Frontegg Sub-accounts and Hierarchy API

openapi: 3.2.0
info:
  title: Entitlements Agent (PDP) Sub-accounts and Hierarchy API
  description: 'The endpoints in this section pertain to the usage of an Entitlements Agent. When your application or service needs to verify entitlements, it can query the Entitlements Agent directly via HTTP.


    These endpoints can be integrated into any backend framework, enabling you to leverage entitlements for advanced authorization needs.'
  version: '1.0'
tags:
- name: Sub-accounts and Hierarchy
  x-displayName: Sub-accounts and hierarchy
paths:
  /resources/hierarchy/v1:
    servers:
    - url: https://api.frontegg.com/tenants
      description: EU Region
    - url: https://api.us.frontegg.com/tenants
      description: US Region
    - url: https://api.ca.frontegg.com/tenants
      description: CA Region
    - url: https://api.au.frontegg.com/tenants
      description: AU Region
    - url: https://{domain}.frontegg.com/tenants
      description: Frontegg sub-domain for use with user tokens
      variables:
        domain:
          default: app-xxx
    post:
      operationId: TenantHierarchyControllerV1_createSubTenants
      summary: Create Sub-account (tenant)
      description: Assign an existing account (tenant) to the hierarchy as a sub-account of a given parent account. A vendor token is required for this route, it can be obtained from the vendor authentication route.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSubTenantRequestDto'
      responses:
        '400':
          description: When:a) given parameters do not pass validationb) or parent and child account (tenant) are equal:c) or child account (tenant) is already a sub-account in other organization's hierarchy
      tags:
      - Sub-accounts and Hierarchy
      security:
      - bearer: []
    delete:
      operationId: TenantHierarchyControllerV1_deleteSubTenant
      summary: Delete Sub-account (tenant)
      description: Delete given sub-account from the hierarchy. A vendor token is required for this route, it can be obtained from the vendor authentication route.
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteSubTenantRequestDto'
      responses:
        '400':
          description: When provided parameters do not pass validation.
        '404':
          description: When given accounts (tenants) are not in parent-child relation.
      tags:
      - Sub-accounts and Hierarchy
      security:
      - bearer: []
components:
  schemas:
    DeleteSubTenantRequestDto:
      type: object
      properties: {}
    CreateSubTenantRequestDto:
      type: object
      properties:
        parentTenantId:
          type: string
        childTenantId:
          type: string
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
x-tagGroups:
- name: Entitlements Agent (PDP)
  tags:
  - Entitlements Check
- name: Audits Overview
  tags:
  - Main
  - Metrics
- name: Entitlements Overview
  tags:
  - Plans
  - API Access Control
  - API Access Control Configurations
  - Features
  - Entitlements
  - Feature Flags
  - ReBAC
- name: Authentication and Identity Management
  tags:
  - API token
  - API tokens
  - Account invitations
  - Account invitations settings
  - Account roles
  - Approval Flows
  - Core settings
  - Custom social OAuth provider
  - Data migration
  - Delegation
  - Domain restrictions
  - Email configuration
  - Email templates
  - General
  - IP restrictions
  - Lockout policy
  - M2M tokens
  - MFA
  - MFA configuration
  - MFA settings
  - Password settings
  - Passwordless
  - Permissions
  - Permissions categories
  - Personal tokens
  - Roles
  - SMS
  - SMS configuration
  - SMS templates
  - Sessions configuration
  - Sessions management
  - User emails policy
  - User groups
  - User management
  - Users
  - User pools
  - User sessions
  - Users-applications management
- name: SCIM Provisioning Overview
  tags:
  - SCIM settings
  - SCIM configurations
- name: Single Sign-On Overview
  tags:
  - SAML configurations
  - SSO settings
  - SSO configurations
  - OIDC configurations
- name: Account Management Overview
  tags:
  - Accounts
  - tenants_other
  - Sub-accounts
  - Account settings
  - Account migration
  - Sub-accounts and hierarchy