OutSystems Application Roles API

openapi: 3.2.0
info:
  title: User and Access Management Application Roles API
  description: REST endpoints for retrieving and managing user and access in your organization.
  version: v1
servers:
- url: https://ODC_PORTAL_DOMAIN/api/identity/v1
  description: Replace ODC_PORTAL_DOMAIN with the domain of your organization.
- url: https://{odc-portal-domain}/api/identity/v1
  description: User and Access Management API
  variables:
    odc-portal-domain:
      default: ODC_PORTAL_DOMAIN
      description: The domain of your organization
security:
- bearerAuth: []
tags:
- name: application-roles
paths:
  /application-roles:
    get:
      tags:
      - application-roles
      summary: Returns a list of application roles.
      description: 'Returns a list of application roles that match the specified filters. Use query parameters to refine the search.


        API Client needs the **User management > View end users** permission.'
      operationId: ApplicationRole_QueryApplicationRoles
      parameters:
      - name: key
        in: query
        description: The application role key.
        schema:
          type: string
          format: uuid
      - name: assetKey
        in: query
        description: The asset key that the application role belongs to.
        schema:
          type: string
          format: uuid
      - name: environmentKey
        in: query
        description: Filters application roles by environment key (stage). Mutually exclusive with `environmentKeys`.
        schema:
          type: string
          format: uuid
      - name: environmentKeys
        in: query
        description: Filters application roles by environment keys (stages). Comma-separated list of environment keys. Mutually exclusive with `environmentKey`.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: portfolioKeys
        in: query
        description: Only returns application roles in environments belonging to the specified portfolios.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: nameContains
        in: query
        description: Filters application roles by name.
        schema:
          type: string
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". Default: name. Allowed: name, environmentKey or assetKey.'
        schema:
          type: string
      - name: limit
        in: query
        description: 'Maximum number of results returned. Allowed values: 1 to 100 Default value: 100.'
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: 'Offset of the first result returned. Default value: 0.'
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationRoleApiResponsePaginatedResponseApi'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > View end users** permission.
  /application-roles/{key}/users:
    get:
      tags:
      - application-roles
      summary: Returns the list of users for the specific application role.
      description: 'Returns a list of users that match the specified filters. Use query parameters to refine the search.


