HERE Authentication API v1.1

{"openapi":"3.0.2","info":{"title":"Authentication API v1.1","version":"1.1.x","description":"\nThis specification describes the Authentication v1.1 APIs.\nNOTE: Swagger UI automatically URL encodes parameters when required.\nIf/when the APIs are called elsewhere make sure to URL encode the parameters when required.\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"Use API Lookup for a base URL"}],"tags":[{"name":"Application Management","description":"Application Management APIs enable HERE users to create applications and authorized identities (user/another app) to manage such applications."},{"name":"Application Access Key Management","description":"These APIs enable authorized identities (user/another app) to manage access key credentials for the applications."},{"name":"API Key Management","description":"API Key Management APIs enable identities authorized to manage an application to create and maintain API keys. API Keys can be used to simplify the usage of HLS services by insecure clients."},{"name":"App Code Management","description":"For deprecated Applications, App Codes are available to authorized identities to via read-only APIs. App Codes can be used to access limited HLS services that still support them."},{"name":"Trusted Domain Management","description":"Trusted Domain Management APIs enable authorized identities to manage URIs to register with an appliication"},{"name":"Secret Management","description":"Secret Management APIs enable authorized identities to securely upload and manage third-party credentials for use in the platform."},{"name":"User Account Management","description":"User Account Management APIs"},{"name":"Platform Service Terms","description":"Platform Service Terms APIs"},{"name":"Platform Pricing Terms","description":"Platform Pricing Terms APIs"},{"name":"Manage Identity Providers for a Realm","description":"APIs to manage Identity Providers trusted in a Realm."},{"name":"List Apps for an Identity Provider","description":"List the Apps that have the specified Identity Provider attached."},{"name":"Manage Identity Providers for an App","description":"APIs to manage Identity Providers attached to an App."},{"name":"Manage Device Accounts","description":"APIs to Manage Device Accounts."},{"name":"Manage SAML identity providers","description":"APIs to manage SAML Identity Providers for a Realm."},{"name":"SAML Identity Provider Templates","description":"List of supported SAML Identity Provider templates."},{"name":"Manage mTLS Identity Providers","description":"APIs to manage mTLS Identity Provider Certificate Authorities in a Realm."},{"name":"Support Access","description":"Manage Account Executive support access"}],"components":{"securitySchemes":{"UserOrClientBearerToken":{"type":"http","scheme":"bearer","description":"Bearer Token issued to either User or Client."},"Bearer":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"A HERE access token obtained from one of the supported OAuth 2.0 authorization flows.\nFor more information on how to get a bearer token, see the\n[https://www.here.com/docs/bundle/identity-and-access-management-developer-guide/page/README.html](Identity & Access Management Guide).\n"}},"parameters":{"App":{"in":"path","required":true,"name":"app","schema":{"type":"string"},"description":"HRN identifying the application. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n"},"AccessKey":{"in":"path","required":true,"name":"accessKey","schema":{"type":"string"},"description":"HRN identifying the access key. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n"},"ApiKey":{"in":"path","required":true,"name":"apiKey","schema":{"type":"string"},"description":"HRN with obfuscated apiKeyId. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.\n","example":"hrn:here:account::myrealm:apikey/ygfDVbZc7vJQTRGjC5-YXZbuwWwxFu4FxD5SsWbp-no"},"Secret":{"in":"path","required":true,"name":"secret","schema":{"type":"string"},"description":"HRN for a Secret.