Auth0 tenants API

openapi: 3.2.0
info:
  title: Auth0 Management Tenants API
  description: Auth0 Management API v2.
  termsOfService: https://auth0.com/web-terms/
  contact:
    name: Auth0 Support
    url: https://support.auth0.com
  version: '2.0'
servers:
- url: https://{tenantDomain}/api/v2
  variables:
    tenantDomain:
      default: '{TENANT}.auth0.com'
      description: Auth0 Tenant Domain
security:
- bearerAuth: []
tags:
- name: tenants
paths:
  /tenants/settings:
    get:
      summary: Get Tenant Settings
      description: Retrieve tenant settings. A list of fields to include or exclude may also be specified.
      tags:
      - tenants
      parameters:
      - name: fields
        in: query
        description: Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
        schema:
          type: string
          pattern: ^((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience))(,((allowed_logout_urls)|(change_password)|(default_token_quota)|(error_page)|(flags)|(friendly_name)|(picture_url)|(support_email)|(support_url)|(session_lifetime)|(default_audience)|(default_directory)|(device_flow)|(idle_session_lifetime)|(ephemeral_session_lifetime)|(idle_ephemeral_session_lifetime)|(default_redirection_uri)|(universal_login)|(universal_login\.colors)|(universal_login\.passwordless)|(enabled_locales)|(session_cookie)|(sessions)|(oidc_logout)|(allow_organization_name_in_authentication_api)|(mtls)|(customize_mfa_in_postlogin_action)|(skip_non_verifiable_callback_uri_confirmation_prompt)|(resource_parameter_profile)|(enable_ai_guide)|(client_id_metadata_document_supported)|(phone_consolidated_experience)))*$
      - name: include_fields
        in: query
        description: Whether specified fields are to be included (true) or excluded (false).
        schema:
          type: boolean
      responses:
        '200':
          description: Tenant settings successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTenantSettingsResponseContent'
        '400':
          description: Invalid request query string. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: The specified client cannot perform the requested operation.
          x-description-1: 'Insufficient scope; expected any of: read:tenant_settings.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: tenant_settings_route
      x-release-lifecycle: GA
      x-operation-name: get
      x-operation-request-parameters-name: GetTenantSettingsRequestParameters
      x-operation-group:
      - tenants
      - settings
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - read:tenant_settings
    patch:
      summary: Update Tenant Settings
      description: Update settings for a tenant.
      tags:
      - tenants
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/UpdateTenantSettingsRequestContent'
      responses:
        '200':
          description: Tenant settings successfully updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTenantSettingsResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation.
        '403':
          description: 'Insufficient scope; expected any of: update:tenant_settings.'
        '429':
          description: Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.
      operationId: patch_settings
      x-release-lifecycle: GA
      x-operation-name: update
      x-operation-group:
      - tenants
      - settings
      security:
      - bearerAuth: []
      - oAuth2ClientCredentials:
        - update:tenant_settings
components:
  schemas:
    UpdateTenantSettingsResponseContent:
      type: object
      additionalProperties: false
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email address.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support URL.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url
        session_lifetime:
          type: number
          description: Number of hours a session will stay valid.
          default: 168
        idle_session_lifetime:
          type: number
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
        ephemeral_session_lifetime:
          type: number
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: number
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment.
          default: '22'
        legacy_sandbox_version:
          type: string
          description: Selected sandbox version for rules and hooks extensibility.
          default: ''
        sandbox_versions_available:
          type: array
          description: Available sandbox versions for the extensibility environment.
          items:
            type: string
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
        enabled_locales:
          type: array
          description: Supported locales for the user interface.
