OutSystems Groups API

openapi: 3.2.0
info:
  title: User and Access Management Groups API
  description: REST endpoints for retrieving and managing user and access in your organization.
  version: v1
servers:
- url: https://ODC_PORTAL_DOMAIN/api/identity/v1
  description: Replace ODC_PORTAL_DOMAIN with the domain of your organization.
- url: https://{odc-portal-domain}/api/identity/v1
  description: User and Access Management API
  variables:
    odc-portal-domain:
      default: ODC_PORTAL_DOMAIN
      description: The domain of your organization
security:
- bearerAuth: []
tags:
- name: groups
paths:
  /groups/{key}/users:
    patch:
      tags:
      - groups
      summary: Allow to add or remove users from a group.
      description: 'Allows adding or removing users from a specified group. Manage group membership by specifying the group key and providing lists of user keys to be added or removed.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_AddOrRemoveUsersFromGroup
      parameters:
      - name: key
        in: path
        description: The group key.
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        description: The request object.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchUsersByGroupRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchUsersByGroupRequest'
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
    get:
      tags:
      - groups
      summary: Returns a list of users associated with a group.
      description: 'Returns a list of users associated with a group that match the specified filters. Use query parameters to refine the search.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_QueryUsersFromGroup
      parameters:
      - name: key
        in: path
        description: The group's key.
        required: true
        schema:
          type: string
          format: uuid
      - name: userKey
        in: query
        description: The user's key. Mutually exclusive with `userKeys`.
        schema:
          type: string
          format: uuid
      - name: userKeys
        in: query
        description: Only returns the users matching any of the specified keys. Comma-separated list of user keys. Mutually exclusive with `userKey`.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: nameOrEmailContains
        in: query
        description: "Filters users by name or email address. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: nameOrEmailOrUsernameContains
        in: query
        description: "Filters users by name or email or username. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: lastLoginAtSince
        in: query
        description: Only returns users whose last login occurred on or after the specified date and time.
        schema:
          type: string
          format: date-time
      - name: lastLoginAtTo
        in: query
        description: Only returns users whose last login occurred before or on the specified date and time.
        schema:
          type: string
          format: date-time
      - name: membershipType
        in: query
        description: Filters users by membership type that can be `Assigned` or `Mapped`.
        schema:
          allOf:
          - $ref: '#/components/schemas/MembershipType'
      - name: limit
        in: query
        description: 'Maximum number of results returned. Allowed values: 1 to 100 Default value: 100.'
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: 'Offset of the first result returned. Default value: 0.'
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". Default: name. Allowed: key, name, email, status, lastLoginAt.'
        schema:
          type: string
      - name: embed
        in: query
        description: List of fields to embed in the response.
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserProfileEmbedType'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupUserResponsePaginatedResponseApi'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
  /groups:
    post:
      tags:
      - groups
      summary: Creates a new group.
      description: 'Creates a new group by specifying a name and environment (stage). Optionally, you can include a list of users and application roles to assign to the group during creation.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_CreateGroup
      requestBody:
        description: Group object with the necessary information.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/GroupCreateRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/GroupCreateRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupCreateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
    get:
      tags:
      - groups
      summary: Returns the list of groups based on specified conditions.
      description: 'Returns a list of groups that match the specified filters. Use query parameters to refine the search.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_QueryGroups
      parameters:
      - name: nameContains
        in: query
        description: Filters users by name.
        schema:
          type: string
      - name: environmentKey
        in: query
        description: Only returns groups associated with the specified environment (stage). Mutually exclusive with `environmentKeys`.
        schema:
          type: string
          format: uuid
      - name: environmentKeys
        in: query
        description: Only returns groups associated with any of the specified environments (stages). Comma-separated list of environment keys. Mutually exclusive with `environmentKey`.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: identityProviderKey
        in: query
        description: Only returns groups with claim mappings for the specified identity provider.
        schema:
          type: string
          format: uuid
      - name: portfolioKeys
        in: query
        description: Only returns groups in environments belonging to any of the specified portfolios.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: limit
        in: query
        description: 'Maximum number of results returned. Allowed values: 1 to 100 Default value: 100.'