\n","example":"hrn:here:account::myrealm:secret/abc-123"},"User":{"in":"path","required":true,"name":"user","schema":{"type":"string"},"description":"HRN identifying the user account"},"Limit":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 100 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":100}},"Limit10":{"in":"query","name":"limit","required":false,"description":"Number of records to return. Default is 10 records. Maximum is 100 records.","schema":{"type":"integer","minimum":0,"maximum":100,"default":10}},"PageToken":{"name":"pageToken","in":"query","required":false,"description":"If there are more records than 'limit' (between 1 and 100), and there are multiple pages of records, 'pageToken' allows for retrieval of individual pages. In order to retrieve subsequent pages, the client should provide the pageToken returned in the result from the previous API call as input to the following API call.\n\nExample: If the result for a call to GET /items returns *{..., \"pageToken\": \"abcdefg\"}*, in order  to retrieve the next page of 'items' the client should call GET /items?pageToken=abcdefg\n","schema":{"type":"string"}},"Action":{"in":"query","required":true,"name":"action","schema":{"type":"string","enum":["read","write","manage","share"]},"description":"Action contained in the permission on which the result set should be filtered"},"ActionParam":{"in":"query","required":false,"name":"action","schema":{"type":"string","enum":["read","write","manage","share"]},"description":"Optionally filters the list of returned applications based on the caller having the provided permission action over the returned applications."},"XCorrelationId":{"in":"header","name":"X-Correlation-ID","schema":{"type":"string"},"required":false,"description":"Correlates HTTP requests between a client and server. If not present in the incoming request, it will be generated. This header and value will be included in all loglines including access logs. It will also be propagated to downstream services and returned in the response.\n"},"XRequestId":{"in":"header","name":"X-Request-ID","schema":{"type":"string"},"required":false,"description":"The unique for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services.\n"},"TrustedDomainUri":{"in":"path","required":true,"name":"trustedDomainUri","schema":{"type":"string"},"description":"URI for a Trusted Domain. A Trusted Domain must conform to the follow validation rules:\n  * entries must include a domain name (e.g. example.com)\n  * no longer than 2048 characters\n  * use correct URI format\n  * IPv4 addresses are permitted (e.g. 192.168.1.1 or 192.168.1.1:1080)\n  * protocol is optional (e.g. https://example.com)\n  * port is optional (e.g. example.com:1080)\n","example":"https://example.com:1080"},"ListParam":{"in":"query","name":"list","required":true,"description":"Comma separated list of Trusted Domain URIs. Maximum of 10. Must be URL-encoded, if reserved characters \":/?#[]@!$&'()*+,;=\" are used. see https://tools.ietf.org/html/rfc3986#section-2.2.","example":"2MZr9AInTFk45NAU8ClIza2Yw7w_AXyUyM4ChvtO7bY","schema":{"type":"string"}},"RealmHrn":{"in":"path","name":"realmHrn","required":true,"schema":{"type":"string"},"description":"Realm is the HRN of the realm.\n"},"RealmHrnOrMe":{"in":"path","name":"realmHrnOrMe","required":true,"description":"HRN of the realm, or \"me\". If \"me\" the \"rlm\" claim from the access token is used.","schema":{"type":"string"}},"Realm":{"in":"path","required":true,"name":"realm","schema":{"type":"string"},"description":"HRN identifying the Realm.  You can also use the shorthand \"me\" to refer to the Realm HRN indicated by your \naccess token context.\n","example":"hrn:here:account::org123456789:realm/org123456789"},"SamlIdentityProviderHrn":{"in":"path","name":"samlIdentityProvider","required":true,"description":"HRN for the specific SAML IdP configuration with a realm","schema":{"type":"string"},"example":"hrn:here:account::myRealm:samlIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"MtlsIdentityProviderHrn":{"in":"path","name":"mtlsIdentityProvider","required":true,"description":"HRN for the specific mTLS IdentityProvider with a realm","schema":{"type":"string"},"example":"hrn:here:account::myRealm:mtlsIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"MtlsAuthenticatorHrn":{"in":"path","name":"mtlsAuthenticator","required":true,"description":"HRN for the specific mTLS Authenticator","schema":{"type":"string"},"example":"hrn:here:account::myRealm:mtlsAuthenticator/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"RealmQuery":{"in":"query","required":false,"name":"realm","schema":{"type":"string"},"description":"HRN identifying the Realm.  If neither `identityProvider` nor `realm` is specified, defaults to the realm \nidentified in your access token context.