List every tenant with the source of its Mapping Set and how its apps choose.
curl --request GET \ --url 'https://auth.example.com/api/admin/platform/identity-mapping/tenants?limit=50' \ --header 'Authorization: Bearer <token>'For the operator, before and after a bulk apply of the default Mapping Set or a change of the platform default. Each tenant (a deleted one is left out) is one row: tenant_default is what the tenant’s level says (unset, set, none, invalid), and effective is what an app of the tenant that names no Mapping Set gets, from the same selection the effective endpoint and the release of claims run (bound with the level that decided it, none with the reason, or failed with the level that failed). apps counts the tenant’s apps by how they choose, each stored identity_mapping read the way the selection reads it: following_default (no choice of their own), own_set (they name a Mapping Set), opted_out ({"mode":"none"}) and unusable (a value that is not a choice, for which the selection fails); the four add up to total. A tenant whose apps cannot be counted keeps its row with apps: null and apps_unavailable; one whose settings cannot be read keeps its row with tenant_default: null and a failed selection (settings_unreadable). The platform’s own default is given once (platform_default). Tenants are in the order of their IDs, a page at a time. Needs the settings read permission for every tenant (a global assignment, or a machine token for every tenant); a tenant’s administrator and an Agent are refused. Counts, IDs and names of tenants and sets only. Each tenant is a settings read and a query on its Core database, so the endpoint is rate limited with the strict profile.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”How many tenants a page holds.
The next_cursor of the page before.
Responses
Section titled “ Responses ”A page of tenants, each with the source of its Mapping Set and its app counts.
object
object
What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.
The set the level names, when state is set.
For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.
Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.
object
The tenant’s state in the directory (never deleted).
object
What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.
The set the level names, when state is set.
For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.
Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.
object
The version the app’s own choice pins, if it does.
object
object
A level is set and not usable. The selection does not fall to the next level. settings_unreadable (no tier: the settings decide both defaults) is given only in the list of every tenant, for a tenant whose settings could not be read; the effective endpoint answers 503 instead.
A fixed code for what failed underneath. legacy_profile_only_selector: the app’s own choice names a Destination Profile (destinationProfileId) and no Mapping Set and no opt-out, a selector of the older kind, which is not a choice; the release fails for the app (400 invalid_client) rather than lose the profile’s gate in silence (select a Mapping Set or save { "mode": "none" }). With settings_unreadable, the code of the read that failed (unknown when it has none).
object
Given with apps: null, why the apps could not be counted.
Null on the last page.
Example
{ "platform_default": { "tier": "client", "state": "unset", "source": "kv", "setOwner": "tenant" }, "tenants": [ { "tenant_default": { "tier": "client", "state": "unset", "source": "kv", "setOwner": "tenant" }, "effective": { "kind": "bound", "tier": "client", "setOwner": "tenant" }, "apps_unavailable": "core_database_unavailable" } ]}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}