HashiCorp Identity API

openapi: 3.0.2
info:
  title: HashiCorp Vault Auth Identity API
  description: HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.
  version: 1.9.3
  license:
    name: Mozilla Public License 2.0
    url: https://www.mozilla.org/en-US/MPL/2.0
tags:
- name: Identity
paths:
  /identity/alias:
    description: Create a new alias.
    post:
      summary: HashiCorp Create a new alias.
      operationId: postIdentityAlias
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: Entity ID to which this alias belongs to
                entity_id:
                  type: string
                  description: Entity ID to which this alias belongs to. This field is deprecated in favor of 'canonical_id'.
                id:
                  type: string
                  description: ID of the alias
                mount_accessor:
                  type: string
                  description: Mount accessor to which this alias belongs to
                name:
                  type: string
                  description: Name of the alias
      responses:
        '200':
          description: OK
  /identity/alias/id:
    description: List all the alias IDs.
    get:
      summary: HashiCorp List all the alias IDs.
      operationId: getIdentityAliasId
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/alias/id/{id}:
    description: Update, read or delete an alias ID.
    parameters:
    - name: id
      description: ID of the alias
      in: path
      schema:
        type: string
      required: true
    get:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: getIdentityAliasIdId
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: postIdentityAliasIdId
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: Entity ID to which this alias should be tied to
                entity_id:
                  type: string
                  description: Entity ID to which this alias should be tied to. This field is deprecated in favor of 'canonical_id'.
                mount_accessor:
                  type: string
                  description: Mount accessor to which this alias belongs to
                name:
                  type: string
                  description: Name of the alias
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: deleteIdentityAliasIdId
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/entity:
    description: Create a new entity
    post:
      summary: HashiCorp Create a new entity
      operationId: postIdentityEntity
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                disabled:
                  type: boolean
                  description: If set true, tokens tied to this identity will not be able to be used (but will not be revoked).
                id:
                  type: string
                  description: ID of the entity. If set, updates the corresponding existing entity.
                metadata:
                  type: object
                  description: 'Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                name:
                  type: string
                  description: Name of the entity
                policies:
                  type: array
                  description: Policies to be tied to the entity.
                  items:
                    type: string
      responses:
        '200':
          description: OK
  /identity/entity-alias:
    description: Create a new alias.
    post:
      summary: HashiCorp Create a new alias.
      operationId: postIdentityEntityAlias
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: Entity ID to which this alias belongs
                custom_metadata:
                  type: object
                  description: User provided key-value pairs
                  format: kvpairs
                entity_id:
                  type: string
                  description: Entity ID to which this alias belongs. This field is deprecated, use canonical_id.
                id:
                  type: string
                  description: ID of the entity alias. If set, updates the corresponding entity alias.
                mount_accessor:
                  type: string
                  description: Mount accessor to which this alias belongs to; unused for a modify
                name:
                  type: string
                  description: Name of the alias; unused for a modify
      responses:
        '200':
          description: OK
  /identity/entity-alias/id:
    description: List all the alias IDs.
    get:
      summary: HashiCorp List all the alias IDs.
      operationId: getIdentityEntityAliasId
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/entity-alias/id/{id}:
    description: Update, read or delete an alias ID.
    parameters:
    - name: id
      description: ID of the alias
      in: path
      schema:
        type: string
      required: true
    get:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: getIdentityEntityAliasIdId
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: postIdentityEntityAliasIdId
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: Entity ID to which this alias should be tied to
                custom_metadata:
                  type: object
                  description: User provided key-value pairs
                  format: kvpairs
                entity_id:
                  type: string
                  description: Entity ID to which this alias belongs to. This field is deprecated, use canonical_id.
                mount_accessor:
                  type: string
                  description: (Unused)
                name:
                  type: string
                  description: (Unused)
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Update, read or delete an alias ID.
      operationId: deleteIdentityEntityAliasIdId
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/entity/batch-delete:
    description: Delete all of the entities provided
    post:
      summary: HashiCorp Delete all of the entities provided
      operationId: postIdentityEntityBatchDelete
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entity_ids:
                  type: array
                  description: Entity IDs to delete
                  items:
                    type: string
      responses:
        '200':
          description: OK
  /identity/entity/id:
    description: List all the entity IDs
    get:
      summary: HashiCorp List all the entity IDs
      operationId: getIdentityEntityId
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/entity/id/{id}:
    description: Update, read or delete an entity using entity ID
    parameters:
    - name: id
      description: ID of the entity. If set, updates the corresponding existing entity.
