openapi: 3.0.1
info:
description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
license:
name: CC BY-NC-SA 3.0 US
url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
title: MongoDB Atlas Administration Access Tracking LDAP Configuration API
version: '2.0'
x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, edits, verifies, and removes LDAP configurations. An LDAP configuration defines settings for MongoDB Cloud to connect to your LDAP server over TLS for user authentication and authorization. Your LDAP server must be visible to the internet or connected to your MongoDB Cloud cluster with VPC Peering. Also, your LDAP server must use TLS. You must have the MongoDB Cloud admin user privilege to use these endpoints. Also, to configure user authentication and authorization with LDAPS, your cluster must run MongoDB 3.6 or higher. Groups for which you have configured LDAPS can't create a cluster using a version of MongoDB 3.6 or lower.
name: LDAP Configuration
paths:
/api/atlas/v2/groups/{groupId}/userSecurity:
get:
description: Returns the current LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
operationId: getGroupUserSecurity
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserSecurity'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return LDAP or X.509 Configuration
tags:
- LDAP Configuration
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api ldapConfiguration getUserSecurity --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupUserSecurityApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tGetGroupUserSecurityWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity?pretty=true\""
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/getGroupUserSecurity
x-xgen-operation-id-override: getUserSecurity
patch:
description: 'Edits the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
Updating this configuration triggers a rolling restart of the database.'
operationId: updateGroupUserSecurity
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserSecurity'
description: Updates the LDAP configuration for the specified project.
required: true
responses:
'202':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserSecurity'
x-xgen-version: '2023-01-01'
description: Accepted
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Update LDAP or X.509 Configuration
tags:
- LDAP Configuration
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api ldapConfiguration updateUserSecurity --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupUserSecurityApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tUpdateGroupUserSecurityWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/updateGroupUserSecurity
x-xgen-operation-id-override: updateUserSecurity
/api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping:
delete:
description: Removes the current LDAP Distinguished Name mapping captured in the ``userToDNMapping`` document from the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
operationId: deleteGroupUserSecurityLdapUserToDnMapping
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
responses:
'202':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserSecurity'
x-xgen-version: '2023-01-01'
description: Accepted
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Remove LDAP User to DN Mapping
tags:
- LDAP Configuration
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api ldapConfiguration deleteLdapUserMapping --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupUserSecurityLdapUserToDnMappingApiParams{}\n\thttpResp, err := client.LDAPConfigurationApi.\n\t\tDeleteGroupUserSecurityLdapUserToDnMappingWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/userToDNMapping\""
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/deleteGroupUserSecurityLdapUserToDnMapping
x-xgen-operation-id-override: deleteLdapUserMapping
/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify:
post:
description: Verifies the LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
operationId: verifyGroupUserSecurityLdap
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/LDAPVerifyConnectivityJobRequestParams'
description: The LDAP configuration for the specified project that you want to verify.
required: true
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/LDAPVerifyConnectivityJobRequest'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Verify LDAP Configuration in One Project
tags:
- LDAP Configuration
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api ldapConfiguration verifyUserSecurityLdap --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.VerifyGroupUserSecurityLdapApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tVerifyGroupUserSecurityLdapWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/verifyGroupUserSecurityLdap
x-xgen-method-verb-override:
customMethod: 'True'
x-xgen-operation-id-override: verifyUserSecurityLdap
/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}:
get:
description: Returns the status of one request to verify one LDAP configuration for the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
operationId: getGroupUserSecurityLdapVerify
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: Unique string that identifies the request to verify an Lightweight Directory Access Protocol (LDAP) configuration.
in: path
name: requestId
required: true
schema:
pattern: ^([a-f0-9]{24})$
type: string
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/LDAPVerifyConnectivityJobRequest'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return Status of LDAP Configuration Verification in One Project
tags:
- LDAP Configuration
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api ldapConfiguration getUserSecurityVerify --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupUserSecurityLdapVerifyApiParams{}\n\tsdkResp, httpResp, err := client.LDAPConfigurationApi.\n\t\tGetGroupUserSecurityLdapVerifyWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/ldap/verify/{requestId}?pretty=true\""
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/LDAP-Configuration/operation/getGroupUserSecurityLdapVerify
x-xgen-method-verb-override:
customMethod: false
verb: get
x-xgen-operation-id-override: getUserSecurityVerify
components:
responses:
internalServerError:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 500
errorCode: UNEXPECTED_ERROR
reason: Internal Server Error
schema:
$ref: '#/components/schemas/ApiError'
description: Internal Server Error.
forbidden:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 403
errorCode: CANNOT_CHANGE_GROUP_NAME
reason: Forbidden
schema:
$ref: '#/components/schemas/ApiError'
description: Forbidden.
