SlashID Identity Management API

openapi: 3.0.1
info:
  title: SlashID Groups Identity Management API
  description: "This is the [OpenAPI](https://www.openapis.org/) specification for communicating with the [SlashID](https://www.slashid.dev/) service.\n\nThe latest version of the OpenAPI API spec can be fetched from [our CDN](https://cdn.slashid.com/slashid-openapi-latest.yaml).\n\nWe recommend you use an [OpenAPI SDK generator](https://openapi.tools/#sdk) to create a client library in your programming language,\nbut you can also use this documentation to make HTTP calls directly.\n\n> **Compatibility note**: We aim to keep wire compatibility whenever we update the API, but parts of the specification may occasionally be refactored.\n  If you use an SDK generator, your code may require minor changes between versions.\n"
  version: '1.1'
  termsOfService: https://www.slashid.dev/terms-of-use/
  contact:
    name: API Support
    email: contact@slashid.dev
servers:
- url: https://api.slashid.com
  description: Production
- url: https://api.sandbox.slashid.com
  description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Identity Management
paths:
  /token/validate:
    parameters:
    - $ref: '#/components/parameters/OptionalSdkVersionHeader'
    post:
      operationId: PostTokenValidate
      tags:
      - Identity Management
      summary: Validate a user token
      description: 'This endpoint validates a SlashID user token.

        The response indicates whether the token is valid and its expiration time if so. If the token is not valid, the reason is returned.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidateTokenReq'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ValidateTokenResponse'
  /token/revoke:
    parameters:
    - $ref: '#/components/parameters/OptionalSdkVersionHeader'
    post:
      operationId: PostTokenRevoke
      tags:
      - Identity Management
      summary: Revoke a user token
      description: 'This endpoint revokes a SlashID user token.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeTokenReq'
        required: true
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '408':
          $ref: '#/components/responses/Timeout'
  /organizations/sso/saml/provider-credentials:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetOrganizationsSamlProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,saml-admin
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: List SAML credentials for SSO
      description: 'Returns a list of existing SAML provider credentials for SSO for your organization.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/SAMLProviderCredentialsGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
    post:
      operationId: PostOrganizationsSamlProviderCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new set of SAML provider credentials for SSO
      description: 'Create a new set of SAML provider credentials for your organization to use with SSO.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLProviderCredentialsPostRequest'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SAMLProviderCredentialsPostResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
  /organizations/sso/saml/provider-credentials/{saml_provider_credentials_id}:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/SAMLProviderCredentialsIDPathParam'
    get:
      operationId: GetOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member,saml-admin
      x-manager-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Get an existing set of SAML provider credentials for SSO
      description: 'Returns an existing set of SAML provider for SSO, specified by the provider credential ID.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SAMLProviderCredentialsGetResponse'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeleteOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete an existing set of SAML provider credentials for SSO
      description: 'Deletes an existing set of SAML provider credentials for SSO, specified by the provider credential ID.

        '
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    patch:
      operationId: PatchOrganizationsSsoSamlProviderCredentialsSamlProviderCredentialsId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,saml-admin
      x-manager-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Modify an existing set of SAML provider credentials for SSO
      description: Modifies an existing set of SAML provider credentials for SSO, specified by the provider credential ID.
      parameters:
      - $ref: '#/components/parameters/RequiredConsistencyHeader'
      - $ref: '#/components/parameters/RequiredConsistencyTimeoutHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLProviderCredentialsPatchRequest'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens/revoke:
    parameters:
    - $ref: '#/components/parameters/SdkVersionHeader'
    post:
      operationId: PostSsoOidcTokensRevoke
      deprecated: true
      tags:
      - Identity Management
      summary: (Deprecated) Revoke an OAuth token obtained through SSO with OIDC
      description: 'Revoke a previously obtained OAuth access or refresh token for an IdP.