\n","example":"hrn:here:account::org123456789:realm/org123456789"},"Project":{"in":"path","required":true,"name":"project","schema":{"type":"string"},"description":"HRN identifying the Project.\n","example":"hrn:here:authorization::org123456789:project/proj-123456"},"IdentityProvider":{"in":"path","required":true,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"IdentityProviderQuery":{"in":"query","required":false,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.  Ignored if `externalId` is not specified in the request.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"Issuer":{"in":"path","required":true,"name":"issuer","schema":{"type":"string"},"description":"OIDC Issuer URL.\n","example":"https://op.example.com"},"ExternalId":{"in":"query","required":false,"name":"externalId","schema":{"type":"string"},"description":"External identifier for the Device under a third-party Identity Provider.  \nIf OpenID Connect Token Exchange was used to create this Device identity, the \nExternalId matches the value of the \"sub\" claim in the OP's access tokens.  \nExternal IDs are considered unique for a given an Identity Provider.  \nIgnored if `identityProvider` is not specified in the request.\n","example":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ="},"RequiredIdentityProvider":{"in":"query","required":true,"name":"identityProvider","schema":{"type":"string"},"description":"HRN identifying the IdentityProvider.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"RequiredExternalId":{"in":"query","required":true,"name":"externalId","schema":{"type":"string"},"description":"External identifier for the Device under a third-party Identity Provider.  \nIf OpenID Connect Token Exchange was used to create this Device identity, the \nExternalId matches the value of the \"sub\" claim in the OP's access tokens.  \nExternal IDs are considered unique for a given an Identity Provider.\n","example":"vtWk4eNAlYLi2UHJGNONTAM5Q7WV4nxHTZGiyfgpFbQ="},"Device":{"in":"path","required":true,"name":"device","schema":{"type":"string"},"description":"HRN of the Device.\n","example":"hrn:here:account::org123456789:identityProvider/example-op"},"SupportEmail":{"in":"query","required":false,"name":"emailAddress","schema":{"type":"string"},"description":"Email address of the authorizedUser entry to delete.  If omitted, all authorizedUser entries **and** the entire\nauthorizedUsers list itself will be deleted.  The authorizedUsers list will not appear in subsequent GET calls\nuntil a new authorizedUser entry is added back.\n"},"AllowPasswordLogin":{"in":"query","required":false,"name":"allowPasswordLogin","schema":{"type":"boolean"},"description":"Flag indicating if password login should be allowed after enabling identity provider for the realm. \nIf omitted, the value is defaulted to false.\n\ntrue - both 'password' and 'saml' login methods are allowed\nfalse - 'saml' is the only allowed login method for the realm\n"}},"headers":{"XCorrelationId":{"schema":{"type":"string"},"required":false,"description":"The X-Correlation-ID for the request, used to track this request in the platform. X-Correlation-ID value is propagated throughout the platform."},"XRequestId":{"schema":{"type":"string"},"required":false,"description":"The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services."},"WWWAuthenticate":{"schema":{"type":"string"},"required":true,"description":"Must be included If the protected resource request does not include authentication credentials or does not contain an access token that enables access to the protected resource. The value must have at least one challenge and must be followed by a comma separated list having one or more authentication param values. In case of OAuth2.0, the challenge must use the auth-scheme value \"Bearer\"."