SecureAuth (incl. Cloudentity) Environment API
The environment API from SecureAuth (incl. Cloudentity) — 2 operation(s) for environment.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/secureauth:secureauth-environment-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Secureauth Environment API
version: latest
description: 'Operations tagged environment across 3 of this provider''s published API definitions: secureauth-admin-openapi.yml, secureauth-developer-openapi.yml, secureauth-public-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://localhost:8443/api/admin/default
- url: https://localhost:8443/api/developer/default/developer
- url: https://localhost:8443/default/default
tags:
- name: Environment
paths:
/environment:
get:
description: Get environment settings.
operationId: getEnvironment
parameters:
- description: A server will only return requested resources if the resource matches one of the listed ETag value
in: header
name: if-match
schema:
type: string
format: etag
- description: Unique identifier included in audit events for request tracking
in: header
name: x-correlation-id
schema:
type: string
- description: Key used to safely retry failed requests without duplicate processing
in: header
name: x-idempotency-key
schema:
type: string
responses:
'200':
$ref: '#/components/responses/Environment'
'401':
$ref: '#/components/responses/unauthorizedHTTPError'
'403':
$ref: '#/components/responses/forbiddenHTTPError'
'429':
$ref: '#/components/responses/tooManyRequestsHTTPError'
security:
- admin: []
summary: Get environment
tags:
- Environment
servers:
- url: https://localhost:8443/api/admin/default
/servers/{wid}/environment:
get:
description: Get workspace environment settings.
operationId: getWorkspaceEnvironment
parameters:
- description: A server will only return requested resources if the resource matches one of the listed ETag value
in: header
name: if-match
schema:
type: string
format: etag
- description: Unique identifier included in audit events for request tracking
in: header
name: x-correlation-id
schema:
type: string
- description: Key used to safely retry failed requests without duplicate processing
in: header
name: x-idempotency-key
schema:
type: string
- description: Workspace id
in: path
name: wid
required: true
schema:
type: string
default: default
responses:
'200':
$ref: '#/components/responses/Environment'
'401':
$ref: '#/components/responses/unauthorizedHTTPError'
'403':
$ref: '#/components/responses/forbiddenHTTPError'
'429':
$ref: '#/components/responses/tooManyRequestsHTTPError'
security:
- admin: []
summary: Get workspace environment
tags:
- Environment
servers:
- url: https://localhost:8443/api/admin/default
components:
schemas:
TenantWorkforceSettings:
properties:
faye_url:
type: string
manifest_url:
type: string
url:
type: string
type: object
DefaultBruteForceLimit:
properties:
block_duration:
description: duration until retry permitted in minutes
format: duration
type: string
max_attempts:
description: number of attempts before blocked
format: int64
type: integer
type: object
Environment:
properties:
acr:
description: ACR support
type: boolean
activation_preferred_method_setup:
description: offer (skippable) enrollment of the pool's preferred authentication method during activation
type: boolean
active_directory_idp:
description: Active Directory IDP
type: boolean
add_fake_tenant_url_to_login_request_for_non_default_routing:
description: add fake tenantUrl to query params for routing other than default (needed for backward compatibility with CIP for vanity domains)
type: boolean
admin_issuer_url:
type: string
admin_workspace_access:
description: admin workspace access
type: boolean
agentic_ai_system_nav:
description: show full system nav in agentic AI workspaces (default off - system nav is hidden)
type: boolean
ai_security:
description: AI Security
type: boolean
ai_security_manifest_url:
type: string
ai_security_public_url:
type: string
allow_identity_pool_otp_challenge_confirmation_via_web_page:
description: allow Identity Pool OTP Challenge confirmation via web page
type: boolean
analytics_duration:
format: duration
type: string
applications_membership:
description: applications membership — assignment of applications to organizations / users / groups (in development)
type: boolean
audit_events_duration:
format: duration
type: string
b2b_orgs_client_side_search:
description: b2b orgs client-side search
type: boolean
block_non_vanity_domain_access:
description: block access to a tenant's resources from traffic not originating from the tenant's vanity domain
type: boolean
brute_force_limits:
$ref: '#/components/schemas/DefaultBruteForceLimits'
built_in_advanced_phone_providers:
description: route SMS and voice sends through the platform-default phone provider chain
type: boolean
cache_access_tokens:
description: cache access tokens
type: boolean
cdr_arrangement_cache:
description: arrangement cache for CDR
type: boolean
cdr_disable_unique_software_id:
description: disable unique software id for CDR
type: boolean
client_id_metadata_document:
description: client ID metadata documents — accept an https client_id resolved by fetching the client's own metadata document (draft-ietf-oauth-client-id-metadata-document)
type: boolean
client_secrets_stored_as_one_way_hash:
description: stores client secrets as one-way hashes
type: boolean
cloudentity_idp:
description: SecureAuth IDP
type: boolean
commit:
type: string
connect_id:
description: connectID profile
type: boolean
connect_id_consent_page_face_lifting:
description: connect ID consent page facelifting
type: boolean
custom_recovery:
description: Custom recovery
type: boolean
debug:
description: enable additional debug logs
type: boolean
dedicated_faas:
description: allow the usage of dedicated FaaS Rego/JS environments
type: boolean
demo_app:
description: demo app
type: boolean
dev_mode:
description: hot reloading of templates
type: boolean
device_pairing_tap_to_pair:
description: Offer opening the mobile app directly, both when pairing a device on the phone itself and when logging in with a QR code on it
type: boolean
disable_audit_events:
description: disable audit events
type: boolean
disable_identity_pool_self_user_apis_without_scopes:
description: disable Identity Pool Self User APIs without scopes
type: boolean
disable_public_identity_api_confirm_reset_password:
description: disable public Identity API to confirm reset password
type: boolean
disable_self_user_identity_api_complete_address_verification:
description: disable self user Identity API to complete address verification
type: boolean
disable_server_error_on_script_user_error:
description: disable failing with server error on script user error instead of redirecting to the client app
type: boolean
display_workspace_wizard:
type: boolean
do_not_validate_cert_for_private_key_jwt:
description: do not validate cert for private key jwt
type: boolean
drop_tokens_on_password_reset:
description: drop tokens on password reset
type: boolean
embeddable_components:
description: render the tenant's User portal through the embeddable web components served at /embed/v1
type: boolean
embedded_idps_enabled:
type: boolean
fake_data:
description: use fake data (such as ips) - needed for qa testing
type: boolean
faye_url:
type: string
grpc_url:
type: string
has_google_image_search:
type: boolean
hotjar_tracking:
description: allow user tracking with hotjar, userpilot and other tracking tools
type: boolean
id_jag:
description: ID-JAG — issue and redeem Identity Assertion JWT Authorization Grants for cross-app access (draft-ietf-oauth-identity-assertion-authz-grant)
type: boolean
identity_assurance:
description: identity assurance
type: boolean
image_proxy_url:
type: string
insecure_allow_internal_webhook_targets:
description: disables SSRF protection for webhook delivery
type: boolean
insecure_disable_csrf:
description: disable csrf
type: boolean
insecure_token_exchange_public_clients:
description: insecure token exchange public clients
type: boolean
manage_logins_any_system_client:
description: allow any system client with manage_logins scope to manage login sessions without being linked to an IDP
type: boolean
mark_address_as_verified_on_any_proof_of_possession:
description: mark address as verified on any proof of possession of the address
type: boolean
nats:
description: publish events to NATS
type: boolean
noop_message_sending:
description: drop outbound message events at publish time so no email/SMS/voice is dispatched; intended for perf-test tenants; admin workspace is excluded
type: boolean
phone_delivery_sms:
description: whether this tenant can currently deliver an SMS
type: boolean
phone_delivery_voice:
description: whether this tenant can currently place a voice call
type: boolean
push:
description: Push
type: boolean
radius:
description: radius
type: boolean
rar:
description: rich authorization requests
type: boolean
remote_risk_dashboard:
description: Remote risk dashboard
