# Canonical Identity Platform API

**Canonical:** https://apis.io/apis/canonical/identity-platform-api/  
**Provider:** Canonical — https://apis.io/providers/canonical/  
**Documentation:** https://github.com/canonical/identity-platform-api

Canonical Identity Platform API is one of 22 APIs that [Canonical](https://apis.io/providers/canonical/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Identity, OIDC, and Authentication. The published artifact set on APIs.io includes an OpenAPI specification.

The API of Canonical's Identity Platform — an OIDC/OAuth 2.0 identity provider built on Ory and delivered as a Juju charm bundle. Covers identities, clients, schemas, providers, roles, groups, rules and entitlements. Canonical publishes an OpenAPI 3.0.3 contract with 45 paths and 79 operations, plus a gRPC-gateway swagger form in the same repository.

## Operations (60 of 79)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/v0/auth` | — |
| GET | `/api/v0/auth/callback` | — |
| GET | `/api/v0/auth/logout` | — |
| GET | `/api/v0/auth/me` | — |
| DELETE | `/api/v0/authz/apps/{app_id}/groups` | RemoveAllowedGroupsForApp removes an app from all groups it is allowed in. |
| GET | `/api/v0/authz/apps/{app_id}/groups` | GetAllowedGroupsForApp retrieves the list of groups an app is allowed in. |
| GET | `/api/v0/authz/groups` | — |
| POST | `/api/v0/authz/groups` | — |
| DELETE | `/api/v0/authz/groups/{group_id}/apps` | RemoveAllowedAppsFromGroup removes all apps from the allowed list of a group. |
| GET | `/api/v0/authz/groups/{group_id}/apps` | GetAllowedAppsInGroup retrieves the list of apps allowed in a specific group. |
| POST | `/api/v0/authz/groups/{group_id}/apps` | AddAllowedAppToGroup adds an app to the allowed list of a group. |
| DELETE | `/api/v0/authz/groups/{group_id}/apps/{app_id}` | RemoveAllowedAppFromGroup removes a specific app from the allowed list of a group. |
| DELETE | `/api/v0/authz/groups/{id}` | — |
| GET | `/api/v0/authz/groups/{id}` | — |
| PUT | `/api/v0/authz/groups/{id}` | — |
| GET | `/api/v0/authz/groups/{id}/users` | — |
| POST | `/api/v0/authz/groups/{id}/users` | — |
| DELETE | `/api/v0/authz/groups/{id}/users/{user_id}` | — |
| GET | `/api/v0/authz/users/{id}/groups` | — |
| PUT | `/api/v0/authz/users/{id}/groups` | — |
| GET | `/api/v0/clients` | — |
| POST | `/api/v0/clients` | — |
| DELETE | `/api/v0/clients/{id}` | — |
| GET | `/api/v0/clients/{id}` | — |
| PUT | `/api/v0/clients/{id}` | — |
| GET | `/api/v0/groups` | — |
| POST | `/api/v0/groups` | — |
| DELETE | `/api/v0/groups/{id}` | — |
| GET | `/api/v0/groups/{id}` | — |
| PATCH | `/api/v0/groups/{id}` | — |
| GET | `/api/v0/groups/{id}/entitlements` | — |
| PATCH | `/api/v0/groups/{id}/entitlements` | — |
| DELETE | `/api/v0/groups/{id}/entitlements/{entitlementId}` | — |
| GET | `/api/v0/groups/{id}/identities` | — |
| PATCH | `/api/v0/groups/{id}/identities` | — |
| DELETE | `/api/v0/groups/{id}/identities/{identityId}` | — |
| GET | `/api/v0/groups/{id}/roles` | — |
| POST | `/api/v0/groups/{id}/roles` | — |
| DELETE | `/api/v0/groups/{id}/roles/{roleId}` | — |
| GET | `/api/v0/identities` | — |
| POST | `/api/v0/identities` | — |
| DELETE | `/api/v0/identities/{id}` | — |
| GET | `/api/v0/identities/{id}` | — |
| PUT | `/api/v0/identities/{id}` | — |
| GET | `/api/v0/idps` | — |
| POST | `/api/v0/idps` | — |
| DELETE | `/api/v0/idps/{id}` | — |
| GET | `/api/v0/idps/{id}` | — |
| PATCH | `/api/v0/idps/{id}` | — |
| GET | `/api/v0/me/tenants` | Public Endpoints |
| GET | `/api/v0/metrics` | — |
| GET | `/api/v0/roles` | — |
| POST | `/api/v0/roles` | — |
| DELETE | `/api/v0/roles/{id}` | — |
| GET | `/api/v0/roles/{id}` | — |
| PATCH | `/api/v0/roles/{id}` | — |
| GET | `/api/v0/roles/{id}/entitlements` | — |
| PATCH | `/api/v0/roles/{id}/entitlements` | — |
| DELETE | `/api/v0/roles/{id}/entitlements/{entitlementId}` | — |
| GET | `/api/v0/roles/{id}/groups` | — |

…and 19 more operations. They are listed in full on the page.

## Machine-readable artifacts (3)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/canonical/refs/heads/main/openapi/canonical-identity-platform-api-openapi.yml
- **Overlay** — https://raw.githubusercontent.com/api-evangelist/canonical/refs/heads/main/overlays/canonical-identity-platform-api-overlay.yaml
- **SourceCode** — https://github.com/canonical/identity-platform-api

## Other Canonical APIs (12)

- [Snap Store API](https://apis.io/apis/canonical/snap-store-api/)
- [Charmhub API](https://apis.io/apis/canonical/charmhub-api/)
- [snapd REST API](https://apis.io/apis/canonical/snapd-rest-api/)
- [MAAS API](https://apis.io/apis/canonical/maas-api/)
- [Juju Client / Controller API](https://apis.io/apis/canonical/juju-api/)
- [Launchpad Web Services API](https://apis.io/apis/canonical/launchpad-api/)
- [Ubuntu Pro Client API](https://apis.io/apis/canonical/ubuntu-pro-api/)
- [Landscape API](https://apis.io/apis/canonical/landscape-api/)
- [Canonical Assertions API](https://apis.io/apis/canonical/canonical-assertions-api/)
- [Canonical Search API](https://apis.io/apis/canonical/canonical-search-api/)
- [Canonical Snaps API](https://apis.io/apis/canonical/canonical-snaps-api/)
- [LXD REST API](https://apis.io/apis/canonical/lxd-rest-api/)

## Tags

Identity, OIDC, Authentication

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/canonical/identity-platform-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/canonical/.