          items:
            $ref: '#/components/schemas/SupportedLocales'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        allow_organization_name_in_authentication_api:
          type: boolean
          description: Whether to accept an organization name instead of an ID on auth endpoints
          default: false
        customize_mfa_in_postlogin_action:
          type: boolean
          description: Whether to enable flexible factors for MFA in the PostLogin action
          default: false
        acr_values_supported:
          type:
          - array
          - 'null'
          description: Supported ACR values
          minItems: 0
          items:
            type: string
            format: acr
        mtls:
          $ref: '#/components/schemas/TenantSettingsMTLS'
        pushed_authorization_requests_supported:
          type: boolean
          description: Enables the use of Pushed Authorization Requests
          default: false
        authorization_response_iss_parameter_supported:
          type:
          - boolean
          - 'null'
          description: Supports iss parameter in authorization responses
          default: false
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type:
          - boolean
          - 'null'
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        resource_parameter_profile:
          $ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
          x-release-lifecycle: GA
        client_id_metadata_document_supported:
          type: boolean
          description: Whether the authorization server supports retrieving client metadata from a client_id URL.
          default: false
          x-release-lifecycle: EA
        phone_consolidated_experience:
          type: boolean
          description: Whether Phone Consolidated Experience is enabled for this tenant.
        enable_ai_guide:
          type: boolean
          description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
        dynamic_client_registration_security_mode:
          $ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
          x-release-lifecycle: GA
    UpdateTenantSettingsRequestContent:
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
          description: Device Flow configuration.
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API Authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token` endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support url.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url-with-placeholders
        session_lifetime:
          type: integer
          description: Number of hours a session will stay valid.
          default: 168
          minimum: 1
        idle_session_lifetime:
          type: integer
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
          minimum: 1
        ephemeral_session_lifetime:
          type: integer
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: integer
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment
          default: '22'
          maxLength: 8
        legacy_sandbox_version:
          type: string
          description: Selected legacy sandbox version for the extensibility environment
          maxLength: 8
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
          format: absolute-https-uri-or-empty
        enabled_locales:
          type: array
          description: Supported locales for the user interface
          minItems: 1
          items:
            $ref: '#/components/schemas/TenantSettingsSupportedLocalesEnum'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        customize_mfa_in_postlogin_action:
          type:
          - boolean
          - 'null'
          description: Whether to enable flexible factors for MFA in the PostLogin action
          default: false
        allow_organization_name_in_authentication_api:
          type:
          - boolean
          - 'null'
          description: Whether to accept an organization name instead of an ID on auth endpoints
          default: false
        acr_values_supported:
          type:
          - array
          - 'null'
          description: Supported ACR values
          minItems: 0
          items:
            type: string
            format: acr
        mtls:
          $ref: '#/components/schemas/TenantSettingsMTLS'
        pushed_authorization_requests_supported:
          type:
          - boolean
          - 'null'
          description: Enables the use of Pushed Authorization Requests
          default: false
        authorization_response_iss_parameter_supported:
          type:
          - boolean
          - 'null'
          description: Supports iss parameter in authorization responses
          default: false
        skip_non_verifiable_callback_uri_confirmation_prompt:
          type:
          - boolean
          - 'null'
          description: 'Controls whether a confirmation prompt is shown during login flows when the redirect URI uses non-verifiable callback URIs (for example, a custom URI schema such as `myapp://`, or `localhost`).

            If set to true, a confirmation prompt will not be shown. We recommend that this is set to false for improved protection from malicious apps.

            See https://auth0.com/docs/secure/security-guidance/measures-against-app-impersonation for more information.'
        resource_parameter_profile:
          $ref: '#/components/schemas/TenantSettingsResourceParameterProfile'
          x-release-lifecycle: GA
        client_id_metadata_document_supported:
          type: boolean
          description: Whether the authorization server supports retrieving client metadata from a client_id URL.
          default: false
          x-release-lifecycle: EA
        enable_ai_guide:
          type: boolean
          description: Whether Auth0 Guide (AI-powered assistance) is enabled for this tenant.
        phone_consolidated_experience:
          type: boolean
          description: Whether Phone Consolidated Experience is enabled for this tenant.
