dotCMS

dotCMS Dot Auth API

OAuth/OIDC and SAML authentication: per-site configuration (SYSTEM_HOST is the global default) and headless OIDC token exchange

GitHub OpenAPI

Operations 15

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/v1/dotauth/oauth/exchange Exchange an OIDC ID token for a session-ref · Exchange an OIDC id_token for a dotAuth session-ref #
Ask an LLM
“How do I turn an OIDC id_token into a dotCMS session for a headless app?”
“Will a user be created automatically if they sign in via token exchange for the first time?”
Tell an agent
Exchange ID token {idToken} with nonce {nonce} for a dotAuth session-ref.
Trade id_token {idToken} (nonce {nonce}) for a session-ref valid for {expirationDays} days.
OPTIONS /api/v1/dotauth/oauth/exchange Preflight the token exchange endpoint for CORS · Exchange preflight #
Ask an LLM
“Does the OIDC token exchange endpoint answer CORS preflight requests?”
“Which options does a browser see before calling the dotAuth exchange?”
Tell an agent
Send a CORS preflight OPTIONS request to the token exchange endpoint.
Check the preflight response for the dotAuth OIDC exchange.
GET /api/v1/dotauth/sites/{hostId} Get a site's SSO configuration · Get the dotAuth configuration for a site #
Ask an LLM
“What OAuth or SAML settings are stored for a site?”
“Is a site inheriting its single sign-on setup from the system default?”
Tell an agent
Show the dotAuth SSO configuration for site {hostId}.
Get the global default SSO config stored under {hostId}, with secrets masked.
PUT /api/v1/dotauth/sites/{hostId} Save a site's SSO configuration · Save (upsert) the dotAuth configuration for a site #
Ask an LLM
“How do I configure OAuth or SAML sign-in for a specific site?”
“Does saving SAML settings for a site remove its OAuth settings?”
Tell an agent
Save {protocol} SSO settings {values} for site {hostId}.
Upsert the dotAuth configuration values {values} on host {hostId}.
DELETE /api/v1/dotauth/sites/{hostId} Clear a site's SSO configuration · Clear the dotAuth configuration for a site #
Ask an LLM
“How do I remove single sign-on settings from a site?”
“What happens to a site's SSO after I clear its own configuration?”
Tell an agent destructive · confirm first
Clear the OAuth and SAML configuration for site {hostId}.
Delete dotAuth secrets on host {hostId} so it falls back to the system default.
PUT /api/v1/dotauth/headless Save the headless token-exchange configuration · Save the system-level headless token-exchange configuration #
Ask an LLM
“Where do I configure headless token exchange for the whole system?”
“Is the headless exchange setting per site or system-wide?”
Tell an agent
Save the system-wide headless token-exchange configuration.
Update the headless dotAuth settings on the system host.
DELETE /api/v1/dotauth/headless Clear the headless token-exchange configuration · Clear the system-level headless token-exchange configuration #
Ask an LLM
“How do I turn off headless token exchange?”
“Will clearing the headless config also wipe my SSO settings?”
Tell an agent destructive · confirm first
Delete the headless token-exchange configuration.
