MongoDB LDAP Configuration API

openapi: 3.2.0
info:
  description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n  --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n  --header \"Content-Type: application/x-www-form-urlencoded\" \\\n  --header \"Accept: application/json\" \\\n  --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
  license:
    name: CC BY-NC-SA 3.0 US
    url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
  termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
  title: MongoDB Atlas Administration Access Tracking LDAP Configuration API
  version: '2.0'
  x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, edits, verifies, and removes LDAP configurations. An LDAP configuration defines settings for MongoDB Cloud to connect to your LDAP server over TLS for user authentication and authorization. Your LDAP server must be visible to the internet or connected to your MongoDB Cloud cluster with VPC Peering. Also, your LDAP server must use TLS. You must have the MongoDB Cloud admin user privilege to use these endpoints. Also, to configure user authentication and authorization with LDAPS, your cluster must run MongoDB 3.6 or higher. Groups for which you have configured LDAPS can't create a cluster using a version of MongoDB 3.6 or lower.
  name: LDAP Configuration
paths:
  /api/atlas/v2/groups/{groupId}/userSecurity:
    get:
      description: Returns the current LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: getGroupUserSecurity
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/UserSecurity'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return LDAP or X.509 Configuration
      tags:
      - LDAP Configuration
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api ldapConfiguration getUserSecurity --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupUserSecurityApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tGetGroupUserSecurityWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/getGroupUserSecurity
      x-xgen-operation-id-override: getUserSecurity
    patch:
      description: 'Edits the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.


        Updating this configuration triggers a rolling restart of the database.'
      operationId: updateGroupUserSecurity
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/UserSecurity'
        description: Updates the LDAP configuration for the specified project.
        required: true
      responses:
        '202':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/UserSecurity'
              x-xgen-version: '2023-01-01'
          description: Accepted
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Update LDAP or X.509 Configuration
      tags:
      - LDAP Configuration
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api ldapConfiguration updateUserSecurity --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupUserSecurityApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tUpdateGroupUserSecurityWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/updateGroupUserSecurity
      x-xgen-operation-id-override: updateUserSecurity
  /api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping:
    delete:
      description: Removes the current LDAP Distinguished Name mapping captured in the ``userToDNMapping`` document from the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: deleteGroupUserSecurityLdapUserToDnMapping
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      responses:
        '202':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/UserSecurity'
              x-xgen-version: '2023-01-01'
          description: Accepted
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Remove LDAP User to DN Mapping
      tags:
      - LDAP Configuration
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api ldapConfiguration deleteLdapUserMapping --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupUserSecurityLdapUserToDnMappingApiParams{}\n\thttpResp, err := client.LDAPConfigurationApi.\n\t\tDeleteGroupUserSecurityLdapUserToDnMappingWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/deleteGroupUserSecurityLdapUserToDnMapping
      x-xgen-operation-id-override: deleteLdapUserMapping
  /api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify:
    post:
      description: Verifies the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: verifyGroupUserSecurityLdap
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/LDAPVerifyConnectivityJobRequestParams'
        description: The LDAP configuration for the specified project that you want to verify.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/LDAPVerifyConnectivityJobRequest'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Verify LDAP Configuration in One Project
      tags:
      - LDAP Configuration
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api ldapConfiguration verifyUserSecurityLdap --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.VerifyGroupUserSecurityLdapApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tVerifyGroupUserSecurityLdapWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/verifyGroupUserSecurityLdap
      x-xgen-method-verb-override:
        customMethod: 'True'
      x-xgen-operation-id-override: verifyUserSecurityLdap
  /api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}:
    get:
      description: Returns the status of one request to verify one LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: getGroupUserSecurityLdapVerify
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      - description: Unique string that identifies the request to verify an Lightweight Directory Access Protocol (LDAP) configuration.
        in: path
        name: requestId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/LDAPVerifyConnectivityJobRequest'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return Status of LDAP Configuration Verification in One Project
      tags:
      - LDAP Configuration
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api ldapConfiguration getUserSecurityVerify --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupUserSecurityLdapVerifyApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tGetGroupUserSecurityLdapVerifyWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/getGroupUserSecurityLdapVerify
      x-xgen-method-verb-override:
        customMethod: false
        verb: get
      x-xgen-operation-id-override: getUserSecurityVerify
components:
  parameters:
    envelope:
      description: Flag that indicates whether Application wraps the response in an `envelope` JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.
      in: query
      name: envelope
      schema:
        default: false
        type: boolean
    groupId:
      description: 'Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.