        dynamic_client_registration_security_mode:
          $ref: '#/components/schemas/TenantSettingsDynamicClientRegistrationSecurityMode'
          x-release-lifecycle: GA
    TenantOIDCLogoutSettings:
      type: object
      description: Settings related to OIDC RP-initiated Logout
      additionalProperties: false
      properties:
        rp_logout_end_session_endpoint_discovery:
          type: boolean
          description: Enable the end_session_endpoint URL in the .well-known discovery configuration
          default: true
    SupportedLocales:
      type: string
      enum:
      - am
      - ar
      - ar-EG
      - ar-SA
      - az
      - bg
      - bn
      - bs
      - ca-ES
      - cnr
      - cs
      - cy
      - da
      - de
      - el
      - en
      - en-CA
      - es
      - es-419
      - es-AR
      - es-MX
      - et
      - eu-ES
      - fa
      - fi
      - fr
      - fr-CA
      - fr-FR
      - gl-ES
      - gu
      - he
      - hi
      - hr
      - hu
      - hy
      - id
      - is
      - it
      - ja
      - ka
      - kk
      - kn
      - ko
      - lt
      - lv
      - mk
      - ml
      - mn
      - mr
      - ms
      - my
      - nb
      - nl
      - nn
      - 'no'
      - pa
      - pl
      - pt
      - pt-BR
      - pt-PT
      - ro
      - ru
      - sk
      - sl
      - so
      - sq
      - sr
      - sv
      - sw
      - ta
      - te
      - th
      - tl
      - tr
      - uk
      - ur
      - vi
      - zgh
      - zh-CN
      - zh-HK
      - zh-MO
      - zh-TW
    TenantSettingsDeviceFlowCharset:
      type: string
      description: Character set used to generate a User Code. Can be `base20` or `digits`.
      default: base20
      enum:
      - base20
      - digits
    TenantSettingsMTLS:
      type:
      - object
      - 'null'
      description: mTLS configuration.
      additionalProperties: false
      properties:
        enable_endpoint_aliases:
          type: boolean
          description: If true, enables mTLS endpoint aliases
          default: false
    TenantSettingsFlags:
      type: object
      description: Flags used to change the behavior of this tenant.
      additionalProperties: false
      properties:
        change_pwd_flow_v1:
          type: boolean
          description: Whether to use the older v1 change password flow (true, not recommended except for backward compatibility) or the newer safer flow (false, recommended).
          default: false
        enable_apis_section:
          type: boolean
          description: Whether the APIs section is enabled (true) or disabled (false).
          default: false
        disable_impersonation:
          type: boolean
          description: Whether the impersonation functionality has been disabled (true) or not (false). Read-only.
          default: false
        enable_client_connections:
          type: boolean
          description: Whether all current connections should be enabled when a new client (application) is created (true, default) or not (false).
          default: true
        enable_pipeline2:
          type: boolean
          description: Whether advanced API Authorization scenarios are enabled (true) or disabled (false).
          default: true
        allow_legacy_delegation_grant_types:
          type: boolean
          description: If enabled, clients are able to add legacy delegation grants.
        allow_legacy_ro_grant_types:
          type: boolean
          description: If enabled, clients are able to add legacy RO grants.
        allow_legacy_tokeninfo_endpoint:
          type: boolean
          description: Whether the legacy `/tokeninfo` endpoint is enabled for your account (true) or unavailable (false).
        enable_legacy_profile:
          type: boolean
          description: Whether ID tokens and the userinfo endpoint includes a complete user profile (true) or only OpenID Connect claims (false).
        enable_idtoken_api2:
          type: boolean
          description: Whether ID tokens can be used to authorize some types of requests to API v2 (true) not not (false).
        enable_public_signup_user_exists_error:
          type: boolean
          description: Whether the public sign up process shows a user_exists error (true) or a generic error (false) if the user already exists.
        enable_sso:
          type: boolean
          description: Whether users are prompted to confirm log in before SSO redirection (false) or are not prompted (true).
        allow_changing_enable_sso:
          type: boolean
          description: Whether the `enable_sso` setting can be changed (true) or not (false).
        disable_clickjack_protection_headers:
          type: boolean
          description: Whether classic Universal Login prompts include additional security headers to prevent clickjacking (true) or no safeguard (false).
        no_disclose_enterprise_connections:
          type: boolean
          description: Do not Publish Enterprise Connections Information with IdP domains on the lock configuration file.