        This endpoint is deprecated. Please use /sso/oidc/tokens/revoke/v2 instead.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRevokeReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
  /sso/oidc/tokens/revoke/v2:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostSsoOidcTokensRevokeV2
      x-rbac-enabled: true
      tags:
      - Identity Management
      summary: Revoke an OAuth token obtained through SSO with OIDC
      description: Revoke a previously obtained OAuth access or refresh token for an IdP
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoOidcTokensRevokeV2Req'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    - $ref: '#/components/parameters/RequiredTokenHeader'
    get:
      operationId: GetSsoOidcTokens
      x-rbac-enabled: true
      tags:
      - Identity Management
      summary: Retrieve OIDC tokens
      description: 'Retrieve tokens issued by an OIDC provider as part of an SSO authentication.

        This endpoint expects a valid SlashID token container issued after an SSO authentication.

        The response will include all of the OIDC tokens that were issued by that SSO authentication.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SsoOidcTokensGetResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /sso/oidc/tokens/query:
    parameters:
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostSsoOidcTokensQuery
      tags:
      - Identity Management
      summary: Query tokens obtained through SSO with OIDC
      description: Query the OIDC tokens for a person issued during SSO authentications.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoOidcTokensQueryReq'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SsoOidcTokensQueryResp'
        '400':
          $ref: '#/components/responses/BadRequest'
  /persons/{person_id}/direct-id:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdDirectId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Get Direct-ID value for a person
      description: 'This endpoint creates a one-time Direct-ID for a specific user. The returned Direct-ID string can embedded in a URL in the `challenges` query parameter to let your users land on a target page already authenticated.

        '
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonDirectIDReq'
        required: true
      responses:
        '201':
          description: The result string is a Direct-ID you can include in your links in the `challenges` query parameter.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/DirectID'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/mint-token:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdMintToken
      tags:
      - Identity Management
      summary: Mint a token for a person
      description: "This endpoint creates a token for a specific user.\n\n\nCustom claims can be specified in the request body which will be added to the token's payload.\nCustom claims are added to the token's payload.\n\nTokens created with this endpoint will have an `authenticated_methods` claim equal to [\"api\"].\n\n\nThe following claims are reserved and cannot be specified:\n  - aud\n  - exp\n  - jti\n  - iat\n  - iss\n  - nbf\n  - sub\n  - prev_token_id\n  - oid\n  - org_id\n  - user_id\n  - person_id\n  - first_token\n  - authenticated_methods\n  - oidc_tokens\n  - user_token\n  - groups\n  - roles\n  - access_token\n  - refresh_token\n  - id\n  - id_token\n  - gdpr\n  - gdpr_consent\n  - gdpr_consent_level\n  - parent_user_id\n  - parent_person_id\n  - parent_org_id\n  - parent_oid\n  - attributes\n  - custom_claims\n  - slashid\n  - slashid.dev\n  - slashid.com\n  - slashid.me\n  - sid\n\n\nWith the following request body:\n\n\n```\n{\n    \"custom_claims\": {\n        \"foo\": \"bar\",\n        \"baz\": {\"everything\": 42}\n    }\n}\n```\n\n\nthe token in the response will have the following payload:\n\n```\n{\n  \"authenticated_methods\": [\n    \"api\"\n  ],\n  \"baz\": {\n    \"everything\": 42\n  },\n  \"exp\": <expiration time timestamp>,\n  \"first_token\": false,\n  \"foo\": \"bar\",\n  \"iat\": <issued at timestamp>,\n  \"iss\": <token issuer>,\n  \"jti\": <token ID>,\n  \"oid\": <organisation ID>,\n  \"person_id\": <person ID>\n}\n```\n"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostMintTokenRequest'
        required: true
      responses:
        '201':
          description: The result string is a newly-minted SlashID token.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/UserTokenText'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    get:
      operationId: GetPersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      tags:
      - Identity Management
      summary: Retrieve a person's credentials
      description: 'Retrieves credentials linked to the specified person in your organization.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      type: array
                      items:
                        $ref: '#/components/schemas/ExportedCredential'
                  required:
                  - result
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      operationId: PostPersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create a new credential
      description: 'Creates a new credential linked to the specified person in your organization. This credential will then be available for use in future authentication challenges.

        '
      requestBody:
        description: The credential creation request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Credential'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/ExportedCredential'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      operationId: DeletePersonsPersonIdCredentials
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete all credentials
      description: 'Deletes all credentials from a person. Note that deletion is irreversible and the credentials will no longer be usable for authentication.