Remove system-level headless dotAuth settings, leaving SSO untouched.
POST /api/v1/dotauth/discover/oidc Fetch an OIDC discovery document · Fetch and parse an OIDC discovery document #
Ask an LLM
“Can dotCMS read an identity provider's openid-configuration to fill in issuer and JWKS?”
“How do I pull endpoints and algorithms from an OIDC well-known URL?”
Tell an agent
Fetch and parse the OIDC discovery document at this .well-known URL.
Look up the issuer, endpoints and JWKS from my provider's openid-configuration.
POST /api/v1/dotauth/export Export all dotAuth secrets · Export all dotAuth AppSecrets #
Ask an LLM
“How do I back up my OAuth, SAML and headless sign-in secrets?”
“Can I export dotAuth settings to move them to another environment?”
Tell an agent
Export all dotAuth AppSecrets to an encrypted file.
Create an encrypted export of the OAuth, SAML and headless secrets.
POST /api/v1/dotauth/fetch/saml-metadata Fetch SAML IdP metadata from a URL · Fetch SAML IdP metadata XML from a URL #
Ask an LLM
“Can dotCMS download my identity provider's SAML metadata XML for review?”
“How do I pull IdP metadata from its URL before saving SAML settings?”
Tell an agent
Fetch the SAML IdP metadata XML from this metadata URL.
Retrieve my identity provider's SAML metadata so I can review it.
GET /api/v1/dotauth/saml/metadata/{hostId} Download a site's SAML SP metadata · Download SAML SP metadata XML for a site #
Ask an LLM
“Where do I get the service provider metadata XML to give my SAML IdP?”
“What entity ID and ACS URL does a site advertise for SAML?”
Tell an agent
Download the SAML service provider metadata for site {hostId}.
Generate SP metadata XML for host {hostId}.
POST /api/v1/dotauth/import Import dotAuth secrets · Import dotAuth AppSecrets #
Ask an LLM
“How do I restore dotAuth sign-in settings from an export file?”
“Can I import only OAuth, SAML and headless secrets from an encrypted file?”
Tell an agent
Import dotAuth AppSecrets from this encrypted export file.
Restore OAuth, SAML and headless secrets from my dotAuth export.
GET /api/v1/dotauth/sites List sites with their SSO status · List all sites with their dotAuth status #
Ask an LLM
“Which sites have their own SSO configured and which inherit the default?”
“Are any of my sites left without sign-on configuration?”
Tell an agent
List every site with its dotAuth SSO status.
Show which sites are configured, inherited or unconfigured for SSO.
POST /api/v1/dotauth/sessionrefs/revoke Revoke all session-refs · Revoke all dotAuth sessionRefs #
Ask an LLM
“How do I invalidate every headless session-ref at once?”
“Does flushing session-refs log out existing browser sessions?”
Tell an agent destructive · confirm first
Revoke all dotAuth session-refs.
Flush the dotAuth session-ref cache.
DELETE /api/v1/dotauth/oauth/session Sign out a session-ref · Invalidate the caller's dotAuth session-ref #
Ask an LLM
“How do I end my own headless session-ref on sign-out?”
“Is it safe to call sign-out when the session-ref is already gone?”
Tell an agent destructive · confirm first
Invalidate my current dotAuth session-ref.
Sign me out by removing the session-ref in my bearer header.