        enforce_client_authentication_on_passwordless_start:
          type: boolean
          description: Enforce client authentication for passwordless start.
        enable_adfs_waad_email_verification:
          type: boolean
          description: Enables the email verification flow during login for Azure AD and ADFS connections
        revoke_refresh_token_grant:
          type: boolean
          description: Delete underlying grant when a Refresh Token is revoked via the Authentication API.
        dashboard_log_streams_next:
          type: boolean
          description: Enables beta access to log streaming changes
        dashboard_insights_view:
          type: boolean
          description: Enables new insights activity page view
        disable_fields_map_fix:
          type: boolean
          description: Disables SAML fields map fix for bad mappings with repeated attributes
        mfa_show_factor_list_on_enrollment:
          type: boolean
          description: Used to allow users to pick what factor to enroll of the available MFA factors.
        remove_alg_from_jwks:
          type: boolean
          description: Removes alg property from jwks .well-known endpoint
        improved_signup_bot_detection_in_classic:
          type: boolean
          description: Improves bot detection during signup in classic universal login
        genai_trial:
          type: boolean
          description: This tenant signed up for the Auth4GenAI trail
        enable_dynamic_client_registration:
          type: boolean
          description: Whether third-party developers can <a href="https://auth0.com/docs/api-auth/dynamic-client-registration">dynamically register</a> applications for your APIs (true) or not (false). This flag enables dynamic client registration.
          default: false
        disable_management_api_sms_obfuscation:
          type: boolean
          description: If true, SMS phone numbers will not be obfuscated in Management API GET calls.
          default: true
        trust_azure_adfs_email_verified_connection_property:
          type: boolean
          description: Changes email_verified behavior for Azure AD/ADFS connections when enabled. Sets email_verified to false otherwise.
          default: false
        custom_domains_provisioning:
          type: boolean
          description: If true, custom domains feature will be enabled for tenant.
          default: false
    TenantSettingsPasswordPage:
      type:
      - object
      - 'null'
      description: Change Password page customization.
      additionalProperties: false
      properties:
        enabled:
          type: boolean
          description: Whether to use the custom change password HTML (true) or the default Auth0 page (false). Default is to use the Auth0 page.
          default: false
        html:
          type: string
          description: Custom change password HTML (<a href='https://github.com/Shopify/liquid/wiki/Liquid-for-Designers'>Liquid syntax</a> supported).
          default: ''
    TokenQuotaClientCredentials:
      type: object
      description: The token quota configuration
      additionalProperties: false
      minProperties: 1
      properties:
        enforce:
          type: boolean
          description: If enabled, the quota will be enforced and requests in excess of the quota will fail. If disabled, the quota will not be enforced, but notifications for requests exceeding the quota will be available in logs.
        per_day:
          type: integer
          description: Maximum number of issued tokens per day
          minimum: 1
          maximum: 2147483647
        per_hour:
          type: integer
          description: Maximum number of issued tokens per hour
          minimum: 1
          maximum: 2147483647
    SessionCookieModeEnum:
      type: string
      description: Behavior of the session cookie
      default: persistent
      enum:
      - persistent
      - non-persistent
    TenantSettingsSessions:
      type:
      - object
      - 'null'
      description: Sessions related settings for tenant
      additionalProperties: false
      properties:
        oidc_logout_prompt_enabled:
          type: boolean
          description: Whether to bypass prompting logic (false) when performing OIDC Logout
          default: true
    TenantSettingsSupportedLocalesEnum:
      type: string
      enum:
      - am
      - ar
      - ar-EG
      - ar-SA
      - az
      - bg
      - bn
      - bs
      - ca-ES
      - cnr
      - cs
      - cy
      - da
      - de
      - el
      - en
      - en-CA
      - es
      - es-419
      - es-AR
      - es-MX
      - et
      - eu-ES
      - fa
      - fi
      - fr
      - fr-CA
      - fr-FR
      - gl-ES
      - gu
      - he
      - hi
      - hr
      - hu
      - hy
      - id
      - is
      - it
      - ja
      - ka
      - kk
