OpenAPI Specification
openapi: 3.1.0
info:
version: 16.10.0
title: Amplify Platform API v1.0.0 aca idp API
description: 'The Amplify Platform API provides the interface to perform the following:
- Manage account settings and credentials
- Manage organization settings, users, service accounts, and teams
- Retrieve organization usage data
- Register and manage applications
- Retrieve application metrics and analytics
- Retrieve user, organization, and application activity
See the <a href="https://docs.axway.com/bundle/amplify-central/page/docs/integrate_with_central/platform-auth-examples/index.html" target="_blank">Amplify Guide</a> for documentation and examples on how to authorize API calls to platform services.
For general documentation refer to the <a href="https://docs.axway.com/category/platform" target="_blank">Amplify Platform documentation</a>.
© Axway 2026. All rights reserved.'
contact:
email: support@axway.com
termsOfService: https://www.axway.com/en/axway-platform-terms-of-use
servers:
- url: https://platform.axway.com/api/v1
tags:
- name: idp
paths:
/provider/{provider_id}/idp/saml:
parameters: []
post:
externalDocs:
description: Managing Identity Providers
url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html
tags:
- idp
summary: Axway Create Consumer SAML V2.0 IdP
description: "Configure a custom SAML v2.0 Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n"
operationId: provider_idpCreateSAML
x-publishes:
- marketplace.idp.create
responses:
'200':
description: Response
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/Response'
- properties:
result:
type: object
required:
- guid
- name
- protocol
unevaluatedProperties: false
allOf:
- $ref: '#/components/schemas/DefaultFields'
properties:
_id:
type: string
description: Document ID of the Identity Provider.
deprecated: true
description:
type: string
description: Description of the Identity Provider.
guid:
type: string
format: uuid
description: '`guid` of the Identity Provider.'
name:
type: string
description: Name of Identity Provider
protocol:
type: string
description: Protocol the Identity Provider uses.
enum:
- oidc
- saml
provider_guid:
type: string
examples:
ProviderIdpcreatesaml200Example:
summary: Default provider_idpCreateSAML 200 response
x-microcks-default: true
value: example_value
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
IDP_MIXED_MAPPERS:
value:
success: false
description: Cannot configure mappers with the same value in both Friendly and Attribute Names.
code: 400
FORBIDDEN:
value:
$ref: '#/components/examples/FORBIDDEN/value'
NOT_FOUND:
value:
$ref: '#/components/examples/NOT_FOUND/value'
USER_NOT_ADMIN:
value:
$ref: '#/components/examples/USER_NOT_ADMIN/value'
LOGIN_REQUIRED:
value:
$ref: '#/components/examples/LOGIN_REQUIRED/value'
PARAM_INVALID:
value:
$ref: '#/components/examples/PARAM_INVALID/value'
PARAM_REQUIRED:
value:
$ref: '#/components/examples/PARAM_REQUIRED/value'
security:
- BearerClient: []
- SessionCookie: []
- BearerUser: []
parameters:
- $ref: '#/components/parameters/fields'
example: example_value
- $ref: '#/components/parameters/exclude_fields'
example: example_value
- in: path
name: provider_id
required: true
schema:
$ref: '#/components/schemas/Provider/properties/guid'
example: {}
requestBody:
content:
'*/*':
schema:
properties:
allowedClockSkew:
type: integer
description: Clock skew in seconds that is tolerated when validating identity provider tokens
default: 0
attributeConsumingServiceIndex:
type: integer
description: Index of the Attribute Consuming Service profile to request during authentication
default: 0
attributeConsumingServiceName:
type: string
description: Name of the Attribute Consuming Service profile to advertise in the SP metadata
backchannelSupported:
type: boolean
description: Whether the IdP supports backchannel logout
default: false
description:
$ref: '#/components/schemas/IdentityProvider/properties/description'
encryptionAlgorithm:
type: string
description: Encryption algorithm which is used by the SAML Identity Provider for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypt SAML document parts will be chosen based on this configured algorithm and is provided by Axway for the encryption (ENC) usage. If algorithm is not configured, then any supported algorithm is allowed and decryption key will be chosen based on the algorithm configured in SAML document itself.
