Inspect a proposed platform default Mapping Set.

POST

/api/admin/platform/identity-mapping/preview-default

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin/platform/identity-mapping/preview-default \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "set_id": "example" }'

Requires the settings read permission for every tenant, through a global assignment or a machine token with global tenant scope. Agents and tenant-limited administrators are refused. The proposal changes no settings, mappings or apps. A string selects a usable platform-owned set; null previews clearing the saved platform value and applying its inherited fallback. Tenants with an unset default are following, those explicitly naming a set are own_default even when they name the current platform set, and those saving none are opted_out. Deleted tenants are excluded and suspended tenants are included. Single-tenant mode restricts the inventory to the configured tenant. Only apps with no choice of their own in following tenants contribute to apps_affected; an unchanged effective default affects zero apps. Claim changes describe the default’s structure, using its active version, catalog and namespace; they are not a per-app scope or value evaluation. An unavailable old mapping is identified by before_unavailable and an unknown difference is null. An unavailable proposed mapping is refused. Counts are a fresh, bounded observation, not an atomic fleet snapshot. A complete inventory of at most 100 tenants is required; partial reads, exceeded budgets, conflicting runtime activation scopes, or a lagging settings projection return 503. The response’s expected_version can be submitted to the platform settings PATCH, together with an optional expected_following count. Rate limited with the strict profile. The exact inspection POST remains available while release mutations are paused; actual saves remain subject to the mutation fence.

Authorizations

• adminBearer
• adminSessionCookie

Request Body ^required

Media type application/json

object

set_id

required

A platform-owned Mapping Set ID, or null to clear. The reserved none choice is not a platform default.

string | null

>= 1 characters <= 200 characters /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/

key

additional properties

Example ^generated

{
  "set_id": "example"
}

Responses

200

A complete read-only preview of the default change.

Media type application/json

object

tenants

required

object

following

required

integer

own_default

required

integer

opted_out

required

integer

key

additional properties

apps_affected

required

integer

expected_version

required

string

by_tenant

required

Array<object>

<= 100 items

object

tenant_id

required

string

relation

required

string

Allowed values: following own_default opted_out

apps_following_default

required

integer

before_unavailable

string

Allowed values: default_setting_invalid set_missing set_inactive destination_profile_invalid

claim_changes

required

Structural default changes, or null when the old mapping is unavailable.

object

added

required

integer

removed

required

integer

renamed

required

integer

key

additional properties

key

additional properties

key

additional properties

Example

{
  "by_tenant": [
    {
      "relation": "following",
      "before_unavailable": "default_setting_invalid"
    }
  ]
}

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

429

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}