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: 'Offset of the first result returned. Default value: 0.'
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupApiResponsePaginatedResponseApi'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
  /groups/{key}:
    delete:
      tags:
      - groups
      summary: Deletes a group.
      description: 'Deletes a specified group using the group''s key.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_DeleteGroup
      parameters:
      - name: key
        in: path
        description: The key of the group to be deleted.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
    get:
      tags:
      - groups
      summary: Returns information for a group.
      description: 'Retrieves detailed information about a group, including its name, description, and environment.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_ReadGroup
      parameters:
      - name: key
        in: path
        description: Group key.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
    patch:
      tags:
      - groups
      summary: Updates a group.
      description: 'Updates the details of a group using the group''s key. Allows modification of the group''s name or description.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_UpdateGroup
      parameters:
      - name: key
        in: path
        description: The key of the group to be updated.
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        description: The request object with the new values.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchGroupRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchGroupRequest'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
  /groups/{key}/application-roles:
    patch:
      tags:
      - groups
      summary: Allow to add or remove application roles from a group.
      description: 'Allows adding or removing application roles from a specified group. Manage roles by specifying the group key and providing lists of application role keys to be added or removed.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_ModifyGroupApplicationRoles
      parameters:
      - name: key
        in: path
        description: The group key.
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        description: Request object with the application role keys to add or remove.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchGroupApplicationRolesRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/PatchGroupApplicationRolesRequest'
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
    get:
      tags:
      - groups
      summary: Returns a list of application roles associated with a group.
      description: 'Returns a list of application roles that match the specified filters. Use query parameters to refine the search.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: Group_QueryApplicationRolesGroups
      parameters:
      - name: key
        in: path
        description: The group key.
        required: true
        schema:
          type: string
          format: uuid
      - name: assetKey
        in: query
        description: The asset key.
        schema:
          type: string
          format: uuid
      - name: applicationRoleKey
        in: query
        description: The application role key. Mutually exclusive with `applicationRoleKeys`.
        schema:
          type: string
          format: uuid
      - name: applicationRoleKeys
        in: query
        description: Only returns the application roles matching any of the specified keys. Comma-separated list of application role keys. Mutually exclusive with `applicationRoleKey`.
        schema:
          type: array
          items:
            type: string
            format: uuid
      - name: nameContains
        in: query
        description: Filters application roles by name.
        schema:
          type: string
      - name: limit
        in: query
        description: 'Maximum number of results returned. Allowed values: 1 to 100 Default value: 100.'
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: 'Offset of the first result returned. Default value: 0.'
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". Default: name. Allowed: name, assetkey.'
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationRoleApiResponsePaginatedResponseApi'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
  /groups/{key}/claim-mappings/{mappingKey}:
    delete:
      tags:
      - groups
      summary: Delete a Group Idp Mapping.
      description: 'Delete a specified Group Idp Mapping object using its key.


        API Client needs the **User management > Manage end-user groups** permission.'
      operationId: GroupIdpClaimMapping_DeleteGroupIdpClaimMapping
      parameters:
      - name: key
        in: path
        description: The key of the Group for the Idp Mapping object to delete.
        required: true
        schema:
          type: string
          format: uuid
      - name: mappingKey
        in: path
        description: Claim Mapping key.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage end-user groups** permission.
components:
  schemas:
    GroupCreateResponse:
      type: object
      properties:
        key:
          type: string
          description: The group key.
          format: uuid
      additionalProperties: false
    GroupUserProfileResponse:
      type: object
      properties:
        key:
          type: string
          description: The user's key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The user's name.
        email:
          type:
          - string
          - 'null'
          description: The user's email.