}},"schemas":{"CreateAppRequest":{"type":"object","required":["name"],"properties":{"clientId":{"$ref":"#/components/schemas/ClientId"},"name":{"$ref":"#/components/schemas/Name"},"description":{"$ref":"#/components/schemas/Description"},"redirectUris":{"$ref":"#/components/schemas/RedirectUris"},"allowedScopes":{"$ref":"#/components/schemas/AllowedScopes"},"tokenEndpointAuthMethod":{"$ref":"#/components/schemas/TokenEndpointAuthMethod"},"tokenEndpointAuthMethodReason":{"$ref":"#/components/schemas/TokenEndpointAuthMethodReason"},"dobRequired":{"$ref":"#/components/schemas/DobRequired"},"tokenDuration":{"$ref":"#/components/schemas/TokenDuration"},"responseTypes":{"$ref":"#/components/schemas/ResponseTypes"},"referrers":{"$ref":"#/components/schemas/Referrers"},"allowedRealmTypes":{"$ref":"#/components/schemas/AllowedRealmTypes"},"deviceTokenCreationEnabled":{"$ref":"#/components/schemas/DeviceTokenCreationEnabled"},"deviceApiCallRateLimitPer15Minutes":{"$ref":"#/components/schemas/DeviceApiCallRateLimitPer15Minutes"}}},"DeviceApiCallRateLimitPer15Minutes":{"type":"integer","minimum":1,"maximum":1000,"example":10,"description":"The rate limit per 15 minutes for linked anonymous devices. Property deviceTokenCreationEnabled needs to be true and a value needs to be set for property deviceApiCallRateLimitPer15Minutes to enable this rate limit. Otherwise the rate limit defaults to the client level rate limit."},"DeviceTokenCreationEnabled":{"type":"boolean","example":false,"description":"If the application allows token creation for linked anonymous devices."},"AppCreationEnabled":{"type":"boolean","example":true,"description":"If the application is allowed to create an App."},"App":{"type":"object","allOf":[{"$ref":"#/components/schemas/CreateAppRequest"},{"type":"object","properties":{"appCreationEnabled":{"$ref":"#/components/schemas/AppCreationEnabled"},"platformTier":{"$ref":"#/components/schemas/PlatformTier"},"hrn":{"$ref":"#/components/schemas/HRN"},"status":{"$ref":"#/components/schemas/Status"},"appCodeEnabled":{"$ref":"#/components/schemas/AppCodeEnabled"},"appCodeVisible":{"$ref":"#/components/schemas/AppCodeVisible"},"applicationType":{"$ref":"#/components/schemas/ApplicationType"},"createdTime":{"$ref":"#/components/schemas/CreatedTime"},"realm":{"$ref":"#/components/schemas/Realm"},"rateLimitTier":{"$ref":"#/components/schemas/RateLimitTier"}}}]},"PatchAppRequest":{"type":"object","allOf":[{"$ref":"#/components/schemas/CreateAppRequest"},{"type":"object","properties":{"clientId":{"type":"string","readOnly":true}}}]},"PageWithToken":{"type":"object","required":["limit","total","items"],"properties":{"limit":{"type":"integer","example":1,"description":"number of entries in the response."},"pageToken":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW","description":"The cursor for pagination. Present only if there is an additional page of data to view."},"total":{"type":"integer","example":1,"description":"The number of federations matching the search criteria."}}},"AppPageWithToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AppInfo"},"description":"List of apps."}}}]},"CreateAccessKeyResponse":{"type":"object","properties":{"accessKeyId":{"type":"string","example":"846ee567-7806-403a-97b6-6cf0b6ffa897"},"accessKeyHrn":{"type":"string","example":"hrn:here:account::myrealm:accesskey/846ee567-7806-403a-97b6-6cf0b6ffa897"},"accessKeySecret":{"type":"string","example":"KuMvTQrdHVVKuMDDdcIvTQrdci1FWdcIHVVci1FW"},"clientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","readOnly":true},"clientHrn":{"type":"string","example":"hrn:here:account::myrealm:app/uIkGzYShLKtQQAimXzvV"},"tokenEndpointUrl":{"type":"string","example":"https://account.api.here.com/oauth2/token"},"enabled":{"type":"boolean","example":true},"createdTime":{"type":"integer","format":"int64","example":1545041748000}}},"AccessKey":{"type":"object","properties":{"accessKeyId":{"type":"string","example":"846ee567-7806-403a-97b6-6cf0b6ffa897","readOnly":true},"accessKeyHrn":{"type":"string","example":"hrn:here:account::myrealm:accesskey/846ee567-7806-403a-97b6-6cf0b6ffa897","readOnly":true},"clientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","readOnly":true},"clientHrn":{"type":"string","example":"hrn:here:account::myrealm:app/uIkGzYShLKtQQAimXzvV","readOnly":true},"enabled":{"type":"boolean","example":true},"createdTime":{"type":"integer","format":"int64","example":1545041748000,"readOnly":true},"lastTimeUsed":{"type":"integer","format":"int64","description":"The timestamp that this Access Key was last used within one minute precision.","example":1545041748000,"readOnly":true}}},"AccessKeyPageWithToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/AccessKey"},"description":"List of access keys."}}}]},"ClientId":{"type":"string","example":"uIkGzYShLKtQQAimXzvV","description":"Identifier for the client/application. If provided, identifier should be present and active in Druid."