        **NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.'
      in: path
      name: groupId
      required: true
      schema:
        example: 32b6e34b3d91647abb20e7b8
        pattern: ^([a-f0-9]{24})$
        type: string
    pretty:
      description: Flag that indicates whether the response body should be in the prettyprint format.
      in: query
      name: pretty
      schema:
        default: false
        externalDocs:
          description: Prettyprint
          url: https://en.wikipedia.org/wiki/Prettyprint
        type: boolean
  schemas:
    DBUserTLSX509Settings:
      description: Settings to configure TLS Certificates for database users.
      properties:
        cas:
          description: Concatenated list of customer certificate authority (CA) certificates needed to authenticate database users. MongoDB Cloud expects this as a PEM-formatted certificate.
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
      title: Database User TLS Certificate Settings
      type: object
    ApiError:
      properties:
        badRequestDetail:
          $ref: '#/components/schemas/BadRequestDetail'
        detail:
          description: Describes the specific conditions or reasons that cause each type of error.
          type: string
        error:
          description: HTTP status code returned with this error.
          externalDocs:
            url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
          format: int32
          readOnly: true
          type: integer
        errorCode:
          description: Application error code returned with this error.
          readOnly: true
          type: string
        parameters:
          description: Parameters used to give more information about the error.
          items:
            type: object
          readOnly: true
          type: array
        reason:
          description: Application error message returned with this error.
          readOnly: true
          type: string
      required:
      - error
      - errorCode
      type: object
    Link:
      properties:
        href:
          description: Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: https://cloud.mongodb.com/api/atlas
          type: string
        rel:
          description: Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: self
          type: string
      type: object
    FieldViolation:
      properties:
        description:
          description: A description of why the request element is bad.
          type: string
        field:
          description: A path that leads to a field in the request body.
          type: string
      required:
      - description
      - field
      type: object
    LDAPVerifyConnectivityJobRequestParams:
      description: Request information needed to verify an Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration. The response does not return the `bindPassword`.
      properties:
        authzQueryTemplate:
          default: '{USER}?memberOf?base'
          description: 'Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud applies to create an LDAP query to return the LDAP groups associated with the authenticated MongoDB user. MongoDB Cloud uses this parameter only for user authorization.


            Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query per [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).'
          example: '{USER}?memberOf?base'
          type: string
          writeOnly: true
        bindPassword:
          description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
          type: string
          writeOnly: true
        bindUsername:
          description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.
          example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
          externalDocs:
            description: RFC 2253
            url: https://tools.ietf.org/html/2253
          pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
          type: string
        caCertificate:
          description: 'Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `"caCertificate": ""`.'
          type: string
        hostname:
          description: Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.
          pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\.){1,10}[a-z]+)?$
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        port:
          default: 636
          description: IANA port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.
          format: int32
          type: integer
      required:
      - bindPassword
      - bindUsername
      - hostname
      - port
      type: object
    LDAPSecuritySettings:
      description: Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration details that apply to the specified project.
      properties:
        authenticationEnabled:
          description: Flag that indicates whether users can authenticate using an Lightweight Directory Access Protocol (LDAP) host.
          type: boolean
        authorizationEnabled:
          description: Flag that indicates whether users can authorize access to MongoDB Cloud resources using an Lightweight Directory Access Protocol (LDAP) host.
          type: boolean
        authzQueryTemplate:
          default: '{USER}?memberOf?base'
          description: Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud runs to obtain the LDAP groups associated with the authenticated user. MongoDB Cloud uses this parameter only for user authorization. Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query according to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
          example: '{USER}?memberOf?base'
          type: string
        bindPassword:
          description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
          type: string
          writeOnly: true
        bindUsername:
          description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.
          example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
          externalDocs:
            description: RFC 2253
            url: https://tools.ietf.org/html/2253
          pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
          type: string
        caCertificate:
          description: 'Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `"caCertificate": ""`.'
          type: string
        hostname:
          description: Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.
          pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\.){1,10}[a-z]+)?$
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        port:
          default: 636
          description: Port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.
          format: int32
          type: integer
        userToDNMapping:
          description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
          items:
            $ref: '#/components/schemas/UserToDNMapping'
          type: array
      title: LDAP Security Settings
      type: object
    LDAPVerifyConnectivityJobRequest:
      properties:
        groupId:
          description: Unique 24-hexadecimal digit string that identifies the project associated with this Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration.
          example: 32b6e34b3d91647abb20e7b8
          pattern: ^([a-f0-9]{24})$
          readOnly: true
          type: string
        links:
          description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
          externalDocs:
            description: Web Linking Specification (RFC 5988)
            url: https://datatracker.ietf.org/doc/html/rfc5988
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
          type: array
        request:
          $ref: '#/components/schemas/LDAPVe

# --- truncated at 32 KB (40 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-ldap-configuration-api-openapi.yml