type: boolean
risk_engine_ab:
description: Enable risk_engine and risk_engine_ab for risk engine a/b testing
type: boolean
risk_insights:
additionalProperties:
$ref: '#/components/schemas/Insight'
type: object
risk_manifest_url:
type: string
risk_organization_id:
type: string
risk_public_url:
type: string
risk_tenant_id:
type: string
saml_idp_overrides_per_sp:
description: SAML IDP overrides per SP
type: boolean
scope_transient_otp:
description: scope transient_otp
type: boolean
script_runtimes:
items:
$ref: '#/components/schemas/ScriptRuntime'
type: array
swagger_ui:
description: swagger ui
type: boolean
sync_user_persistence:
description: synchronous user persistence (bypass event stream, write directly to database)
type: boolean
system_flags:
items:
type: string
type: array
system_workspace_access:
description: system workspace access
type: boolean
tenant_flags:
items:
type: string
type: array
tenant_level_identity_pool:
description: use tenant level identity pool
type: boolean
tenant_settings:
$ref: '#/components/schemas/TenantSettings'
tenant_source:
enum:
- saidp
- aws
- internal_signup
- marketing
type: string
tree_dump_tenant:
description: hierarchical dumps tenant APIs
type: boolean
user_cross_organization_role_assignment:
description: User cross-organization role assignment
type: boolean
user_friendly_credentials_setup:
description: User-friendly credentials setup
type: boolean
version:
type: string
wildcard_tenant_id_must_match_path_tenant_id:
description: require that the wildcard tenant id matches the path param tenant id
type: boolean
with_analytics:
type: boolean
with_permissions:
type: boolean
with_roles:
type: boolean
workforce:
description: workforce integration
type: boolean
workforce_manifest_url:
type: string
workforce_url:
type: string
type: object
RedactionPolicy:
properties:
address:
description: Controls whether phone numbers are retained or obfuscated by the provider.
example: retain
type: string
content:
description: Controls whether message body content is retained by the provider.
example: retain
type: string
title: RedactionPolicy controls message redaction at the SMS provider level.
type: object
SecureOptions:
properties:
AllowedHosts:
description: AllowedHosts is a slice of fully qualified domain names that are allowed. Default is an empty slice, which allows any and all host names.
items:
type: string
type: array
AllowedHostsAreRegex:
description: AllowedHostsAreRegex determines, if the provided `AllowedHosts` slice contains valid regular expressions. If this flag is set to true, every request's host will be checked against these expressions. Default is false.
type: boolean
BrowserXssFilter:
description: If BrowserXssFilter is true, adds the X-XSS-Protection header with the value `1; mode=block`. Default is false.
type: boolean
ContentSecurityPolicy:
description: ContentSecurityPolicy allows the Content-Security-Policy header value to be set with a custom value. Default is "".
type: string
ContentSecurityPolicyReportOnly:
description: ContentSecurityPolicyReportOnly allows the Content-Security-Policy-Report-Only header value to be set with a custom value. Default is "".
type: string
ContentTypeNosniff:
description: If ContentTypeNosniff is true, adds the X-Content-Type-Options header with the value `nosniff`. Default is false.
type: boolean
CrossOriginOpenerPolicy:
description: 'CrossOriginOpenerPolicy allows you to ensure a top-level document does not share a browsing context group with cross-origin documents. Default is "".
Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy'
type: string
CustomBrowserXssValue:
description: CustomBrowserXssValue allows the X-XSS-Protection header value to be set with a custom value. This overrides the BrowserXssFilter option. Default is "".
type: string
CustomFrameOptionsValue:
description: 'Passing a template string will replace `$NONCE` with a dynamic nonce value of 16 bytes for each request which can be later retrieved using the Nonce function.
Eg: script-src $NONCE -> script-src ''nonce-a2ZobGFoZg==''
CustomFrameOptionsValue allows the X-Frame-Options header value to be set with a custom value. This overrides the FrameDeny option. Default is "".'
type: string
ExpectCTHeader:
description: ExpectCTHeader allows the Expect-CT header value to be set with a custom value. Default is "".
type: string
FeaturePolicy:
description: 'FeaturePolicy allows to selectively enable and disable use of various browser features and APIs. Default is "".