},"Name":{"type":"string","example":"My Application","description":"Human readable name of the client.  This field is required unless a clientId is provided."},"Description":{"type":"string","example":"This is a description of my application.","description":"Prose description of the client"},"RedirectUris":{"type":"array","items":{"type":"string","format":"uri"},"example":["https://www.example.com","https://qa.example.com"],"description":"List of redirect Uris. should be fully qualified HTTPS URIs without any fragments (HTTP is only supported for localhost development). At least one Redirect URI should be registered if the response types is non-empty.\nRedirect URI as defined in OAuth2 specification: [https://tools.ietf.org/html/rfc6749#section-3.1.2](https://tools.ietf.org/html/rfc6749#section-3.1.2)"},"AllowedScopes":{"type":"array","items":{"type":"string","enum":["openid","email","profile","phone"]},"example":["email","profile"],"description":"List of Strings representing the scopes. This field is required when the response types is non-empty. For more details [see here](http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims)."},"TokenEndpointAuthMethod":{"type":"string","enum":["client_secret_basic","client_secret_post","client_secret_jwt"],"example":"client_secret_jwt","description":"The default value will be \"client_secret_jwt\" if the field is not included in the request body.Please check [here](http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) for further details."},"TokenEndpointAuthMethodReason":{"type":"string","minLength":20,"example":"Here's the reason why client_secret_jwt was not used.","description":"This needs to be included only if  \"tokenEndpointAuthMethod\" is not equal to client_secret_jwt. The reason for choosing a less secure tokenEndpoint auth method needs to be provided here. Minimum 20 characters required."},"DobRequired":{"type":"boolean","example":false,"description":"Flag indicating whether or not application users are required to provide their date of birth.\n\ntrue - the user must supply their DOB\nfalse - the user can use self-service and indicate \"yes I am over age X\"\n\nCollection of users date of birth is required for compliance with Article 8 of the General Data Protection Regulation. For more details [see here](https://gdpr-info.eu/art-8-gdpr/)"},"TokenDuration":{"type":"integer","example":3600,"description":"default duration in seconds for the token issued to this application. It has be a non-zero value, less than or equal to 24 hours (86400) or the max allowed for the realm via the realm setting."},"Status":{"type":"string","enum":["active","expired","blacklisted","deactivated"],"example":"active","description":"Status of the application.","readOnly":true},"AppCodeEnabled":{"type":"boolean","example":true,"description":"Identifies if app codes are enabled.","readOnly":true},"AppCodeVisible":{"type":"boolean","example":true,"description":"Identifies if app code is available via the /apps/{app}/appCode API.","readOnly":true},"ApplicationType":{"type":"string","enum":["application","service"],"example":"application","description":"Whether it's an application or a trusted back-end service.","readOnly":true},"CreatedTime":{"type":"integer","format":"int64","example":1432216394712,"description":"Timestamp (milliseconds since the Unix epoch) of when the app was created.","readOnly":true},"Realm":{"type":"string","example":"HERE","description":"Realm the application belongs to.","readOnly":true},"ResponseTypes":{"type":"array","items":{"type":"string","enum":["code","token","id_token"]},"example":["code"],"description":"Valid value is \"code\". If the responseTypes value is \"id_token\" or [\"token\", \"id_token\"], then the allowedScopes value must contain \"openid\". For more details see [here](http://openid.net/specs/openid-connect-core-1_0.html#Authentication) and [here](https://tools.ietf.org/html/rfc6749#section-3.1.1)."},"RateLimitTier":{"type":"string","example":"olp_tier_50k","description":"Rate limit tier to configure application for. If no rate limit tier is specified, created application will be configured with 'global' rate limit tier.","readOnly":true},"PlatformTier":{"type":"integer","example":1,"description":"The platform rate limit tier assigned to this realm.  Must be an integer > 0.  All identities in the realm are associated with this\ntier unless otherwise individually overridden.  