OutSystems Organization Roles API

openapi: 3.2.0
info:
  title: User and Access Management Organization Roles API
  description: REST endpoints for retrieving and managing user and access in your organization.
  version: v1
servers:
- url: https://ODC_PORTAL_DOMAIN/api/identity/v1
  description: Replace ODC_PORTAL_DOMAIN with the domain of your organization.
- url: https://{odc-portal-domain}/api/identity/v1
  description: User and Access Management API
  variables:
    odc-portal-domain:
      default: ODC_PORTAL_DOMAIN
      description: The domain of your organization
security:
- bearerAuth: []
tags:
- name: organization-roles
paths:
  /organization-roles:
    post:
      tags:
      - organization-roles
      summary: Create an organization role.
      description: 'Creates an organization role.


        API Client needs the **User management > Manage organization roles** permission.'
      operationId: OrganizationRole_CreateOrganizationRole
      requestBody:
        description: Organization role object.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/OrganizationRoleCreateRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/OrganizationRoleCreateRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationRoleCreateResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage organization roles** permission.
    get:
      tags:
      - organization-roles
      summary: Returns the list of organization roles.
      description: 'Returns a list of organization roles. Use query parameters to filter the result based on different criteria.


        API client must have at least one permission.'
      operationId: OrganizationRole_QueryOrganizationRoles
      parameters:
      - name: roleKey
        in: query
        description: Organization role key.
        schema:
          type: string
          format: uuid
      - name: nameContains
        in: query
        description: Filters list by name.
        schema:
          type: string
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". The default is name. Allowed: name.'
        schema:
          type: string
      - name: limit
        in: query
        description: Maximum number of results returned. The value must be within 1 - 100 (both inclusive). The default value is 100.
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: Starting point or position of the first result returned. The default value is 0.
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationRoleApiResponsePaginatedResponseApi'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API client must have at least one permission.
  /organization-roles/{key}:
    delete:
      tags:
      - organization-roles
      summary: Delete an organization role.
      description: 'Deletes an organization role.


        API Client needs the **User management > Manage organization roles** permission.'
      operationId: OrganizationRole_DeleteOrganizationRole
      parameters:
      - name: key
        in: path
        description: Organization role key.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage organization roles** permission.
    get:
      tags:
      - organization-roles
      summary: Returns information for an organization role.
      description: 'Returns details about an organization role based on the organization role key.


        API client must have at least one permission.'
      operationId: OrganizationRole_ReadOrganizationRole
      parameters:
      - name: key
        in: path
        description: Organization role key.
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationRoleApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API client must have at least one permission.
    patch:
      tags:
      - organization-roles
      summary: Update an organization role.
      description: 'Updates the details of an organization role based on the organization role key.


        API Client needs the **User management > Manage organization roles** permission.'
      operationId: OrganizationRole_UpdateOrganizationRole
      parameters:
      - name: key
        in: path
        description: Organization role key.
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        description: Organization role object.
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/OrganizationRoleUpdateRequest'
          application/*+json:
            schema:
              allOf:
              - $ref: '#/components/schemas/OrganizationRoleUpdateRequest'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > Manage organization roles** permission.
  /organization-roles/{key}/users:
    get:
      tags:
      - organization-roles
      summary: Returns a list of users with a specific organization role.
      description: 'Returns a list of users with a specific organization role, based on the organization role key.

        Use query parameters to filter the result based on different criteria.


