Preview which Mapping Set an app (or the tenant) would be bound to if a choice were saved.

POST

/api/admin/identity-mapping/preview-effective

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/identity-mapping/preview-effective \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "client_id": "example", "proposal": { "client": { "fieldMappingSetId": "example", "fieldMappingVersionId": "example", "destinationNamespace": "example", "sourceProfileId": "example" }, "tenant_default": "example" } }'

Nothing is written. The answer is the effective endpoint’s, before (what is saved) and after (with the proposal), from the same selection. proposal.client is an app’s own choice (a set, { "mode": "none" }, or null to follow the defaults; needs client_id and the clients read permission); proposal.tenant_default is the tenant’s default (a set ID, none, or null to have none of its own). A proposal is checked as a save checks it: a malformed one is the save’s 400, and a set a save would refuse (missing, another tenant’s, not active, not one release path, a platform set for an app) gives after.selection of kind failed with code proposal_refused and the tier, and refusals with the save’s reason codes. An app of another tenant, and one that does not exist, are 404. Needs the settings read permission. This read-only inspection remains available while release mutations are paused or rollout status is unavailable. Rate limited with the moderate profile.

Authorizations

• adminBearer
• adminSessionCookie

Request Body ^required

Media type application/json

object

client_id

string

>= 1 characters <= 256 characters

proposal

required

object

>= 1 properties

client

One of:

object

One of:

object

object

fieldMappingSetId

required

string

fieldMappingVersionId

string

destinationNamespace

string

sourceProfileId

string

key

additional properties

object

object

mode

required

string

Allowed values: none

key

additional properties

null

null

tenant_default

A Mapping Set ID, none, or null (no default of the tenant’s own).

string | null

key

additional properties

key

additional properties

Responses

200

What an app or the tenant is bound to now, and with the proposal.

Media type application/json

object

tenantId

required

string

clientId

required

string | null

before

required

object

tenantId

required

string

clientId

required

The app asked about; null for the tenant’s view.

string

nullable

selection

required

One of:

object

object

kind

required

string

Allowed values: bound

tier

required

string

Allowed values: client tenant_default platform_default

setId

required

string

pinnedVersionId

The version the app’s own choice pins, if it does.

string

setFound

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

object

object

kind

required

string

Allowed values: none

reason

required

string

Allowed values: client_opt_out tenant_opt_out no_default

object

object

kind

required

string

Allowed values: failed

code

required

A level is set and not usable. The selection does not fall to the next level. settings_unreadable (no tier: the settings decide both defaults) is given only in the list of every tenant, for a tenant whose settings could not be read; the effective endpoint answers 503 instead.

string

Allowed values: default_setting_invalid client_selector_invalid settings_unreadable proposal_refused

tier

string

Allowed values: client tenant_default platform_default

reason

A fixed code for what failed underneath. legacy_profile_only_selector: the app’s own choice names a Destination Profile (destinationProfileId) and no Mapping Set and no opt-out, a selector of the older kind, which is not a choice; the release fails for the app (400 invalid_client) rather than lose the profile’s gate in silence (select a Mapping Set or save { "mode": "none" }). With settings_unreadable, the code of the read that failed (unknown when it has none).

string

chain

required

The app’s level, the tenant default and the platform default, in that order.

Array<object>

object

tier

required

string

Allowed values: client tenant_default platform_default

state

required

What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.

string

Allowed values: unset set none invalid not_consulted

setId

The set the level names, when state is set.

string

source

For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.

string

Allowed values: kv platform tenant env default

setFound

Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

warnings

Given with a selection of none because nothing is named (no_default); empty otherwise. implicit_activation_no_longer_applies: the tenant has active activations that fit an OIDC call (for an app, one that names it counts too), which the release used to apply to an app naming no Mapping Set and no longer does. Name the Mapping Set as the tenant’s default (or the app’s own) to keep what they did. Only this tenant’s rows are read, and only IDs and names are given.