Documentation

📖
Documentation
https://dev.dotcms.com/docs/build/apis/api-basics/rest-apis
📖
APIReference
https://dev.dotcms.com/docs/build/apis/rest-apis/api-playground

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/dotcms/refs/heads/main/openapi/dotcms-dotauth-api-openapi.yml

Other Resources

🔗
DeveloperPortal
https://dev.dotcms.com/
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/dotcms/refs/heads/main/errors/dotcms-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/dotcms/refs/heads/main/data-model/dotcms-data-model.yml
🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/dotcms/refs/heads/main/conventions/dotcms-conventions.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/dotcms:dotcms-dotauth-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

dotcms-dotauth-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: dotCMS REST Dot Auth API
  version: '3'
  description: 'OAuth/OIDC and SAML authentication: per-site configuration (SYSTEM_HOST is the global default) and headless OIDC token exchange'
servers:
- url: /
  description: dotCMS Server
tags:
- name: dotAuth
  description: 'OAuth/OIDC and SAML authentication: per-site configuration (SYSTEM_HOST is the global default) and headless OIDC token exchange'
paths:
  /api/v1/dotauth/oauth/exchange:
    post:
      tags:
      - dotAuth
      summary: Exchange an OIDC id_token for a dotAuth session-ref
      description: Validates the caller-supplied id_token against the configured OIDC provider's JWKS (signature, iss, aud == our client_id, exp, nonce), resolves or JIT-provisions the matching dotCMS user, and returns an opaque session-ref bound to that user.
      operationId: exchange
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthExchangeForm'
      responses:
        '200':
          description: Token exchange succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntityOAuthExchangeView'
        '400':
          description: Malformed payload or non-OIDC provider configured
        '401':
          description: id_token failed validation (signature, iss, aud, exp, or nonce)
        '403':
          description: Resolved dotCMS user exists but is not active
        '404':
          description: Exchange endpoint not found
        '503':
          description: OAuth is not configured for this site
    options:
      tags:
      - dotAuth
      operationId: exchangePreflight
      responses:
        default:
          description: default response
          content:
            '*/*': {}
      summary: Exchange preflight
      x-summary-source: derived
  /api/v1/dotauth/sites/{hostId}:
    get:
      tags:
      - dotAuth
      summary: Get the dotAuth configuration for a site
      description: Returns the protocol-specific configuration stored for the given hostId. Use the sentinel "SYSTEM_HOST" for the global default. When the host has no row of its own and the system default is configured, the response carries inherited=true and values holds the system defaults. Hidden secrets (e.g. clientSecret, privateKey) are masked as "****".
      operationId: getDotAuthConfig
      parameters:
      - name: hostId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Configuration retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntityDotAuthConfigView'
        '401':
          description: Authentication required
        '403':
          description: User does not have permission to read this site
        '404':
          description: Site not found
        '500':
          description: Internal server error
    put:
      tags:
      - dotAuth
      summary: Save (upsert) the dotAuth configuration for a site
      description: Writes the chosen protocol's secrets for the given hostId and deletes the other protocol's row for that host (mutual exclusion). Posting "****" on a hidden field preserves the stored value.
      operationId: saveDotAuthConfig
      parameters:
      - name: hostId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DotAuthConfigForm'
      responses:
        '200':
          description: Configuration saved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntityStringView'
        '400':
          description: Invalid form payload
        '401':
          description: Authentication required
        '403':
          description: User does not have permission to edit this site
        '404':
          description: Site not found
        '500':
          description: Internal server error
    delete:
      tags:
      - dotAuth
      summary: Clear the dotAuth configuration for a site
      description: Deletes both OAuth and SAML secret rows for the given hostId. On SYSTEM_HOST this removes the global default; non-system hosts fall back to inheriting from SYSTEM_HOST afterward.
      operationId: clearDotAuthConfig
      parameters:
      - name: hostId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Configuration cleared successfully
        '401':
          description: Authentication required
        '403':
          description: User does not have permission to edit this site
        '404':
          description: Site not found
        '500':
          description: Internal server error
  /api/v1/dotauth/headless:
    put:
      tags:
      - dotAuth
      summary: Save the system-level headless token-exchange configuration
      description: Writes headless config to SYSTEM_HOST. Headless config is system-wide (not per-site). SSO saves/deletes never affect it.
      operationId: saveDotAuthHeadlessConfig
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: object
      responses:
        '200':
          description: Headless config saved
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
        '500':