This tier applies to calls against all Platform APIs excluding HERE Account APIs.\nThe rate limiting rules for each tier are dynamically configured.\n"},"HRN":{"type":"string","example":"hrn:here:account::HERE:app/uIkGzYShLKtQQAimXzvV","description":"HRN of the application.","readOnly":true},"Referrers":{"type":"array","items":{"type":"string","minLength":1,"maxLength":255,"example":"api.here.com/api"},"maxItems":20,"example":["localhost","127.0.0.1","www.example.com/hello/world/"],"description":"List Referrer URLs to register/registered with Application\n  * On create/update: if the parameter is not present, the current value(s) are unchanged. If empty list specified, current value(s) will be reset to empty list.\n  * Value has a min length of 1 char and max of 255 chars.\n  * Wildcards are NOT allowed. The only valid characters`:` alphanumerics, '-', '_', '.', '/'\n  * The protocol is NOT specified, i.e. no http:// or https://\n  * Some examples`:` here.com, localhost, 127.0.0.1, www.example.com/hello/world/\n  * A port may be specified. Ex. localhost:1234\n  * Maximum of 20 Referrer URLs are allowed per application.\n"},"AllowedRealmTypes":{"type":"array","items":{"type":"string","enum":["olp","auto","consumer","all"]},"example":["olp"],"description":"List of realmTypes from which this client is allowed to request user access tokens when using either the OAuth2 or OpenID protocols.\n"},"DefaultScope":{"type":"string","description":"The default requested scope for the given application.","example":"hrn:here:authorization::myrealm:project/my-project-0000"},"IsRestrictedScope":{"type":"boolean","example":true,"default":false,"description":"Boolean value indicating whether or not the given application should be restricted\nfrom requesting a client token with a different scope from the default value.\nAccess tokens with NO scope are allowed with this value set to true unless\nthe 'alwaysProjectScope' setting is also true.  This value has no effect on the scope\nof API Keys which are assigned no scope unless 'alwaysProjectScope' is set to true.\n"},"AlwaysProjectScope":{"type":"boolean","example":true,"default":false,"description":"Indicates whether or not the given application is locked to the default scope.\nWhen this value is set to true, both API Keys and Access Tokens for this app are\nalways assigned the default project.  In addition, the given application cannot\nbe added to any additional projects or groups.  Any attempt to get an unscoped access token\nfor the given application will fail.  Any API Keys associated with the given\napplication are assigned the default scope.\n"},"ErrorDetail":{"type":"object","properties":{"title":{"type":"string","description":"Error message","example":"Invalid size value"},"source":{"type":"string","description":"Reference to JSON path","example":"$.data.attributes[0].size"},"message":{"type":"string","description":"Detailed error message","example":"Size must be between 3 and 64"},"messageTemplate":{"type":"string","description":"Optional error template","example":"validation.constraint.between"},"messagePlaceholders":{"type":"object","additionalProperties":{},"example":{"field":"size","min":3,"max":64}}}},"IdpTemplateResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/IdentityProviderTemplate"},"description":"List of IDP templates."}}}]},"IdentityProviderTemplate":{"type":"object","properties":{"id":{"type":"string","description":"Identity provider template id","example":"okta"},"name":{"type":"string","description":"Name of the identity provider template.","example":"okta"}}},"SamlIdpConfigValidateOnlyResponse":{"type":"object","properties":{"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"IdP entity Id.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"The login url for IdP","example":"https://here.example.com/sso/saml"}}},"SamlIdpConfigResponse":{"type":"object","properties":{"samlIdentityProviderHrn":{"type":"string","description":"HRN of the IdP","example":"hrn:here:account::myRealm:samlIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"IdP entity Id.