enum:
- RSA-OAEP
entityId:
type: string
description: The Entity ID that will be used to uniquely identify this SAML Service Provider
forceAuthn:
type: boolean
description: Whether the IdP must authenticate the presenter directly rather than rely on a previous security context
default: false
idpEntityId:
type: string
description: The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed
loginHint:
type: boolean
description: Whether to pass login_hint to the IdP
default: true
metadataDescriptorUrl:
type: string
description: External URL where the Identity Provider publishes the SAML Descriptor metadata information to source the X509 certificates used to validate signatures
name:
$ref: '#/components/schemas/IdentityProvider/properties/name'
nameIDPolicyFormat:
type: string
description: Specifies the URI reference corresponding to a name identifier format
enum:
- urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
- urn:oasis:names:tc:SAML:2.0:nameid-format:transient
- urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos
- urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
- urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName
- urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
postBindingAuthnRequest:
type: boolean
description: Indicates whether the AuthnRequest must be sent using HTTP-POST binding
default: true
postBindingLogout:
type: boolean
description: Indicates whether to respond to requests using HTTP-POST binding
default: false
postBindingResponse:
type: boolean
description: Indicates whether to respond to requests using HTTP-POST binding
default: true
xmlSigKeyInfoKeyNameTransformer:
type: string
description: Signing key to use in KeyName element
enum:
- NONE
- KEY_ID
- CERT_SUBJECT
signSpMetadata:
type: boolean
description: Enable/disable signature of the provider SAML metadata
signatureAlgorithm:
type: string
description: The signature algorithm to use to sign documents
enum:
- RSA_SHA256
- RSA_SHA256_MGF1
- RSA_SHA512
- RSA_SHA512_MGF1
signingCertificate:
type: string
description: The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma
singleLogoutServiceUrl:
type: string
description: The URL that must be used to send logout requests
singleSignOnServiceUrl:
type: string
description: The URL that must be used to send authentication requests
useMetadataDescriptorUrl:
type: boolean
description: Whether to use a configured Metadata Descriptor URL to source the X509 certificates used to validate signatures
validateSignature:
type: boolean
description: Enable/disable signature validation of IdP signatures
default: false
wantAssertionsEncrypted:
type: boolean
description: Whether to expect an encrypted assertion
default: false
wantAssertionsSigned:
type: boolean
description: Whether to expect a signed assertion
default: false
wantAuthnRequestsSigned:
type: boolean
description: Indicates whether the IdP expects a signed AuthnRequest
default: true
mapperAttrEmail:
type: string
description: Attribute name of the attribute to map to a user's email
mapperFriendlyEmail:
type: string
description: Friendly name of the attribute to map to a user's email. One of friendly or attribute name is required
mapperAttrFirstname:
type: string
description: Attribute name of the attribute to map to a user's first name. One of friendly or attribute name is required
mapperFriendlyFirstname:
type: string
description: Friendly name of the attribute to map to a user's first name. One of friendly or attribute name is required
mapperAttrLastname:
type: string
description: Attribute name of the attribute to map to a user's last name. One of friendly or attribute name is required
mapperFriendlyLastname:
type: string
description: Friendly name of the attribute to map to a user's last name. One of friendly or attribute name is required
mapperAttrPhone:
type: string
description: Attribute name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied
mapperFriendlyPhone:
type: string
description: Friendly name of the attribute to map to a user's phone number. One of friendly or attribute name can be supplied
mapperAttrCountry:
type: string
description: Attribute name of the attribute to map to a user's country. One of friendly or attribute name can be supplied
mapperFriendlyCountry:
type: string
description: Friendly name of the attribute to map to a user's country. One of friendly or attribute name can be supplied
caseInsensitiveMappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles'
defaultRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles'
enforceMappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles'
mappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles'
mapperAttrConsumerId:
type: string
description: Attribute name of the attribute to map to the consumer organization ID(s). One of friendly or attribute name can be supplied
mapperFriendlyConsumerId:
type: string
description: Friendly name of the attribute to map to the consumer organization ID(s). One of friendly or attribute name can be supplied
consumerDefaultTeam:
type: boolean
description: Whether to add new users to the default team of the consumer organization
consumerDefaultTeamRoles:
type: array
description: The roles to assign to new users in the default team of the consumer organization
items:
type: string
consumerDefaultTeamPrivate:
type: boolean
description: Whether to make the default team of the consumer organization private when a new organization is created
required:
- name
- nameIDPolicyFormat
- singleSignOnServiceUrl
- defaultRoles
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/provider/{provider_id}/idp/oidc:
parameters: []
post:
externalDocs:
description: Managing Identity Providers
url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html
tags:
- idp
summary: Axway Create Consumer OIDC IdP
description: "Configure a custom OIDC Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n"
operationId: provider_idpCreateOIDC
x-publishes:
- marketplace.idp.create
responses:
'200':
description: Response
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/Response'
- properties:
result:
type: object
required:
- guid
- name
- protocol
unevaluatedProperties: false
allOf:
- $ref: '#/components/schemas/DefaultFields'
properties:
_id:
type: string
description: Document ID of the Identity Provider.
