users:read; mutations and previews require admin:users:write. Rule changes use ifMatch optimistic concurrency; a stale version returns 409. Missing or disabled group references, cycles and invalid typed comparisons are rejected. Malformed, empty or non-object JSON request bodies return 400 with group_request_invalid. Only complete per-user snapshots are published. During reconciliation, old snapshots remain readable with stale status; pending or failed results must not be treated as current membership.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Header Parameters

X-Tenant-Id

string

Tenant selector for multi-tenant admin requests.

Request Body ^required

Media type application/json

object

ifMatch

required

Current catalog revision; zero for the first group.

integer

Example ^generated

{
  "ifMatch": 1
}

Responses

202

Successful operation.

Media type application/json

Catalog operations return revision and groups. Catalog reads additionally return fields, dependencies and scans. Validation returns valid, dependencies, order and optional evaluation. Member listing returns members, nextCursor and coverage. Reconciliation requests return status.

object

revision

integer

groups

Array

object

key

required

string

/^[a-z][a-z0-9_-]{0,63}$/

displayName

required

string

>= 1 characters <= 200 characters

description

string

<= 2000 characters

enabled

boolean

default: true

condition

Null or omitted disables the dynamic contribution; other sources are preserved.

object

One of:

object

object

op

required

string

Allowed values: all any

args

required

Array

>= 1 items <= 128 items

One of:

recursive object

object recursive

object

object

op

required

string

Allowed values: not

arg

required

object recursive

object

object

op

required

string

Allowed values: member

groupId

required

Stable ID of an enabled group in the same tenant.

string

object

object

op

required

string

Allowed values: attribute

field

required

Email, email_domain, email_verified, country, registration_state, or custom.FIELD_KEY. Custom fields require an active schema. Email and domain are unavailable until verified. Country is normalized to two uppercase ASCII letters; domains are lowercase. Other strings use case-sensitive NFC equality. Registration state is guest or registered.

string

compare

required

string

Allowed values: eq in contains lt lte gt gte

value

required

One of:

string

string

<= 4096 characters

number

number

boolean

boolean

Array

Array

<= 256 items

object

object

op

required

string

Allowed values: not

arg

required

One of:

object

object

op

required

string

Allowed values: all any

args

required

Array<object> recursive

recursive object

object recursive

object

object

op

required

string

Allowed values: member

groupId

required

Stable ID of an enabled group in the same tenant.

string

object

object

op

required

string

Allowed values: attribute

field

required

Email, email_domain, email_verified, country, registration_state, or custom.FIELD_KEY. Custom fields require an active schema. Email and domain are unavailable until verified. Country is normalized to two uppercase ASCII letters; domains are lowercase. Other strings use case-sensitive NFC equality. Registration state is guest or registered.

string

compare

required

string

Allowed values: eq in contains lt lte gt gte

value

required

One of:

string

string

<= 4096 characters

number

number

boolean

boolean

Array

Array

<= 256 items

object

object

op

required

string

Allowed values: member

groupId

required

Stable ID of an enabled group in the same tenant.

string

object

object

op

required

string

Allowed values: attribute

field

required

Email, email_domain, email_verified, country, registration_state, or custom.FIELD_KEY. Custom fields require an active schema. Email and domain are unavailable until verified. Country is normalized to two uppercase ASCII letters; domains are lowercase. Other strings use case-sensitive NFC equality. Registration state is guest or registered.

string

compare

required

string

Allowed values: eq in contains lt lte gt gte

value

required

One of:

string

string

<= 4096 characters

number

number

boolean

boolean

Array

Array

<= 256 items

scimRoleId

Optional explicit link to a tenant-local legacy SCIM role. No existing role data is rewritten.

string

id

string

tenantId

string

fields

object

key

additional properties

object

dependencies

object

key

additional properties

Array<string>

scans

Array<object>

object

binding_ref

string

rule_version

integer

cursor_id

string

processed

integer

failures

integer

status

string

Allowed values: pending processing completed failed

updated_at

integer

valid

boolean

order

Array<string>

evaluation

object

members

Array<object>

object

userId

string

freshness

string

ruleVersion

integer

reason

object

nextCursor

string

nullable

coverage

string

Allowed values: evaluated_subjects

status

string

Allowed values: pending

Example

{
  "groups": [
    {
      "enabled": true,
      "condition": {
        "op": "all"
      }
    }
  ],
  "scans": [
    {
      "status": "pending"
    }
  ],
  "coverage": "evaluated_subjects",
  "status": "pending"
}

400

Invalid condition, reference, subject, or unavailable stable input.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

401

Authentication required.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

403

Insufficient tenant-scoped permissions.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

404

Group not found.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

409

Rule version conflict or concurrent evaluation.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

503

Input storage unavailable. No partial result was published.

Media type application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}