      in: path
      schema:
        type: string
      required: true
    get:
      summary: HashiCorp Update, read or delete an entity using entity ID
      operationId: getIdentityEntityIdId
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Update, read or delete an entity using entity ID
      operationId: postIdentityEntityIdId
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                disabled:
                  type: boolean
                  description: If set true, tokens tied to this identity will not be able to be used (but will not be revoked).
                metadata:
                  type: object
                  description: 'Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                name:
                  type: string
                  description: Name of the entity
                policies:
                  type: array
                  description: Policies to be tied to the entity.
                  items:
                    type: string
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Update, read or delete an entity using entity ID
      operationId: deleteIdentityEntityIdId
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/entity/merge:
    description: Merge two or more entities together
    post:
      summary: HashiCorp Merge two or more entities together
      operationId: postIdentityEntityMerge
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                force:
                  type: boolean
                  description: Setting this will follow the 'mine' strategy for merging MFA secrets. If there are secrets of the same type both in entities that are merged from and in entity into which all others are getting merged, secrets in the destination will be unaltered. If not set, this API will throw an error containing all the conflicts.
                from_entity_ids:
                  type: array
                  description: Entity IDs which needs to get merged
                  items:
                    type: string
                to_entity_id:
                  type: string
                  description: Entity ID into which all the other entities need to get merged
      responses:
        '200':
          description: OK
  /identity/entity/name:
    description: List all the entity names
    get:
      summary: HashiCorp List all the entity names
      operationId: getIdentityEntityName
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/entity/name/{name}:
    description: Update, read or delete an entity using entity name
    parameters:
    - name: name
      description: Name of the entity
      in: path
      schema:
        type: string
      required: true
    get:
      summary: HashiCorp Update, read or delete an entity using entity name
      operationId: getIdentityEntityNameName
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Update, read or delete an entity using entity name
      operationId: postIdentityEntityNameName
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                disabled:
                  type: boolean
                  description: If set true, tokens tied to this identity will not be able to be used (but will not be revoked).
                id:
                  type: string
                  description: ID of the entity. If set, updates the corresponding existing entity.
                metadata:
                  type: object
                  description: 'Metadata to be associated with the entity. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                policies:
                  type: array
                  description: Policies to be tied to the entity.
                  items:
                    type: string
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Update, read or delete an entity using entity name
      operationId: deleteIdentityEntityNameName
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/group:
    description: Create a new group.
    post:
      summary: HashiCorp Create a new group.
      operationId: postIdentityGroup
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the group. If set, updates the corresponding existing group.
                member_entity_ids:
                  type: array
                  description: Entity IDs to be assigned as group members.
                  items:
                    type: string
                member_group_ids:
                  type: array
                  description: Group IDs to be assigned as group members.
                  items:
                    type: string
                metadata:
                  type: object
                  description: 'Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                name:
                  type: string
                  description: Name of the group.
                policies:
                  type: array
                  description: Policies to be tied to the group.
                  items:
                    type: string
                type:
                  type: string
                  description: Type of the group, 'internal' or 'external'. Defaults to 'internal'
      responses:
        '200':
          description: OK
  /identity/group-alias:
    description: Creates a new group alias, or updates an existing one.
    post:
      summary: HashiCorp Creates a new group alias, or updates an existing one.
      operationId: postIdentityGroupAlias
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: ID of the group to which this is an alias.
                id:
                  type: string
                  description: ID of the group alias.
                mount_accessor:
                  type: string
                  description: Mount accessor to which this alias belongs to.
                name:
                  type: string
                  description: Alias of the group.
      responses:
        '200':
          description: OK
  /identity/group-alias/id:
    description: List all the group alias IDs.
    get:
      summary: HashiCorp List all the group alias IDs.
      operationId: getIdentityGroupAliasId
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/group-alias/id/{id}:
    parameters:
    - name: id
      description: ID of the group alias.