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"The login url for IdP","example":"https://here.example.com/sso/saml"},"created":{"type":"string","format":"date-time","example":"2023-01-21T17:32:28Z"},"enabled":{"type":"boolean","description":"Whether the IdP config is enabled or not","example":true},"callback":{"type":"string","description":"Service provider's callback url.","example":"https://account.here.com/saml/callback"},"spMetadataUrl":{"type":"string","description":"Url to get service provider metadata.xml file content.","example":"https://account.here.com/identityProvider/aHJuOmhlcmU6YWNjb3VudDo6bXlSZWFs/metadata"},"spCertificateUrl":{"type":"string","description":"Url to get service provider public key certificate.","example":"https://account.here.com/identityProvider/aHJuOmhlcmU6YWNjb3VudDo6bXlSZWFs/cert"}}},"SamlIdpConfigResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/SamlIdpConfigResponse"},"description":"List of IdP configurations."}}}]},"SamlIdpUpdateRequest":{"type":"object","properties":{"name":{"type":"string","description":"Idp's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"entityId":{"type":"string","description":"Issuer Id provided for the IDP","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"Login url for the IDP","example":"https://here.example.com/sso/saml"},"metadataSource":{"type":"string","description":"Path to the IdP metadata file (file path or URL).","example":"File"},"metadataContent":{"type":"string","description":"Base-64 encrypted metadata xml content.","example":"PG1kOkVudGl0eURlc2NyaXB0b3IKCXhtbG5zOm1kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLj=="}}},"SamlIdpConfigRequest":{"type":"object","required":["name","identityProviderTemplateId","metadataContent"],"properties":{"name":{"type":"string","description":"IdP's display name.","example":"Okta Login!"},"identityProviderTemplateId":{"type":"string","description":"Identity provider (okta/entra/generic).","example":"okta"},"metadataContent":{"type":"string","description":"Base-64 encoded metadata xml content.","example":"PG1kOkVudGl0eURlc2NyaXB0b3IKCXhtbG5zOm1kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLj=="},"metadataSource":{"type":"string","description":"Path to the IdP metadata file (file path or URL).","example":"/root/meta.xml"},"entityId":{"type":"string","description":"Issuer Id provided for the IdP. This will be extracted from the metadata if not provided.","example":"https://www.example.com/mySso"},"ssoLoginUrl":{"type":"string","description":"Login url for the IdP. This will be extracted from the metadata if not provided.","example":"https://here.example.com/sso/saml"}}},"MtlsCARequest":{"type":"object","required":["name","certificateChainPemContent"],"properties":{"name":{"type":"string","description":"IdP's display name.","example":"My Certificate Authority"},"certificateChainPemContent":{"type":"string","description":"PEM encoded certificate chain","example":"-----BEGIN CERTIFICATE-----\\nMIIF7TCCBNWgAwIBAgIQJ1J...\\n-----END CERTIFICATE-----"}}},"MtlsCAResponse":{"type":"object","required":["hrn","name","certificates"],"properties":{"hrn":{"type":"string","description":"HRN of the mTLS Identity Provider","example":"hrn:here:account::myRealm:mtlsIdentityProvider/IDP-4451d8ed-42cd-4de1-ac16-3fa1ed7f393d"},"name":{"type":"string","description":"IdP's display name.","example":"My Certificate Authority"},"certificates":{"type":"array","description":"Details about each certificate in the chain","items":{"type":"object","properties":{"subject":{"type":"string","description":"The subject field of the certificate","example":"C=DE, O=Company Name, CN=Company Intermediate CA v1"},"fingerprint":{"type":"string","description":"The SHA-1 encoded fingerprint the certificate","example":123456789},"serialNumber":{"type":"string","description":"The serial number of the certificate","example":"43:40:44:51:3a:80:2a:a1:9c:97:a2:d0:41:47:74:5a:e1:b0:48:48"}}}}}},"MtlsCAResponseWithPageToken":{"type":"object","allOf":[{"$ref":"#/components/schemas/PageWithToken"},{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/MtlsCAResponse"},"description":"List of mTLS Certificate Authorities"}}}]},"AddIdentityProviderRequest":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"Unique identifier the Identity Provider within a Realm","example":"widgets-op"},"name":{"type":"string","description":"User-friendly name for the Identity Provider","example":"Widgets Provider"},"description":{"type":"string","description":"Detailed text description of the Identity Provider","example":"The Widgets Provider is us

# --- truncated at 32 KB (214 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/here/refs/heads/main/openapi/here-authentication-v1-1-openapi.yml