        API Client needs the **User management > View members** permission.'
      operationId: OrganizationRole_QueryUsersByRole
      parameters:
      - name: key
        in: path
        description: Organization role key.
        required: true
        schema:
          type: string
          format: uuid
      - name: nameOrEmailContains
        in: query
        description: "Filters list by name or email. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: nameOrEmailOrUsernameContains
        in: query
        description: "Filters list by name, email, or username. Parameter value must be URL-encoded (percent-encoding) to ensure it's correctly interpreted by the server. Example: Searching for an email with a +\n            \n Incorrect: .../users?email=`john+doe@example.com`.\n            \n Correct: .../users?email=`john%2Bdoe@example.com`"
        schema:
          type: string
      - name: limit
        in: query
        description: Maximum number of results returned. The value must be within 1 - 100 (both inclusive). The default value is 100.
        schema:
          type: integer
          format: int32
      - name: offset
        in: query
        description: Starting point or position of the first result returned. The default value is 0.
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        description: 'Used for sorting the list. Ascending by default. Prepend a hyphen, "-", to get a descending sort, for example "-name". The default is name. Allowed: userKey, name, email, status, lastLoginAt.'
        schema:
          type: string
      - name: embed
        in: query
        description: List of fields to embed in the response.
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserProfileEmbedType'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleUserResponsePaginatedResponseApi'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
      x-os-permissions: API Client needs the **User management > View members** permission.
components:
  schemas:
    OrganizationRoleCreateRequest:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
          description: Gets or sets the name of Organization Role.
        permissions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/PermissionDetailsRequest'
          description: Gets or sets the list of permissions for the Organization Role.
      additionalProperties: false
    UserProfileStatus:
      enum:
      - Active
      - Invited
      - Inactive
      - PendingRegistration
      type: string
    OrgRolePermissionDetailsApiResponse:
      type: object
      properties:
        permissionKey:
          type: string
          description: Gets or sets the permission key.
          format: uuid
        environmentKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: Gets or sets the environment keys.
        portfolioKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: Gets or sets the portfolio keys.
        claimName:
          type:
          - string
          - 'null'
          description: Gets or sets the claim name.
        name:
          type:
          - string
          - 'null'
          description: Gets or sets the permission name.
      additionalProperties: false
    UserProfileEmbeddedResponse:
      type: object
      properties:
        applicationRoles:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationRoleApiResponse'
          description: List of application roles.
        userIdentityProviders:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/UserIdpProfileResponse'
          description: List of user identity providers.
      additionalProperties: false
    OrganizationRoleCreateResponse:
      type: object
      properties:
        orgRoleKey:
          type: string
          description: Gets or sets the Organization Role Key.
          format: uuid
      additionalProperties: false
    OrganizationRoleUpdateRequest:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
          description: Gets or sets the name of the organization role.
        permissions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/PermissionDetailsRequest'
          description: Gets or sets the list of permissions for the organization role.
      additionalProperties: false
    UserProfileEmbedType:
      enum:
      - ApplicationRoles
      - UserIdentityProviders
      type: string
    UserIdpProfileResponse:
      type: object
      properties:
        userKey:
          type: string
          description: The user key.
          format: uuid
        identityProviderKey:
          type: string
          description: 'The identity provider key (format: guid).'
          format: uuid
        subject:
          type:
          - string
          - 'null'
          description: The subject claims in the token issued by the IdP.
        username:
          type:
          - string
          - 'null'
          description: The username.
        name:
          type:
          - string
          - 'null'
          description: The user's full name.
        email:
          type:
          - string
          - 'null'
          description: The user's email address.
        photoUrl:
          type:
          - string
          - 'null'
          description: The user's photo URL.
        firstLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the first login for this user using the idp in UTC.
          format: date-time
        lastLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the last login for this user using the idp in UTC.
          format: date-time
        isEmailVerified:
          type:
          - boolean
          - 'null'
          description: The value indicating whether or not the user's email is verified.
      additionalProperties: false
    ProblemDetails:
      type: object
      properties:
        type:
          type:
          - string
          - 'null'
          description: A URI reference that identifies the problem type.
        title:
          type:
          - string
          - 'null'
          description: A short, human-readable summary of the problem.
        status:
          type:
          - integer
          - 'null'
