Show which Mapping Set an app is bound to, and why.

GET

/api/admin/identity-mapping/effective

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/identity-mapping/effective \
  --header 'Authorization: Bearer <token>'

Runs the selection of the Mapping Set for an OIDC app of the calling tenant: the app’s own choice (identity_mapping), else the tenant’s default, else the platform’s default (identity_mapping.oidc_default_set_id), else none. Only an unset level falls to the next; a level that is set and unusable is a failure, reported as selection.kind failed with the level, never as the next level’s answer. chain gives what each level says (unset, set, none, invalid) and where a default came from (kv: saved at the tenant; platform: inherited). Without client_id the view is the tenant’s, with no app level. An app of another tenant, and one that does not exist, answer 404. The selection reads no database; the name, owner and state of the sets it names are read from the Admin database in one query and are left out (setFound absent) when it cannot be read. The release of claims (ID token, UserInfo, the consent screen) uses this same selection. When nothing is named (no_default) the answer also looks, in one more Admin database query, for the tenant’s active activations that the release once applied to an app naming no Mapping Set and no longer does, and lists them in warnings (implicit_activation_no_longer_applies; IDs and names only); if that cannot be read the answer is the same with warnings_unavailable: true. An app whose selector names only a Destination Profile (the older kind) is failed with reason legacy_profile_only_selector. The endpoint is rate limited with the moderate profile.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Query Parameters

client_id

string

>= 1 characters <= 256 characters

The app (OIDC client) of the calling tenant.

Responses

200

The Mapping Set an app is bound to, and the levels that decided it.

Media type application/json

object

tenantId

required

string

clientId

required

The app asked about; null for the tenant’s view.

string

nullable

selection

required

One of:

object

object

kind

required

string

Allowed values: bound

tier

required

string

Allowed values: client tenant_default platform_default

setId

required

string

pinnedVersionId

The version the app’s own choice pins, if it does.

string

setFound

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

object

object

kind

required

string

Allowed values: none

reason

required

string

Allowed values: client_opt_out tenant_opt_out no_default

object

object

kind

required

string

Allowed values: failed

code

required

A level is set and not usable. The selection does not fall to the next level. settings_unreadable (no tier: the settings decide both defaults) is given only in the list of every tenant, for a tenant whose settings could not be read; the effective endpoint answers 503 instead.

string

Allowed values: default_setting_invalid client_selector_invalid settings_unreadable proposal_refused

tier

string

Allowed values: client tenant_default platform_default

reason

A fixed code for what failed underneath. legacy_profile_only_selector: the app’s own choice names a Destination Profile (destinationProfileId) and no Mapping Set and no opt-out, a selector of the older kind, which is not a choice; the release fails for the app (400 invalid_client) rather than lose the profile’s gate in silence (select a Mapping Set or save { "mode": "none" }). With settings_unreadable, the code of the read that failed (unknown when it has none).

string

chain

required

The app’s level, the tenant default and the platform default, in that order.

Array<object>

object

tier

required

string

Allowed values: client tenant_default platform_default

state

required

What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.

string

Allowed values: unset set none invalid not_consulted

setId

The set the level names, when state is set.

string

source

For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.

string

Allowed values: kv platform tenant env default

setFound

Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

warnings

Given with a selection of none because nothing is named (no_default); empty otherwise. implicit_activation_no_longer_applies: the tenant has active activations that fit an OIDC call (for an app, one that names it counts too), which the release used to apply to an app naming no Mapping Set and no longer does. Name the Mapping Set as the tenant’s default (or the app’s own) to keep what they did. Only this tenant’s rows are read, and only IDs and names are given.

Array<object>

object

code

required

string

Allowed values: implicit_activation_no_longer_applies

activations

required

Array<object>

object

activationId

required

string

setId

required

string

setName

string

key

additional properties

key

additional properties

warnings_unavailable

The Admin database could not be read to look for the activations, so warnings is empty without the tenant having none.

boolean

key

additional properties

Example

{
  "selection": {
    "kind": "bound",
    "tier": "client",
    "setOwner": "tenant"
  },
  "chain": [
    {
      "tier": "client",
      "state": "unset",
      "source": "kv",
      "setOwner": "tenant"
    }
  ],
  "warnings": [
    {
      "code": "implicit_activation_no_longer_applies"
    }
  ],
  "warnings_unavailable": true
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}