Array<object>

object

code

required

string

Allowed values: implicit_activation_no_longer_applies

activations

required

Array<object>

object

activationId

required

string

setId

required

string

setName

string

key

additional properties

key

additional properties

warnings_unavailable

The Admin database could not be read to look for the activations, so warnings is empty without the tenant having none.

boolean

key

additional properties

after

required

object

tenantId

required

string

clientId

required

The app asked about; null for the tenant’s view.

string

nullable

selection

required

One of:

object

object

kind

required

string

Allowed values: bound

tier

required

string

Allowed values: client tenant_default platform_default

setId

required

string

pinnedVersionId

The version the app’s own choice pins, if it does.

string

setFound

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

object

object

kind

required

string

Allowed values: none

reason

required

string

Allowed values: client_opt_out tenant_opt_out no_default

object

object

kind

required

string

Allowed values: failed

code

required

A level is set and not usable. The selection does not fall to the next level. settings_unreadable (no tier: the settings decide both defaults) is given only in the list of every tenant, for a tenant whose settings could not be read; the effective endpoint answers 503 instead.

string

Allowed values: default_setting_invalid client_selector_invalid settings_unreadable proposal_refused

tier

string

Allowed values: client tenant_default platform_default

reason

A fixed code for what failed underneath. legacy_profile_only_selector: the app’s own choice names a Destination Profile (destinationProfileId) and no Mapping Set and no opt-out, a selector of the older kind, which is not a choice; the release fails for the app (400 invalid_client) rather than lose the profile’s gate in silence (select a Mapping Set or save { "mode": "none" }). With settings_unreadable, the code of the read that failed (unknown when it has none).

string

chain

required

The app’s level, the tenant default and the platform default, in that order.

Array<object>

object

tier

required

string

Allowed values: client tenant_default platform_default

state

required

What the level says. This endpoint reads every level, so unset, set, none and invalid are what is found. not_consulted is given for the two defaults only when they were not read for this answer: the app’s own identity_mapping is not a choice (selection is failed with client_selector_invalid, and nothing below it is looked at), or the app decides (a set, or an opt-out) and the settings that hold the defaults could not be read.

string

Allowed values: unset set none invalid not_consulted

setId

The set the level names, when state is set.

string

source

For the two defaults: kv is saved at the tenant itself, platform is the platform’s value.

string

Allowed values: kv platform tenant env default

setFound

Whether the set exists and the calling tenant may name it (its own or the platform’s). False for a set that does not exist and for another tenant’s. Absent, with the other set* fields, when the Admin database could not be read.

boolean

setName

string

setOwner

string

Allowed values: tenant platform

setLifecycleState

string

warnings

Given with a selection of none because nothing is named (no_default); empty otherwise. implicit_activation_no_longer_applies: the tenant has active activations that fit an OIDC call (for an app, one that names it counts too), which the release used to apply to an app naming no Mapping Set and no longer does. Name the Mapping Set as the tenant’s default (or the app’s own) to keep what they did. Only this tenant’s rows are read, and only IDs and names are given.

Array<object>

object

code

required

string

Allowed values: implicit_activation_no_longer_applies

activations

required

Array<object>

object

activationId

required

string

setId

required

string

setName

string

key

additional properties

key

additional properties

warnings_unavailable

The Admin database could not be read to look for the activations, so warnings is empty without the tenant having none.

boolean

key

additional properties

refusals

Why a save of the proposal would be refused; after binds nothing then.

Array<object>

object

tier

required

string

Allowed values: client tenant_default

reason

required

string

message

required

string

key

additional properties

key

additional properties

Example

{
  "before": {
    "selection": {
      "kind": "bound",
      "tier": "client",
      "setOwner": "tenant"
    },
    "chain": [
      {
        "tier": "client",
        "state": "unset",
        "source": "kv",
        "setOwner": "tenant"
      }
    ],
    "warnings": [
      {
        "code": "implicit_activation_no_longer_applies"
      }
    ],
    "warnings_unavailable": true
  },
  "after": {
    "selection": {
      "kind": "bound",
      "tier": "client",
      "setOwner": "tenant"
    },
    "chain": [
      {
        "tier": "client",
        "state": "unset",
        "source": "kv",
        "setOwner": "tenant"
      }
    ],
    "warnings": [
      {
        "code": "implicit_activation_no_longer_applies"
      }
    ],
    "warnings_unavailable": true
  },
  "refusals": [
    {
      "tier": "client"
    }
  ]
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

429

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}