deprecated: true
description:
type: string
description: Description of the Identity Provider.
guid:
type: string
format: uuid
description: '`guid` of the Identity Provider.'
name:
type: string
description: Name of Identity Provider
protocol:
type: string
description: Protocol the Identity Provider uses.
enum:
- oidc
- saml
provider_guid:
type: string
examples:
ProviderIdpcreateoidc200Example:
summary: Default provider_idpCreateOIDC 200 response
x-microcks-default: true
value: example_value
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
FORBIDDEN:
value:
$ref: '#/components/examples/FORBIDDEN/value'
NOT_FOUND:
value:
$ref: '#/components/examples/NOT_FOUND/value'
USER_NOT_ADMIN:
value:
$ref: '#/components/examples/USER_NOT_ADMIN/value'
LOGIN_REQUIRED:
value:
$ref: '#/components/examples/LOGIN_REQUIRED/value'
PARAM_INVALID:
value:
$ref: '#/components/examples/PARAM_INVALID/value'
PARAM_REQUIRED:
value:
$ref: '#/components/examples/PARAM_REQUIRED/value'
security:
- BearerClient: []
- SessionCookie: []
- BearerUser: []
parameters:
- $ref: '#/components/parameters/fields'
example: example_value
- $ref: '#/components/parameters/exclude_fields'
example: example_value
- in: path
name: provider_id
required: true
schema:
$ref: '#/components/schemas/Provider/properties/guid'
example: {}
requestBody:
content:
'*/*':
schema:
properties:
allowedClockSkew:
type: integer
description: Clock skew in seconds that is tolerated when validating identity provider tokens
default: 0
authorizationUrl:
type: string
description: Authorization URL
backchannelSupported:
type: boolean
description: Whether the IdP supports backchannel logout
default: false
clientAssertionAudience:
type: string
description: The audience to use for the client assertion. The default value is the Identity Provider's token endpoint URL
clientAssertionSigningAlg:
type: string
description: 'Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted: `RS256` is adapted in the case of JWT signed with private key, `HS256` is adapted in the case of JWT signed with client secret'
enum:
- algorithmNotSpecified
- ES256
- ES384
- ES512
- HS256
- HS384
- HS512
- PS256
- PS384
- PS512
- RS256
- RS384
- RS512
default: algorithmNotSpecified
clientAuthMethod:
type: string
description: The client authentication method. In case of JWT signed with private key, Axway's private key is used
enum:
- client_secret_post
- client_secret_basic
- client_secret_jwt
- private_key_jwt
clientId:
type: string
description: The client identifier registered within the IdP
clientSecret:
type: string
description: The client secret registered within the IdP
defaultScope:
type: string
description: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes
description:
$ref: '#/components/schemas/IdentityProvider/properties/description'
issuer:
type: string
description: The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
jwksUrl:
type: string
description: URL where identity provider keys in JWK format are stored
jwtX509HeadersEnabled:
type: boolean
description: If enabled, the `x5t` (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the `kid` (Key ID) header will be used instead
loginHint:
type: boolean
description: Whether to pass login_hint to the IdP
default: true
logoutUrl:
type: string
description: End session endpoint to use to logout user from the external IdP
name:
$ref: '#/components/schemas/IdentityProvider/properties/name'
pkceEnabled:
type: boolean
description: Use PKCE (Proof of Key-code exchange) for Identity Provider Brokering
pkceMethod:
type: string
description: PKCE Method to use
enum:
- plain
- S256
publicKeySignatureVerifier:
type: string
description: The public key in PEM format that must be used to verify IdP signatures
publicKeySignatureVerifierKeyId:
type: string
description: Explicit ID of the supplied validating public key
sendClientIdOnLogout:
type: boolean
description: If the `client_id` parameter should be sent in logout requests
sendIdTokenOnLogout:
type: boolean
description: If the `id_token_hint` parameter should be sent in logout requests
tokenUrl:
type: string
description: Token URL
useJwksUrl:
type: boolean
description: If enabled, then identity provider public keys will be downloaded from given JWKS URL
validateSignature:
type: boolean
description: Enable/disable signature validation of IdP signatures
default: false
mapperAttrEmail:
type: string
description: Name of claim to search for in token for the user's email address
mapperAttrFirstname:
type: string
description: Name of claim to search for in token for the user's first name
mapperAttrLastname:
type: string
description: Name of claim to search for in token for the user's last name
mapperAttrPhone:
type: string
description: Name of claim to search for in token for the user's phone number
mapperAttrCountry:
type: string
description: Name of claim to search for in token for the user's country
caseInsensitiveMappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/case_insensitive_mapped_roles'
defaultRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/default_roles'
enforceMappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/enforce_mapped_roles'
mappedRoles:
$ref: '#/components/schemas/IdentityProvider/properties/orgs/items/properties/mapped_roles'
mapperAttrConsumerId:
type: string
description: Name of claim to search for in token for the consumer organization ID(s)
consumerDefaultTeam:
type: boolean
description: Whether to add new users to the default team of the consumer organization
consumerDefaultTeamRoles:
type: array
description: The roles to assign to new users in the default team of the consumer organization
items:
type: string
consumerDefaultTeamPrivate:
type: boolean
description: Whether to make the default team of the consumer organization private when a new organization is created
required:
- authorizationUrl
- clientAuthMethod
- clientId
- defaultScope
- name
- tokenUrl
- mapperAttrEmail
- mapperAttrFirstname
- mapperAttrLastname
- defaultRoles
- mapperAttrConsumerId
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/provider/{provider_id}/idp:
parameters: []
get:
summary: Axway Get Consumer IdP
description: "Returns external IdP configured for the marketplace's consumer organization\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n"
externalDocs:
description: Managing Identity Providers
url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html
tags:
- idp
operationId: provider_idpFind
responses:
'200':
description: Response
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/Response'
- properties:
result:
$ref: '#/components/schemas/IdentityProviderList'
examples:
ProviderIdpfind200Example:
summary: Default provider_idpFind 200 response
x-microcks-default: true
value: example_value
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
FORBIDDEN:
value:
$ref: '#/components/examples/FORBIDDEN/value'
NOT_FOUND:
value:
$ref: '#/components/examples/NOT_FOUND/value'
USER_NOT_ADMIN:
value:
$ref: '#/components/examples/USER_NOT_ADMIN/value'
LOGIN_REQUIRED:
value:
$ref: '#/components/examples/LOGIN_REQUIRED/value'
PARAM_INVALID:
value:
$ref: '#/components/examples/PARAM_INVALID/value'
PARAM_REQUIRED:
value:
$ref: '#/components/examples/PARAM_REQUIRED/value'
security:
- BearerClient: []
- SessionCookie: []
- BearerUser: []
parameters:
- $ref: '#/components/parameters/fields'
example: example_value
- $ref: '#/components/parameters/exclude_fields'
example: example_value
- in: path
name: provider_id
required: true
schema:
$ref: '#/components/schemas/Provider/properties/guid'
example: {}
- in: query
name: basic
required: false
schema:
type: boolean
description: Whether to return a basic representation of the IdP
default: false
example: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
delete:
summary: Axway Remove Consumer IdP
description: "Removes a custom Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n - `administrator` access to the provider's organization.\n - The organization entitlements allow `idp`.\n"
externalDocs:
description: Managing Identity Providers
url: https://docs.axway.com/bundle/platform-management/page/docs/management_guide/configuring_and_managing_identity_providers/index.html
tags:
- idp
operationId: provider_idpRemove
x-publishes:
- marketplace.idp.remove
responses:
'204':
description: No Content
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
NOT_FOUND:
value:
$ref: '#/components/examples/NOT_FOUND/value'
PROVIDER_REMOVE_ENABLED_IDP:
value:
success: false
description: Identity Provider cannot be removed as Identity Provider Managed Consumers is enabled for the Marketplace.
code: 400
FORBIDDEN:
value:
$ref: '#/components/examples/FORBIDDEN/value'
USER_NOT_ADMIN:
value:
$ref: '#/components/examples/USER_NOT_ADMIN/value'
LOGIN_REQUIRED:
value:
$ref: '#/components/examples/LOGIN_REQUIRED/value'
PARAM_INVALID:
value:
$ref: '#/components/examples/PARAM_INVALID/value'
PARAM_REQUIRED:
value:
$ref: '#/components/examples/PARAM_REQUIRED/value'
security:
- BearerClient: []
- SessionCookie: []
- BearerUser: []
parameters:
- in: path
name: provider_id
required: true
schema:
$ref: '#/components/schemas/Provider/properties/guid'
example: {}
- in: query
name: cleanup
required: false
schema:
type: boolean
description: Whether to cascade delete consumer organizations and users created by this Identity Provider.
default: false
example: true
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
put:
summary: Axway Update Consumer IdP
description: "Update a custom Identity Provider for a marketplace's consumer organizations\n\n___Auth Requirement___\n - _All of_\n
# --- truncated at 32 KB (124 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/axway/refs/heads/main/openapi/axway-idp-api-openapi.yml