Deprecated: This header has been renamed to Permissions-Policy.'
type: string
ForceSTSHeader:
description: If ForceSTSHeader is set to true, the STS header will be added even when the connection is HTTP. Default is false.
type: boolean
FrameDeny:
description: If FrameDeny is set to true, adds the X-Frame-Options header with the value of `DENY`. Default is false.
type: boolean
HostsProxyHeaders:
description: HostsProxyHeaders is a set of header keys that may hold a proxied hostname value for the request.
items:
type: string
type: array
IsDevelopment:
description: 'When developing, the AllowedHosts, SSL, and STS options can cause some unwanted effects. Usually testing happens on http, not https, and on localhost, not your production domain... so set this to true for dev environment.
If you would like your development environment to mimic production with complete Host blocking, SSL redirects, and STS headers, leave this as false. Default if false.'
type: boolean
PermissionsPolicy:
description: PermissionsPolicy allows to selectively enable and disable use of various browser features and APIs. Default is "".
type: string
PublicKey:
description: 'PublicKey implements HPKP to prevent MITM attacks with forged certificates. Default is "".
Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible.'
type: string
ReferrerPolicy:
description: ReferrerPolicy allows sites to control when browsers will pass the Referer header to other sites. Default is "".
type: string
SSLForceHost:
description: If SSLForceHost is true and SSLHost is set, requests will be forced to use SSLHost even the ones that are already using SSL. Default is false.
type: boolean
SSLHost:
description: SSLHost is the host name that is used to redirect http requests to https. Default is "", which indicates to use the same host.
type: string
SSLProxyHeaders:
additionalProperties:
type: string
description: 'SSLProxyHeaders is set of header keys with associated values that would indicate a valid https request. Useful when using Nginx: `map[string]string{"X-Forwarded-Proto": "https"}`. Default is blank map.'
type: object
SSLRedirect:
description: If SSLRedirect is set to true, then only allow https requests. Default is false.
type: boolean
SSLTemporaryRedirect:
description: If SSLTemporaryRedirect is true, the a 302 will be used while redirecting. Default is false (301).
type: boolean
STSIncludeSubdomains:
description: If STSIncludeSubdomains is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header. Default is false.
type: boolean
STSPreload:
description: If STSPreload is set to true, the `preload` flag will be appended to the Strict-Transport-Security header. Default is false.
type: boolean
STSSeconds:
description: STSSeconds is the max-age of the Strict-Transport-Security header. Default is 0, which would NOT include the header.
format: int64
type: integer
SecureContextKey:
description: SecureContextKey allows a custom key to be specified for context storage.
type: string
type: object
Error:
description: HTTP error response
properties:
details:
type: object
error:
type: string
error_code:
type: string
status_code:
format: int64
type: integer
type: object
TenantSettings:
properties:
default_template_id:
format: serverID
type: string
default_workspace_id:
format: serverID
type: string
message_redaction:
$ref: '#/components/schemas/RedactionPolicy'
security:
$ref: '#/components/schemas/SecureOptions'
translations:
$ref: '#/components/schemas/TenantTranslationsSettings'
well_known:
additionalProperties:
type: object
type: object
workforce:
$ref: '#/components/schemas/TenantWorkforceSettings'
type: object
Insight:
properties:
desc:
description: Description
type: string
name:
description: Display name
type: string
type: object
TenantTranslationsSettings:
properties:
default_locale:
description: Default locale
format: locale
type: string
disabled_translations:
description: Disabled built-in translations
items:
format: locale
type: string
type: array
enabled:
description: Are translations enabled
type: boolean
selector_enabled:
description: Is locale selector enabled in templates
type: boolean
type: object
DefaultBruteForceLimits:
properties:
client_authentication:
$ref: '#/components/schemas/DefaultBruteForceLimit'
device_handling:
$ref: '#/components/schemas/DefaultBruteForceLimit'
enabled:
type: boolean
