Frontegg API Tokens API

openapi: 3.2.0
info:
  title: Entitlements Agent (PDP) API Tokens API
  description: 'The endpoints in this section pertain to the usage of an Entitlements Agent. When your application or service needs to verify entitlements, it can query the Entitlements Agent directly via HTTP.


    These endpoints can be integrated into any backend framework, enabling you to leverage entitlements for advanced authorization needs.'
  version: '1.0'
tags:
- name: API Tokens
  x-displayName: API tokens
paths:
  /resources/tenants/access-tokens/v1:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: TenantAccessTokensV1Controller_createTenantAccessToken
      summary: Create Account (tenant) Access Token
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTenantAccessTokenRequest'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantAccessTokenResponse'
      tags:
      - API Tokens
      description: Create an access token for a specific account (tenant).
      security:
      - bearer: []
    get:
      operationId: TenantAccessTokensV1Controller_getTenantAccessTokens
      summary: Get Account (tenant) Access Tokens
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTenantAccessTokensResponse'
      tags:
      - API Tokens
      description: Retrieve all access tokens for a specific account (tenant).
      security:
      - bearer: []
  /resources/tenants/access-tokens/v1/{id}:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    delete:
      operationId: TenantAccessTokensV1Controller_deleteTenantAccessToken
      summary: Delete Account (tenant) Access Token
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      - name: id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: ''
      tags:
      - API Tokens
      description: Delete an account (tenant) access token.
      security:
      - bearer: []
  /resources/tenants/api-tokens/v1:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: TenantApiTokensV1Controller_createTenantApiToken
      summary: Create Client Credentials Token
      description: Do not use. Instead, use v2 of this route.
      deprecated: true
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTenantApiTokenDto'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateTenantApiTokenResponseDto'
      tags:
      - API Tokens
      security:
      - bearer: []
    get:
      operationId: TenantApiTokensV1Controller_getTenantsApiTokens
      summary: Get Client Credentials Tokens
      description: Retrieve all API tokens for a specific account (tenant).
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/GetTenantApiTokensResponse'
      tags:
      - API Tokens
      security:
      - bearer: []
  /resources/tenants/api-tokens/v1/{id}:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    delete:
      operationId: TenantApiTokensV1Controller_deleteTenantApiToken
      summary: Delete Client Credentials Token
      description: Delete an account (tenant) API token.
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      responses:
        '200':
          description: ''
      tags:
      - API Tokens
      security:
      - bearer: []
    patch:
      operationId: TenantApiTokensV1Controller_updateTenantApiToken
      summary: Update Client Credentials Token
      description: Update an account (tenant) API token.
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateApiTokenDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTenantApiTokenResponseDto'
      tags:
      - API Tokens
      security:
      - bearer: []
  /resources/tenants/api-tokens/v2:
    servers:
    - url: https://api.frontegg.com/identity
      description: EU Region
    - url: https://api.us.frontegg.com/identity
      description: US Region
    - url: https://api.ca.frontegg.com/identity
      description: CA Region
    - url: https://api.au.frontegg.com/identity
      description: AU Region
    - url: https://{domain}.frontegg.com/identity
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: TenantApiTokensV2Controller_createTenantApiToken
      summary: Create Client Credentials Token
      description: 'Create an account (tenant) API token.