        '
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/{credential_id}:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/CredentialIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    delete:
      operationId: DeletePersonsPersonIdCredentialsCredentialId
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Delete a credential object
      description: 'Deletes the specified credential from a person,organization pair. Note that deletion is irreversible and the credential will no longer be usable for authentication.

        '
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    put:
      operationId: PutPersonsPersonIdCredentialsPassword
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Create or overwrite a password credential.
      description: 'Creates or overwrites the password credential linked to the specified person in your organization. This credential will then be available for use in future authentication challenges.

        '
      requestBody:
        description: The password credential creation/overwrite request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordCredential'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password-reset:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdCredentialsPasswordReset
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Trigger a password reset flow
      description: 'Triggers a password reset flow for the specified person and credential. The specified person must then take action to complete the flow and set a new password. Optionally, you can specify which of the person''s handles will be used to send the password reset link.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordResetPostReq'
      responses:
        '202':
          $ref: '#/components/responses/Accepted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/credentials/password-rotate:
    parameters:
    - $ref: '#/components/parameters/PersonIDPathParam'
    - $ref: '#/components/parameters/OrgIDHeader'
    post:
      operationId: PostPersonsPersonIdCredentialsPasswordRotate
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      tags:
      - Identity Management
      summary: Rotate a person's password
      description: 'Rotates a person''s password. The specified person does not need to have an existing password credential. A new password credential will be created regardless and returned in the response.

        '
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/PasswordRotatePostResp'
                  required:
                  - result
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/attributes:
    patch:
      operationId: PatchPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in multiple buckets
      description: 'Create new attributes or modify existing attributes for a person in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in multiple buckets
      description: 'Create new attributes or modify existing attributes for a person in one or more attribute buckets.

        The request body should be a nested object, with bucket names as top-level keys, and key-value pair attributes as values, as shown in the example request body. The buckets must exist and must be accessible by the organization identified in the request header. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutBucketedAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersonsPersonIdAttributes
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for a person from multiple buckets
      description: 'Retrieve attributes for a person from one or more buckets. If no buckets are specified, attributes from all buckets will be retrieved.

        Bucket names can be specified as a comma-separated list in the `buckets` query parameter. All buckets specified must exist, and the organization specified in the header must be able to access them. Empty bucket names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketsQueryParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetBucketedAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /persons/{person_id}/attributes/{bucket_name}:
    patch:
      operationId: PatchPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in a single bucket
      description: 'Create new attributes or modify existing attributes for a person in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Any existing attribute that isn''t referenced by key in the request is left untouched.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      operationId: PutPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin
      summary: Create or modify attributes for a person in a single bucket
      description: 'Create new attributes or modify existing attributes for a person in a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header.

        The request body should be an object consisting of key-value pair attributes. Attribute names may be at most 70 bytes long. Attribute values must be JSON-serializable and are limited to 64KiB. Replaces the set of existing attributes with those present in the request. In other words, it deletes any existing attributes that aren''t referenced by key in the request.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutAttributesReq'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    get:
      operationId: GetPersonsPersonIdAttributesBucketName
      x-rbac-enabled: true
      x-rbac-allowed-groups: admin,member
      summary: Retrieve attributes for a person from a single bucket
      description: 'Retrieve attributes for a person from a single attribute bucket.

        The bucket must exist and must be accessible by the organization identified in the request header. If no attribute names are specified, all attributes in the bucket will be retrieved. Attribute names can be provided as a comma-separated list in the `attributes` query parameter. Empty attribute names are not permitted.

        '
      tags:
      - Identity Management
      parameters:
      - $ref: '#/components/parameters/PersonIDPathParam'
      - $ref: '#/components/parameters/OrgIDHeader'
      - $ref: '#/components/parameters/AttributeBucketNamePathParam'
        required: true
      - $ref: '#/components/parameters/AttributeNamesQueryParam'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/APIResponseBase'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/GetAttributesResp'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $r

# --- truncated at 32 KB (257 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/slashid/refs/heads/main/openapi/slashid-identity-management-api-openapi.yml