        status:
          enum:
          - Active
          - Invited
          - Inactive
          - PendingRegistration
          allOf:
          - $ref: '#/components/schemas/UserProfileStatus'
          description: The user's status. Allowed values are 'Active', 'Inactive', 'PendingRegistration' and 'Invited'.
        photoUrl:
          type:
          - string
          - 'null'
          description: A URL pointing to the user's photo.
        lastLoginAt:
          type: string
          description: The date of the last time the user logged in.
          format: date-time
        _embedded:
          allOf:
          - $ref: '#/components/schemas/UserProfileEmbeddedResponse'
          description: The embedded information to provide. (optional) Only available when the request includes the query parameter `embed=`, e.g. `embed=userIdentityProviders`
      additionalProperties: false
      description: The profile of a group member.
    ProblemDetails:
      type: object
      properties:
        type:
          type:
          - string
          - 'null'
          description: A URI reference that identifies the problem type.
        title:
          type:
          - string
          - 'null'
          description: A short, human-readable summary of the problem.
        status:
          type:
          - integer
          - 'null'
          description: The HTTP status code applicable to the problem.
          format: int32
        detail:
          type:
          - string
          - 'null'
          description: A human-readable explanation of the error.
        instance:
          type:
          - string
          - 'null'
          description: A URI that identifies the specific occurrence of the problem.
        traceId:
          type: string
          description: This field helps OutSystems support track and investigate specific error occurrences. Providing this identifier when reporting an issue allows for more precise and faster troubleshooting.
        errorCode:
          type: string
          description: This error code serves the purpose to communicate with OutSystems Support and help diagnose errors.
      description: A standardized error response as per RFC 7807 (Problem Details for HTTP APIs).
    PatchGroupApplicationRolesRequest:
      type: object
      properties:
        applicationRoleKeysToAdd:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: The list of application role keys to add to the group.
        applicationRoleKeysToRemove:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: The list of application role keys to remove from the group.
      additionalProperties: false
    ApplicationRoleApiResponse:
      type: object
      properties:
        key:
          type: string
          description: The application role key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The name of the application role.
        environmentKey:
          type: string
          description: The environment key.
          format: uuid
        assetKey:
          type: string
          description: The asset key.
          format: uuid
        externalKey:
          type: string
          description: The unique identifier for an application role independently of the environment.
          format: uuid
        claim:
          type:
          - string
          - 'null'
          description: The claim name.
        portfolioKey:
          type: string
          description: The portfolio key associated with the environment.
          format: uuid
      additionalProperties: false
    MembershipType:
      enum:
      - Assigned
      - Mapped
      type: string
    PatchGroupRequest:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
          description: The name of the group.
        description:
          type:
          - string
          - 'null'
          description: The description of the group.
      additionalProperties: false
    GroupCreateRequest:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
          description: The name of the group.
        description:
          type:
          - string
          - 'null'
          description: The description of the group.
        environmentKey:
          type: string
          description: The environment key to associate with the group.
          format: uuid
        applicationRoleKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: The application role keys to associate with the group.
        userKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: The user keys to associate with the group.
      additionalProperties: false
    ApplicationRoleApiResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationRoleApiResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    GroupApiResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/GroupApiResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    GroupUserResponse:
      type: object
      properties:
        membershipTypes:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/MembershipType'
          description: The list of membership types of this user in this group. Allowed values are 'Assigned' (if directly added to the group) or 'Mapped' (if added via group mappings).
        user:
          allOf:
          - $ref: '#/components/schemas/GroupUserProfileResponse'
          description: The user details.
      additionalProperties: false
      description: Represents a user in a group.
    UserProfileEmbeddedResponse:
      type: object
      properties:
        applicationRoles:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationRoleApiResponse'
          description: List of application roles.
        userIdentityProviders:
          type:
          - array
          - 'null'
          items:
            $ref

# --- truncated at 32 KB (38 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/outsystems/refs/heads/main/openapi/outsystems-groups-api-openapi.yml