      in: path
      schema:
        type: string
      required: true
    get:
      operationId: getIdentityGroupAliasIdId
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      operationId: postIdentityGroupAliasIdId
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                canonical_id:
                  type: string
                  description: ID of the group to which this is an alias.
                mount_accessor:
                  type: string
                  description: Mount accessor to which this alias belongs to.
                name:
                  type: string
                  description: Alias of the group.
      responses:
        '200':
          description: OK
    delete:
      operationId: deleteIdentityGroupAliasIdId
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/group/id:
    description: List all the group IDs.
    get:
      summary: HashiCorp List all the group IDs.
      operationId: getIdentityGroupId
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/group/id/{id}:
    description: Update or delete an existing group using its ID.
    parameters:
    - name: id
      description: ID of the group. If set, updates the corresponding existing group.
      in: path
      schema:
        type: string
      required: true
    get:
      summary: HashiCorp Update or delete an existing group using its ID.
      operationId: getIdentityGroupIdId
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp Update or delete an existing group using its ID.
      operationId: postIdentityGroupIdId
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                member_entity_ids:
                  type: array
                  description: Entity IDs to be assigned as group members.
                  items:
                    type: string
                member_group_ids:
                  type: array
                  description: Group IDs to be assigned as group members.
                  items:
                    type: string
                metadata:
                  type: object
                  description: 'Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                name:
                  type: string
                  description: Name of the group.
                policies:
                  type: array
                  description: Policies to be tied to the group.
                  items:
                    type: string
                type:
                  type: string
                  description: Type of the group, 'internal' or 'external'. Defaults to 'internal'
      responses:
        '200':
          description: OK
    delete:
      summary: HashiCorp Update or delete an existing group using its ID.
      operationId: deleteIdentityGroupIdId
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/group/name:
    get:
      operationId: getIdentityGroupName
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/group/name/{name}:
    parameters:
    - name: name
      description: Name of the group.
      in: path
      schema:
        type: string
      required: true
    get:
      operationId: getIdentityGroupNameName
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      operationId: postIdentityGroupNameName
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the group. If set, updates the corresponding existing group.
                member_entity_ids:
                  type: array
                  description: Entity IDs to be assigned as group members.
                  items:
                    type: string
                member_group_ids:
                  type: array
                  description: Group IDs to be assigned as group members.
                  items:
                    type: string
                metadata:
                  type: object
                  description: 'Metadata to be associated with the group. In CLI, this parameter can be repeated multiple times, and it all gets merged together. For example: vault <command> <path> metadata=key1=value1 metadata=key2=value2'
                  format: kvpairs
                policies:
                  type: array
                  description: Policies to be tied to the group.
                  items:
                    type: string
                type:
                  type: string
                  description: Type of the group, 'internal' or 'external'. Defaults to 'internal'
      responses:
        '200':
          description: OK
    delete:
      operationId: deleteIdentityGroupNameName
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/lookup/entity:
    description: Query entities based on various properties.
    post:
      summary: HashiCorp Query entities based on various properties.
      operationId: postIdentityLookupEntity
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                alias_id:
                  type: string
                  description: ID of the alias.
                alias_mount_accessor:
                  type: string
                  description: Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with 'alias_name'.
                alias_name:
                  type: string
                  description: Name of the alias. This should be supplied in conjunction with 'alias_mount_accessor'.
                id:
                  type: string
                  description: ID of the entity.
                name:
                  type: string
                  description: Name of the entity.
      responses:
        '200':
          description: OK
  /identity/lookup/group:
    description: Query groups based on various properties.
    post:
      summary: HashiCorp Query groups based on various properties.
      operationId: postIdentityLookupGroup
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                alias_id:
                  type: string
                  description: ID of the alias.
                alias_mount_accessor:
                  type: string
                  description: Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with 'alias_name'.
                alias_name:
                  type: string
                  description: Name of the alias. This should be supplied in conjunction with 'alias_mount_accessor'.
                id:
                  type: string
                  description: ID of the group.
                name:
                  type: string
                  description: Name of the group.