          description: Internal server error
    delete:
      tags:
      - dotAuth
      summary: Clear the system-level headless token-exchange configuration
      description: Deletes the headless config. SSO config is not affected.
      operationId: clearDotAuthHeadlessConfig
      responses:
        '204':
          description: Headless config cleared
        '401':
          description: Authentication required
        '403':
          description: Insufficient permissions
        '500':
          description: Internal server error
  /api/v1/dotauth/discover/oidc:
    post:
      tags:
      - dotAuth
      summary: Fetch and parse an OIDC discovery document
      description: Thin authenticated proxy used by the dotAuth portlet to populate issuer, endpoint, JWKS, and supported algorithm fields from a .well-known/openid-configuration URL.
      operationId: discoverDotAuthOidc
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: object
      responses:
        '200':
          description: Discovery document parsed successfully
          content:
            application/json:
              schema:
                type: object
                description: 'Parsed OIDC discovery fields: issuer, endpoints, JWKS URI, and signing algorithms'
        '400':
          description: Missing or invalid discovery URL
        '401':
          description: Authentication required
        '500':
          description: Internal server error
  /api/v1/dotauth/export:
    post:
      tags:
      - dotAuth
      summary: Export all dotAuth AppSecrets
      description: Exports OAuth/OIDC, SAML, and headless dotAuth AppSecrets into one encrypted Apps export file.
      operationId: exportDotAuthAppSecrets
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: object
      responses:
        '200':
          description: Encrypted export file
          content:
            application/octet-stream: {}
        '400':
          description: Invalid password or no secrets configured
        '401':
          description: Authentication required
        '403':
          description: Admin access required
        '500':
          description: Internal server error
  /api/v1/dotauth/fetch/saml-metadata:
    post:
      tags:
      - dotAuth
      summary: Fetch SAML IdP metadata XML from a URL
      description: Authenticated proxy that fetches SAML metadata XML from an IdP's metadata endpoint URL. Returns the raw XML as a string so the admin can review it before saving.
      operationId: fetchSamlMetadata
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: object
      responses:
        '200':
          description: Metadata fetched successfully
          content:
            application/json:
              schema:
                type: object
                description: Object with a single 'xml' field containing the raw metadata XML
        '400':
          description: Missing or invalid metadata URL
        '401':
          description: Authentication required
        '500':
          description: Internal server error
  /api/v1/dotauth/saml/metadata/{hostId}:
    get:
      tags:
      - dotAuth
      summary: Download SAML SP metadata XML for a site
      description: Generates SAML Service Provider metadata XML for the given site. For inherited configs the certificate comes from the SYSTEM_HOST row, but the entity ID and ACS URL use the target site's hostname so the IdP can distinguish per-site requests.
      operationId: getSamlSpMetadata
      parameters:
      - name: hostId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: SP metadata XML
          content:
            application/xml: {}
        '401':
          description: Authentication required
        '404':
          description: No SAML configuration found for this site
        '500':
          description: Internal server error
  /api/v1/dotauth/import:
    post:
      tags:
      - dotAuth
      summary: Import dotAuth AppSecrets
      description: Imports an encrypted Apps export file containing only OAuth/OIDC, SAML, and headless dotAuth AppSecrets.
      operationId: importDotAuthAppSecrets
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/FormDataMultiPart'
      responses:
        '200':
          description: Import succeeded
          content:
            application/json:
              schema:
                type: object
                description: Import result with count of imported secrets
        '400':
          description: Invalid password, empty file, or non-dotAuth secrets in file
        '401':
          description: Authentication required
        '403':
          description: Admin access required
        '500':
          description: Internal server error
  /api/v1/dotauth/sites:
    get:
      tags:
      - dotAuth
      summary: List all sites with their dotAuth status
      description: Returns the SYSTEM_HOST (global default) status plus a per-site list indicating whether each site has its own OAuth/SAML configuration, inherits from the system default, or is unconfigured.
      operationId: listDotAuthSites
      responses:
        '200':
          description: Sites retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntityDotAuthSitesView'
        '401':
          description: Authentication required
        '403':
          description: User does not have permission to access dotAuth
        '500':
          description: Internal server error
  /api/v1/dotauth/sessionrefs/revoke:
    post:
      tags:
      - dotAuth
      summary: Revoke all dotAuth sessionRefs
      description: Flushes the dotAuth sessionRef cache. Existing browser sessions are not affected.
      operationId: revokeDotAuthSessionRefs
      responses:
        '200':