        You can retrieve roles and permissions via the API.'
      parameters:
      - name: frontegg-tenant-id
        in: header
        description: The account (tenant) ID identifier
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTenantApiTokenDto'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateTenantApiTokenResponseDto'
      tags:
      - API Tokens
      security:
      - bearer: []
components:
  schemas:
    CreateTenantApiTokenResponseDto:
      type: object
      properties:
        clientId:
          type: string
        description:
          type:
          - string
          - 'null'
        tenantId:
          type: string
        secret:
          type: string
        createdByUserId:
          type:
          - string
          - 'null'
        metadata:
          type: object
          description: Extra data that will be encoded as part of the JWT
        createdAt:
          format: date-time
          type: string
        permissionIds:
          description: Array of permission Ids
          type: array
          items:
            type: string
        roleIds:
          description: Array of role Ids
          type: array
          items:
            type: string
        expires:
          format: date-time
          type: string
      required:
      - clientId
      - description
      - tenantId
      - secret
      - createdByUserId
      - metadata
      - createdAt
    CreateTenantAccessTokenRequest:
      type: object
      properties:
        description:
          type: string
        expiresInMinutes:
          type: number
          minimum: 1
          description: Token expiration time in minutes. In case of undefined, the token won't be expired
        roleIds:
          description: Array of role IDs to attach to the token
          type: array
          items:
            type: string
    TenantAccessTokenResponse:
      type: object
      properties:
        id:
          type: string
        description:
          type: string
        createdAt:
          format: date-time
          type: string
        secret:
          type: string
        expires:
          format: date-time
          type: string
        roleIds:
          description: Array of role Ids
          type: array
          items:
            type: string
        createdByUserId:
          type:
          - string
          - 'null'
      required:
      - id
      - createdAt
      - roleIds
      - createdByUserId
    CreateTenantApiTokenDto:
      type: object
      properties:
        metadata:
          type: object
          description: Extra data that will be encoded as part of the JWT
        description:
          type: string
        roleIds:
          description: Array of role Ids. Either this or permissionIds must be provided, but not both.
          type: array
          items:
            type: string
        permissionIds:
          description: Array of permission Ids. Either this or roleIds must be provided, but not both. roleIds will override permissionIds.
          type: array
          items:
            type: string
        expiresInMinutes:
          type: number
          minimum: 1
          description: Token expiration time in minutes. In case of undefined, the token won't be expired
    GetTenantAccessTokensResponse:
      type: object
      properties:
        accessTokens:
          type: array
          items:
            $ref: '#/components/schemas/TenantAccessTokenResponse'
      required:
      - accessTokens
    GetTenantApiTokensResponse:
      type: object
      properties:
        clientId:
          type: string
        description:
          type:
          - string
          - 'null'
        tenantId:
          type: string
        createdByUserId:
          type:
          - string
          - 'null'
        metadata:
          type: object
          description: Extra data that will be encoded as part of the JWT
        createdAt:
          format: date-time
          type: string
        permissionIds:
          description: Array of permission Ids. Either this or roleIds will be present, but not both.
          type: array
          items:
            type: string
        roleIds:
          description: Array of role Ids. Either this or permissionIds will be present, but not both.
          type: array
          items:
            type: string
        expires:
          format: date-time
          type: string
      required:
      - clientId
      - description
      - tenantId
      - createdByUserId
      - metadata
      - createdAt
      - permissionIds
      - roleIds
      - expires
    UpdateApiTokenDto:
      type: object
      properties:
        metadata:
          type: object
          description: Extra data that will be encoded as part of the JWT
        description:
          type: string
        roleIds:
          description: Array of role Ids
          type: array
          items:
            type: string
        permissionIds:
          description: Array of permission Ids
          type: array
          items:
            type: string
    UpdateTenantApiTokenResponseDto:
      type: object
      properties:
        clientId:
          type: string
        description:
          type:
          - string
          - 'null'
        tenantId:
          type: string
        createdByUserId:
          type:
          - string
          - 'null'
        metadata:
          type: object
          description: Extra data that will be encoded as part of the JWT
        createdAt:
          format: date-time
          type: string
        permissionIds:
          description: Array of permission Ids
          type: array
          items:
            type: string
        roleIds:
          description: Array of role Ids
          type: array
          items:
            type: string
        expires:
          format: date-time
          type: string
      required:
      - clientId
      - description
      - tenantId
      - createdByUserId
      - metadata
      - createdAt
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
x-tagGroups:
- name: Entitlements Agent (PDP)
  tags:
  - Entitlements Check
- name: Audits Overview
  tags:
  - Main
  - Metrics
- name: Entitlements Overview
  tags:
  - Plans
  - API Access Control
  - API Access Control Configurations
  - Features
  - Entitlements
  - Feature Flags
  - ReBAC
- name: Authentication and Identity Management
  tags:
  - API token
  - API tokens
  - Account invitations
  - Account invitations settings
  - Account roles
  - Approval Flows
  - Core settings
  - Custom social OAuth provider
  - Data migration
  - Delegation
  - Domain restrictions
  - Email configuration
  - Email templates
  - General
  - IP restrictions
  - Lockout policy
  - M2M tokens
  - MFA
  - MFA configuration
  - MFA settings
  - Password settings
  - Passwordless
  - Permissions
  - Permissions categories
  - Personal tokens
  - Roles
  - SMS
  - SMS configuration
  - SMS templates
  - Sessions configuration
  - Sessions management
  - User emails policy
  - User groups
  - User management
  - Users
  - User pools
  - User sessions
  - Users-applications management
- name: SCIM Provisioning Overview
  tags:
  - SCIM settings
  - SCIM configurations
- name: Single Sign-On Overview
  tags:
  - SAML configurations
  - SSO settings
  - SSO configurations
  - OIDC configurations
- name: Account Management Overview
  tags:
  - Accounts
  - tenants_other
  - Sub-accounts
  - Account settings
  - Account migration
  - Sub-accounts and hierarchy