      responses:
        '200':
          description: OK
  /identity/oidc/.well-known/keys:
    description: Retrieve public keys
    x-vault-unauthenticated: true
    get:
      summary: HashiCorp Retrieve public keys
      operationId: getIdentityOidcWellKnownKeys
      tags:
      - Identity
      responses:
        '200':
          description: OK
  /identity/oidc/.well-known/openid-configuration:
    description: Query OIDC configurations
    x-vault-unauthenticated: true
    get:
      summary: HashiCorp Query OIDC configurations
      operationId: getIdentityOidcWellKnownOpenidConfiguration
      tags:
      - Identity
      responses:
        '200':
          description: OK
  /identity/oidc/assignment:
    description: List OIDC assignments
    get:
      operationId: getIdentityOidcAssignment
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/oidc/assignment/{name}:
    description: CRUD operations for OIDC assignments.
    parameters:
    - name: name
      description: Name of the assignment
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      operationId: getIdentityOidcAssignmentName
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      operationId: postIdentityOidcAssignmentName
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entity_ids:
                  type: array
                  description: Comma separated string or array of identity entity IDs
                  items:
                    type: string
                group_ids:
                  type: array
                  description: Comma separated string or array of identity group IDs
                  items:
                    type: string
      responses:
        '200':
          description: OK
    delete:
      operationId: deleteIdentityOidcAssignmentName
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/oidc/client:
    description: List OIDC clients
    get:
      operationId: getIdentityOidcClient
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/oidc/client/{name}:
    description: CRUD operations for OIDC clients.
    parameters:
    - name: name
      description: Name of the client.
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      operationId: getIdentityOidcClientName
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      operationId: postIdentityOidcClientName
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                access_token_ttl:
                  type: integer
                  description: The time-to-live for access tokens obtained by the client.
                  format: seconds
                  default: 24h
                assignments:
                  type: array
                  description: Comma separated string or array of assignment resources.
                  items:
                    type: string
                id_token_ttl:
                  type: integer
                  description: The time-to-live for ID tokens obtained by the client.
                  format: seconds
                  default: 24h
                key:
                  type: string
                  description: A reference to a named key resource. Cannot be modified after creation.
                redirect_uris:
                  type: array
                  description: Comma separated string or array of redirect URIs used by the client. One of these values must exactly match the redirect_uri parameter value used in each authentication request.
                  items:
                    type: string
              required:
              - key
      responses:
        '200':
          description: OK
    delete:
      operationId: deleteIdentityOidcClientName
      tags:
      - Identity
      responses:
        '204':
          description: empty body
  /identity/oidc/config:
    description: OIDC configuration
    get:
      summary: HashiCorp OIDC configuration
      operationId: getIdentityOidcConfig
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp OIDC configuration
      operationId: postIdentityOidcConfig
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                issuer:
                  type: string
                  description: Issuer URL to be used in the iss claim of the token. If not set, Vault's app_addr will be used.
      responses:
        '200':
          description: OK
  /identity/oidc/introspect:
    description: Verify the authenticity of an OIDC token
    post:
      summary: HashiCorp Verify the authenticity of an OIDC token
      operationId: postIdentityOidcIntrospect
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  description: Optional client_id to verify
                token:
                  type: string
                  description: Token to verify
      responses:
        '200':
          description: OK
  /identity/oidc/key:
    description: List OIDC keys
    get:
      summary: HashiCorp List OIDC keys
      operationId: getIdentityOidcKey
      tags:
      - Identity
      parameters:
      - name: list
        description: Return a list if `true`
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
  /identity/oidc/key/{name}:
    description: CRUD operations for OIDC keys.
    parameters:
    - name: name
      description: Name of the key
      in: path
      schema:
        type: string
      required: true
    x-vault-createSupported: true
    get:
      summary: HashiCorp CRUD operations for OIDC keys.
      operationId: getIdentityOidcKeyName
      tags:
      - Identity
      responses:
        '200':
          description: OK
    post:
      summary: HashiCorp CRUD operations for OIDC keys.
      operationId: postIdentityOidcKeyName
      tags:
      - Identity
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                algorithm:
                  type: string
                  description: Signing algorithm to use. This will default to RS256.
                  default: RS256
                a

# --- truncated at 32 KB (46 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/hashicorp/refs/heads/main/openapi/hashicorp-identity-api-openapi.yml