          description: All session-refs revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseEntityStringView'
        '401':
          description: Authentication required
        '403':
          description: Admin access required
        '500':
          description: Internal server error
  /api/v1/dotauth/oauth/session:
    delete:
      tags:
      - dotAuth
      summary: Invalidate the caller's dotAuth session-ref
      description: 'Removes the session referenced by the Authorization: Bearer header from the in-memory session cache. Always returns 204 — unknown or missing refs are silently ignored so this is safe to call unconditionally on sign-out.'
      operationId: logout
      responses:
        '204':
          description: Session invalidated (or was unknown)
components:
  schemas:
    ResponseEntityStringView:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorEntity'
        entity:
          type: string
        messages:
          type: array
          items:
            $ref: '#/components/schemas/MessageEntity'
        i18nMessagesMap:
          type: object
          additionalProperties:
            type: string
        permissions:
          type: array
          items:
            type: string
        pagination:
          $ref: '#/components/schemas/Pagination'
    SystemView:
      type: object
      properties:
        configured:
          type: boolean
        protocol:
          type: string
          enum:
          - OAUTH
          - SAML
        headlessConfigured:
          type: boolean
    Pagination:
      type: object
      properties:
        currentPage:
          type: integer
          format: int32
        perPage:
          type: integer
          format: int32
        totalEntries:
          type: integer
          format: int64
    UserSummary:
      type: object
      properties:
        userId:
          type: string
        email:
          type: string
        firstName:
          type: string
        lastName:
          type: string
        fullName:
          type: string
        roles:
          type: array
          items:
            type: string
    MessageBodyWorkers:
      type: object
    FormDataMultiPart:
      type: object
      properties:
        contentDisposition:
          $ref: '#/components/schemas/ContentDisposition'
        entity:
          type: object
        headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        mediaType:
          type: object
          properties:
            type:
              type: string
            subtype:
              type: string
            parameters:
              type: object
              additionalProperties:
                type: string
            wildcardType:
              type: boolean
            wildcardSubtype:
              type: boolean
        messageBodyWorkers:
          $ref: '#/components/schemas/MessageBodyWorkers'
        parent:
          $ref: '#/components/schemas/MultiPart'
        providers:
          type: object
        bodyParts:
          type: array
          items:
            $ref: '#/components/schemas/BodyPart'
        fields:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/FormDataBodyPart'
        parameterizedHeaders:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/ParameterizedHeader'
    ErrorEntity:
      type: object
      properties:
        errorCode:
          type: string
        message:
          type: string
        fieldName:
          type: string
    DotAuthConfigForm:
      required:
      - values
      type: object
      properties:
        protocol:
          type: string
          enum:
          - OAUTH
          - SAML
        values:
          type: object
          additionalProperties:
            type: object
    BodyPart:
      type: object
      properties:
        contentDisposition:
          $ref: '#/components/schemas/ContentDisposition'
        entity:
          type: object
        headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        mediaType:
          type: object
          properties:
            type:
              type: string
            subtype:
              type: string
            parameters:
              type: object
              additionalProperties:
                type: string
            wildcardType:
              type: boolean
            wildcardSubtype:
              type: boolean
        messageBodyWorkers:
          $ref: '#/components/schemas/MessageBodyWorkers'
        parent:
          $ref: '#/components/schemas/MultiPart'
        providers:
          type: object
        parameterizedHeaders:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/ParameterizedHeader'
    OAuthExchangeView:
      type: object
      properties:
        sessionRef:
          type: string
        expiresAt:
          type: string
        expirationDays:
          type: integer
          format: int32
        user:
          $ref: '#/components/schemas/UserSummary'
    ResponseEntityDotAuthSitesView:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorEntity'
        entity:
          $ref: '#/components/schemas/DotAuthSitesView'
        messages:
          type: array
          items:
            $ref: '#/components/schemas/MessageEntity'
        i18nMessagesMap:
          type: object
          additionalProperties:
            type: string
        permissions:
          type: array
          items:
            type: string
        pagination:
          $ref: '#/components/schemas/Pagination'
    FormDataContentDisposition:
      type: object
      properties:
        type:
          type: string
        parameters:
          type: object
          additionalProperties:
            type: string
        fileName:
          type: string
        creationDate:
          type: string
          format: date-time
        modificationDate:
          type: string
          format: date-time
        readDate:
          type: string
          format: date-time
        size:
          type: integer
          format: int64
        name:
          type: string
    ContentDisposition:
      type: object
      properties:
        type:
          type: string
        parameters:
          type: object
          additionalProperties:
            type: string
        fileName:
          type: string
        creationDate:
          type: string
          format: date-time
        modificationDate:
          type: string
          format: date-time
        readDate:
          type: string
          format: date-time
        size:
          type: integer
          format: int64
    ResponseEntityDotAuthConfigView:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorEntity'
        entity:
          $ref: '#/components/schemas/DotAuthConfigView'
        messages:
          type: array
          items:
            $ref: '#/components/schemas/MessageEntity'
        i18nMessagesMap:
          type: object
          additionalProperties:
            type: string
        permissions:
          type: array
          items:
            type: string
        pagination:
          $ref: '#/components/schemas/Pagination'
    MessageEntity:
      type: object
      properties:
        message:
          type: string
    FormDataBodyPart:
      type: object
      properties:
        contentDisposition:
          $ref: '#/components/schemas/ContentDisposition'
        entity:
          type: object
        headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        mediaType:
          type: object
          properties:
            type:
              type: string
            subtype:
              type: string
            parameters:
              type: object
              additionalProperties:
                type: string
            wildcardType:
              type: boolean
            wildcardSubtype:
              type: boolean
        messageBodyWorkers:
          $ref: '#/components/schemas/MessageBodyWorkers'
        parent:
          $ref: '#/components/schemas/MultiPart'
        providers:
          type: object
        formDataContentDisposition:
          $ref: '#/components/schemas/FormDataContentDisposition'
        simple:
          type: boolean
        name:
          type: string
        value:
          type: string
        parameterizedHeaders:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/ParameterizedHeader'
    DotAuthSitesView:
      type: object
      properties:
        system:
          $ref: '#/components/schemas/SystemView'
        sites:
          type: array
          items:
            $ref: '#/components/schemas/SiteRowView'
    ParameterizedHeader:
      type: object
      properties:
        value:
          type: string
        parameters:
          type: object
          additionalProperties:
            type: string
    ResponseEntityOAuthExchangeView:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorEntity'
        entity:
          $ref: '#/components/schemas/OAuthExchangeView'
        messages:
          type: array
          items:
            $ref: '#/components/schemas/MessageEntity'
        i18nMessagesMap:
          type: object
          additionalProperties:
            type: string
        permissions:
          type: array
          items:
            type: string
        pagination:
          $ref: '#/components/schemas/Pagination'
    DotAuthConfigView:
      type: object
      properties:
        hostId:
          type: string
        protocol:
          type: string
          enum:
          - OAUTH
          - SAML
        configured:
          type: boolean
        inherited:
          type: boolean
        values:
          type: object
          additionalProperties:
            type: object
        headlessValues:
          type: object
          additionalProperties:
            type: object
    MultiPart:
      type: object
      properties:
        contentDisposition:
          $ref: '#/components/schemas/ContentDisposition'
        entity:
          type: object
        headers:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        mediaType:
          type: object
          properties:
            type:
              type: string
            subtype:
              type: string
            parameters:
              type: object
              additionalProperties:
                type: string
            wildcardType:
              type: boolean
            wildcardSubtype:
              type: boolean
        messageBodyWorkers:
          $ref: '#/components/schemas/MessageBodyWorkers'
        parent:
          $ref: '#/components/schemas/MultiPart'
        providers:
          type: object
        bodyParts:
          type: array
          items:
            $ref: '#/components/schemas/BodyPart'
        parameterizedHeaders:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/ParameterizedHeader'
    SiteRowView:
      type: object
      properties:
        hostId:
          type: string
        hostName:
          type: string
        status:
          type: string
          enum:
          - SITE_OVERRIDE
          - INHERITED
          - NOT_CONFIGURED
        protocol:
          type: string
          enum:
          - OAUTH
          - SAML
    OAuthExchangeForm:
      required:
      - idToken
      - nonce
      type: object
      properties:
        idToken:
          type: string
        nonce:
          type: string
        expirationDays:
          type: integer
          format: int32