identity_activate_self_registered:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_activate_with_extended_code:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_address_verification:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_authentication:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_change_password:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_change_totp_secret:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_code_inspect:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_code_verify:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_confirm_password:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_registration:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_self_activation:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_self_change_password:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_self_change_totp_secret:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_self_register:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_set_credential:
$ref: '#/components/schemas/DefaultBruteForceLimit'
identity_verify_password:
$ref: '#/components/schemas/DefaultBruteForceLimit'
mfa:
$ref: '#/components/schemas/DefaultBruteForceLimit'
type: object
ScriptRuntime:
properties:
dependencies:
additionalProperties:
type: string
description: Preinstalled nodejs libraries
type: object
env_version:
description: Node executor environment runtime version
type: string
node_version:
description: Nodejs engine version
type: string
valid_until:
description: Nodejs executor end-of-life date
format: date-time
type: string
type: object
DeveloperEnvironment:
properties:
client_secrets_stored_as_one_way_hash:
description: store client secrets as a one way hash
type: boolean
rar:
description: Rich Authorization Requests (RAR)
type: boolean
saml_idp_overrides_per_sp:
description: SAML IDP overrides per SP
type: boolean
type: object
PublicEnvironment:
properties:
ai_security:
description: If ai_security is enabled
type: boolean
ai_security_manifest_url:
type: string
ai_security_public_url:
type: string
b2b_orgs_client_side_search:
description: If b2b_orgs_client_side_search is enabled
type: boolean
embeddable_components:
description: If the User portal renders its self-service panes through the embeddable components
type: boolean
faye_url:
type: string
image_proxy_url:
description: Image proxy URL
type: string
push:
description: If push is enabled
type: boolean
server_profile:
enum:
- default
- demo
- workforce
- workforce_v2
- consumer
- partners
- third_party
- fapi_advanced
- fapi_rw
- fapi_ro
- openbanking_uk_fapi_advanced
- openbanking_uk
- openbanking_br
- openbanking_br_unico
- cdr_australia
- cdr_australia_fapi_rw
- fdx
- openbanking_ksa
- fapi_20_security
- fapi_20_message_signing
- connect_id
- agentic_ai
- saidp_legacy
type: string
translations_default_locale:
format: locale
type: string
translations_enabled:
description: translations
type: boolean
translations_locales:
items:
format: locale
type: string
type: array
workforce:
description: workforce integration
type: boolean
workforce_logout_url:
type: string
workforce_manifest_url:
type: string
workforce_status:
$ref: '#/components/schemas/WorkforceProvisioningStatus'
workforce_tenant_slug:
type: string
workforce_url:
type: string
workspace_issuer_url:
description: Workspace Issuer URL
type: string
type: object
WorkforceProvisioningStatus:
type: string
responses:
forbiddenHTTPError:
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Environment:
description: Environment
headers:
etag:
description: 'The ETag HTTP header is an identifier for a specific version of a resource
in:header'
schema:
type: string
format: etag
x-external-error:
description: 'Indicates that a 5xx error was caused by tenant-provided code
in:header'
schema:
type: string
x-trace-id:
description: 'OpenTelemetry trace identifier
in:header'
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/Environment'
unauthorizedHTTPError:
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
tooManyRequestsHTTPError:
description: Too many requests
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
GetDeveloperEnvironmentAPIResponse:
description: Developer environment
content:
application/json:
schema:
$ref: '#/components/schemas/DeveloperEnvironment'
GetPublicEnvironmentAPIResponse:
description: Public environment
content:
application/json:
schema:
$ref: '#/components/schemas/PublicEnvironment'
securitySchemes:
admin:
type: oauth2
flows:
authorizationCode:
scopes: {}
authorizationUrl: /default/admin/oauth2/authorize
tokenUrl: /default/admin/oauth2/token
developer:
type: oauth2
flows:
authorizationCode:
scopes: {}
authorizationUrl: /default/developer/oauth2/authorize
tokenUrl: /default/developer/oauth2/token
default:
type: oauth2
flows:
authorizationCode:
scopes:
list_clients_with_access: list_clients_with_access
manage_consents: manage_consents
manage_post_authn: manage_post_authn
manage_sessions: manage_sessions
revoke_client_access: revoke_client_access
transient_otp: transient_otp
view_consents: view_consents
view_sessions: view_sessions
authorizationUrl: /default/default/oauth2/authorize
tokenUrl: /default/default/oauth2/token
x-refined-from:
- secureauth-admin-openapi.yml
- secureauth-developer-openapi.yml
- secureauth-public-openapi.yml