tooManyRequests:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 429
errorCode: RATE_LIMITED
reason: Too Many Requests
schema:
$ref: '#/components/schemas/ApiError'
description: Too Many Requests.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
Retry-After:
$ref: '#/components/headers/HeaderRetryAfter'
unauthorized:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 401
errorCode: NOT_ORG_GROUP_CREATOR
reason: Unauthorized
schema:
$ref: '#/components/schemas/ApiError'
description: Unauthorized.
badRequest:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint) No provider AWS exists.
error: 400
errorCode: VALIDATION_ERROR
reason: Bad Request
schema:
$ref: '#/components/schemas/ApiError'
description: Bad Request.
notFound:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS
error: 404
errorCode: RESOURCE_NOT_FOUND
reason: Not Found
schema:
$ref: '#/components/schemas/ApiError'
description: Not Found.
schemas:
LDAPSecuritySettings:
description: Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration details that apply to the specified project.
properties:
authenticationEnabled:
description: Flag that indicates whether users can authenticate using an Lightweight Directory Access Protocol (LDAP) host.
type: boolean
authorizationEnabled:
description: Flag that indicates whether users can authorize access to MongoDB Cloud resources using an Lightweight Directory Access Protocol (LDAP) host.
type: boolean
authzQueryTemplate:
default: '{USER}?memberOf?base'
description: Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud runs to obtain the LDAP groups associated with the authenticated user. MongoDB Cloud uses this parameter only for user authorization. Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query according to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
example: '{USER}?memberOf?base'
type: string
bindPassword:
description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
type: string
writeOnly: true
bindUsername:
description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.
example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
externalDocs:
description: RFC 2253
url: https://tools.ietf.org/html/2253
pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
type: string
caCertificate:
description: 'Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `"caCertificate": ""`.'
type: string
hostname:
description: Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.
pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\.){1,10}[a-z]+)?$
type: string
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
port:
default: 636
description: Port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.
format: int32
type: integer
userToDNMapping:
description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
items:
$ref: '#/components/schemas/UserToDNMapping'
type: array
title: LDAP Security Settings
type: object
Link:
properties:
href:
description: Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
example: https://cloud.mongodb.com/api/atlas
type: string
rel:
description: Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
example: self
type: string
type: object
UserToDNMapping:
description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
properties:
ldapQuery:
description: Lightweight Directory Access Protocol (LDAP) query template that inserts the LDAP name that the regular expression matches into an LDAP query Uniform Resource Identifier (URI). The formatting for the query must conform to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
type: string
match:
description: Regular expression that MongoDB Cloud uses to match against the provided Lightweight Directory Access Protocol (LDAP) username. Each parenthesis-enclosed section represents a regular expression capture group that the substitution or `ldapQuery` template uses.
example: (.*)
type: string
substitution:
description: Lightweight Directory Access Protocol (LDAP) Distinguished Name (DN) template that converts the LDAP username that matches regular expression in the *match* parameter into an LDAP Distinguished Name (DN).
example: CN={0},CN=Users,DC=my-atlas-ldap-server,DC=example,DC=com
type: string
required:
- match
title: User to Distinguished Name Mapping
type: object
DBUserTLSX509Settings:
description: Settings to configure TLS Certificates for database users.
properties:
cas:
description: Concatenated list of customer certificate authority (CA) certificates needed to authenticate database users. MongoDB Cloud expects this as a PEM-formatted certificate.
type: string
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
title: Database User TLS Certificate Settings
type: object
ApiError:
properties:
badRequestDetail:
$ref: '#/components/schemas/BadRequestDetail'
detail:
description: Describes the specific conditions or reasons that cause each type of error.
type: string
error:
description: HTTP status code returned with this error.
externalDocs:
url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
format: int32
readOnly: true
type: integer
errorCode:
description: Application error code returned with this error.
readOnly: true
type: string
parameters:
description: Parameters used to give more information about the error.
items:
type: object
readOnly: true
type: array
reason:
description: Application error message returned with this error.
readOnly: true
type: string
required:
- error
- errorCode
type: object
BadRequestDetail:
description: Bad request detail.
properties:
fields:
description: Describes all violations in a client request.
items:
$ref: '#/components/schemas/FieldViolation'
type: array
readOnly: true
type: object
FieldViolation:
properties:
description:
description: A description of why the request element is bad.
type: string
field:
description: A path that leads to a field in the request body.
type: string
required:
- description
- field
type: object
LDAPVerifyConnectivityJobRequestParams:
description: Request information needed to verify an Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration. The response does not return the `bindPassword`.
properties:
authzQueryTemplate:
default: '{USER}?memberOf?base'
description: 'Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud applies to create an LDAP query to return the LDAP groups associated with the authenticated MongoDB user. MongoDB Cloud uses this parameter only for user authorization.
Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query per [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).'
example: '{USER}?memberOf?base'
type: string
writeOnly: true
bindPassword:
description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
type: string
writeOnly: true
bindUsername:
description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP dis
# --- truncated at 32 KB (40 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-ldap-configuration-api-openapi.yml