      - kn
      - ko
      - lt
      - lv
      - mk
      - ml
      - mn
      - mr
      - ms
      - my
      - nb
      - nl
      - nn
      - 'no'
      - pa
      - pl
      - pt
      - pt-BR
      - pt-PT
      - ro
      - ru
      - sk
      - sl
      - so
      - sq
      - sr
      - sv
      - sw
      - ta
      - te
      - th
      - tl
      - tr
      - uk
      - ur
      - vi
      - zgh
      - zh-CN
      - zh-HK
      - zh-MO
      - zh-TW
    SessionCookieSchema:
      type:
      - object
      - 'null'
      description: Session cookie configuration
      additionalProperties: false
      required:
      - mode
      properties:
        mode:
          $ref: '#/components/schemas/SessionCookieModeEnum'
    TokenQuotaConfiguration:
      type: object
      additionalProperties: true
      required:
      - client_credentials
      properties:
        client_credentials:
          $ref: '#/components/schemas/TokenQuotaClientCredentials'
    GetTenantSettingsResponseContent:
      type: object
      additionalProperties: false
      properties:
        change_password:
          $ref: '#/components/schemas/TenantSettingsPasswordPage'
        guardian_mfa_page:
          $ref: '#/components/schemas/TenantSettingsGuardianPage'
        default_audience:
          type: string
          description: Default audience for API authorization.
          default: ''
        default_directory:
          type: string
          description: 'Name of connection used for password grants at the `/token`endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.'
          default: ''
        error_page:
          $ref: '#/components/schemas/TenantSettingsErrorPage'
        device_flow:
          $ref: '#/components/schemas/TenantSettingsDeviceFlow'
        default_token_quota:
          $ref: '#/components/schemas/DefaultTokenQuota'
          x-release-lifecycle: EA
        flags:
          $ref: '#/components/schemas/TenantSettingsFlags'
        friendly_name:
          type: string
          description: Friendly name for this tenant.
          default: My Company
        picture_url:
          type: string
          description: 'URL of logo to be shown for this tenant (recommended size: 150x150)'
          default: https://mycompany.org/logo.png
          format: absolute-uri-or-empty
        support_email:
          type: string
          description: End-user support email address.
          default: support@mycompany.org
          format: email-or-empty
        support_url:
          type: string
          description: End-user support URL.
          default: https://mycompany.org/support
          format: absolute-uri-or-empty
        allowed_logout_urls:
          type: array
          description: URLs that are valid to redirect to after logout from Auth0.
          items:
            type: string
            format: url
        session_lifetime:
          type: number
          description: Number of hours a session will stay valid.
          default: 168
        idle_session_lifetime:
          type: number
          description: Number of hours for which a session can be inactive before the user must log in again.
          default: 72
        ephemeral_session_lifetime:
          type: number
          description: Number of hours an ephemeral (non-persistent) session will stay valid.
          default: 72
          minimum: 1
        idle_ephemeral_session_lifetime:
          type: number
          description: Number of hours for which an ephemeral (non-persistent) session can be inactive before the user must log in again.
          default: 24
          minimum: 1
        sandbox_version:
          type: string
          description: Selected sandbox version for the extensibility environment.
          default: '22'
        legacy_sandbox_version:
          type: string
          description: Selected sandbox version for rules and hooks extensibility.
          default: ''
        sandbox_versions_available:
          type: array
          description: Available sandbox versions for the extensibility environment.
          items:
            type: string
        default_redirection_uri:
          type: string
          description: The default absolute redirection uri, must be https
        enabled_locales:
          type: array
          description: Supported locales for the user interface.
          items:
            $ref: '#/components/schemas/SupportedLocales'
        session_cookie:
          $ref: '#/components/schemas/SessionCookieSchema'
        sessions:
          $ref: '#/components/schemas/TenantSettingsSessions'
        oidc_logout:
          $ref: '#/components/schemas/TenantOIDCLogoutSettings'
        allow_organization_name_in_authenticati

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/auth0/refs/heads/main/openapi/auth0-tenants-api-openapi.yml