        API Client needs the **User management > View end users** permission.'
      operationId: ApplicationRole_QueryUsersByApplicationRole
      parameters:
      - name: key
        in: path
        description: Application role key.
        required: true
        schema:
          type: string
          format: uuid
      - name: userKey
        in: query
        description: User's key to search.
        schema:
          type: string
          format: uuid
      - name: nameOrEmailContains
        in: query
        description: "Filters users by name or email address. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: nameOrEmailOrUsernameContains
        in: query
        description: "Filters users by name or email address or username.. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: lastLoginAtSince
        in: query
        description: Only returns users whose last login occurred on or after the specified date and time.
        schema:
          type: string
          format: date-time
      - name: lastLoginAtTo
        in: query
        description: Only returns users whose last login occurred before or on the specified date and time.
        schema:
          type: string
          format: date-time
      - name: limit
        in: query
        description: 'Maximum number of results returned. Allowed values: 1 to 100 Default value: 100.'
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: 'Offset of the first result returned. Default value: 0.'
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". Default: name. Allowed: userKey, name, email, status, lastLoginAt.'
        schema:
          type: string
      - name: embed
        in: query
        description: List of fields to embed in the response.
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserProfileEmbedType'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleUserResponsePaginatedResponseApi'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > View end users** permission.
components:
  schemas:
    UserProfileEmbedType:
      enum:
      - ApplicationRoles
      - UserIdentityProviders
      type: string
    UserProfileEmbeddedResponse:
      type: object
      properties:
        applicationRoles:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationRoleApiResponse'
          description: List of application roles.
        userIdentityProviders:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/UserIdpProfileResponse'
          description: List of user identity providers.
      additionalProperties: false
    UserProfileStatus:
      enum:
      - Active
      - Invited
      - Inactive
      - PendingRegistration
      type: string
    ApplicationRoleApiResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationRoleApiResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    UserIdpProfileResponse:
      type: object
      properties:
        userKey:
          type: string
          description: The user key.
          format: uuid
        identityProviderKey:
          type: string
          description: 'The identity provider key (format: guid).'
          format: uuid
        subject:
          type:
          - string
          - 'null'
          description: The subject claims in the token issued by the IdP.
        username:
          type:
          - string
          - 'null'
          description: The username.
        name:
          type:
          - string
          - 'null'
          description: The user's full name.
        email:
          type:
          - string
          - 'null'
          description: The user's email address.
        photoUrl:
          type:
          - string
          - 'null'
          description: The user's photo URL.
        firstLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the first login for this user using the idp in UTC.
          format: date-time
        lastLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the last login for this user using the idp in UTC.
          format: date-time
        isEmailVerified:
          type:
          - boolean
          - 'null'
          description: The value indicating whether or not the user's email is verified.
      additionalProperties: false
    ProblemDetails:
      type: object
      properties:
        type:
          type:
          - string
          - 'null'
          description: A URI reference that identifies the problem type.
        title:
          type:
          - string
          - 'null'
          description: A short, human-readable summary of the problem.
        status:
          type:
          - integer
          - 'null'
          description: The HTTP status code applicable to the problem.
          format: int32
        detail:
          type:
          - string
          - 'null'
          description: A human-readable explanation of the error.
        instance:
          type:
          - string
          - 'null'
          description: A URI that identifies the specific occurrence of the problem.
        traceId:
          type: string
          description: This field helps OutSystems support track and investigate specific error occurrences. Providing this identifier when reporting an issue allows for more precise and faster troubleshooting.
        errorCode:
          type: string
          description: This error code serves the purpose to communicate with OutSystems Support and help diagnose errors.
      description: A standardized error response as per RFC 7807 (Problem Details for HTTP APIs).
    PageInfoWithTotalsApi:
      required:
      - count
      - limit
      - offset
      type: object
      properties:
        count:
          type: integer
          description: The results of the current page.
          format: int32
        limit:
          type: integer
          description: The limit of results per page.
          format: int32
        offset:
          type: integer
          description: The offset of the current page of results.
          format: int32
        totalResults:
          type:
          - integer
          - 'null'
          description: The total number of results.
          format: int32
        nextPageOffset:
          type:
          - integer
          - 'null'
          description: The offset of the next page of results. (optional)
          format: int32
          readOnly: true
        totalPages:
          type:
          - integer
          - 'null'
          description: The total number of pages with results.
          format: int32
          readOnly: true
      additionalProperties: false
    RoleUserResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/RoleUserResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    RoleUserResponse:
      type: object
      properties:
        key:
          type: string
          description: The user's key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The user's full name.
        email:
          type:
          - string
          - 'null'
          description: The user's email address.
        status:
          enum:
          - Active
          - Invited
          - Inactive
          - PendingRegistration
          allOf:
          - $ref: '#/components/schemas/UserProfileStatus'
          description: The user's status.
        photoUrl:
          type:
          - string
          - 'null'
          description: The user's photo URL.
        lastLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the last login (or token refresh) for this user in UTC.
          format: date-time
        _embedded:
          allOf:
          - $ref: '#/components/schemas/UserProfileEmbeddedResponse'
          description: 'The embedded information to provide. (optional)

            Only available when the request includes the query parameter `embed=`,

            e.g. `embed=userIdentityProviders`'
      additionalProperties: false
    ApplicationRoleApiResponse:
      type: object
      properties:
        key:
          type: string
          description: The application role key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The name of the application role.
        environmentKey:
          type: string
          description: The environment key.
          format: uuid
        assetKey:
          type: string
          description: The asset key.
          format: uuid
        externalKey:
          type: string
          description: The unique identifier for an application role independently of the environment.
          format: uuid
        claim:
          type:
          - string
          - 'null'
          description: The claim name.
        portfolioKey:
          type: string
          description: The portfolio key associated with the environment.
          format: uuid
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      description: Enter your bearer token in the format 'Bearer {token}'
      scheme: bearer
      bearerFormat: JWT