          description: The HTTP status code applicable to the problem.
          format: int32
        detail:
          type:
          - string
          - 'null'
          description: A human-readable explanation of the error.
        instance:
          type:
          - string
          - 'null'
          description: A URI that identifies the specific occurrence of the problem.
        traceId:
          type: string
          description: This field helps OutSystems support track and investigate specific error occurrences. Providing this identifier when reporting an issue allows for more precise and faster troubleshooting.
        errorCode:
          type: string
          description: This error code serves the purpose to communicate with OutSystems Support and help diagnose errors.
      description: A standardized error response as per RFC 7807 (Problem Details for HTTP APIs).
    PermissionDetailsRequest:
      type: object
      properties:
        permissionKey:
          type: string
          description: Gets or sets the permission key.
          format: uuid
        environmentKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: Gets or sets the environment keys.
        portfolioKeys:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          description: Gets or sets the portfolio keys.
        claimName:
          type:
          - string
          - 'null'
          description: Gets or sets the claim name.
        name:
          type:
          - string
          - 'null'
          description: Gets or sets the permission name.
      additionalProperties: false
    PageInfoWithTotalsApi:
      required:
      - count
      - limit
      - offset
      type: object
      properties:
        count:
          type: integer
          description: The results of the current page.
          format: int32
        limit:
          type: integer
          description: The limit of results per page.
          format: int32
        offset:
          type: integer
          description: The offset of the current page of results.
          format: int32
        totalResults:
          type:
          - integer
          - 'null'
          description: The total number of results.
          format: int32
        nextPageOffset:
          type:
          - integer
          - 'null'
          description: The offset of the next page of results. (optional)
          format: int32
          readOnly: true
        totalPages:
          type:
          - integer
          - 'null'
          description: The total number of pages with results.
          format: int32
          readOnly: true
      additionalProperties: false
    RoleUserResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/RoleUserResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    OrganizationRoleApiResponsePaginatedResponseApi:
      type: object
      properties:
        results:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/OrganizationRoleApiResponse'
          description: The List of results.
        page:
          allOf:
          - $ref: '#/components/schemas/PageInfoWithTotalsApi'
          description: The details of the page information.
      additionalProperties: false
    OrganizationRoleApiResponse:
      required:
      - permissions
      type: object
      properties:
        key:
          type: string
          description: Gets or sets the organization role key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: Gets or sets the organization role name.
        permissions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/OrgRolePermissionDetailsApiResponse'
          description: Gets or sets the permissions.
        isReadOnly:
          type: boolean
          description: Gets or sets a value indicating whether the organization role is readonly.
      additionalProperties: false
    RoleUserResponse:
      type: object
      properties:
        key:
          type: string
          description: The user's key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The user's full name.
        email:
          type:
          - string
          - 'null'
          description: The user's email address.
        status:
          enum:
          - Active
          - Invited
          - Inactive
          - PendingRegistration
          allOf:
          - $ref: '#/components/schemas/UserProfileStatus'
          description: The user's status.
        photoUrl:
          type:
          - string
          - 'null'
          description: The user's photo URL.
        lastLoginAt:
          type:
          - string
          - 'null'
          description: The timestamp of the last login (or token refresh) for this user in UTC.
          format: date-time
        _embedded:
          allOf:
          - $ref: '#/components/schemas/UserProfileEmbeddedResponse'
          description: 'The embedded information to provide. (optional)

            Only available when the request includes the query parameter `embed=`,

            e.g. `embed=userIdentityProviders`'
      additionalProperties: false
    ApplicationRoleApiResponse:
      type: object
      properties:
        key:
          type: string
          description: The application role key.
          format: uuid
        name:
          type:
          - string
          - 'null'
          description: The name of the application role.
        environmentKey:
          type: string
          description: The environment key.
          format: uuid
        assetKey:
          type: string
          description: The asset key.
          format: uuid
        externalKey:
          type: string
          description: The unique identifier for an application role independently of the environment.
          format: uuid
        claim:
          type:
          - string
          - 'null'
          description: The claim name.
        portfolioKey:
          type: string
          description: The portfolio key associated with the environment.
          format: uuid
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      description: Enter your bearer token in the format 'Bearer {token}'
      scheme: bearer
      bearerFormat: JWT