openapi: 3.0.3
info:
title: One-Time Login Applications API
description: Login users using one-time login methods like magic links or OTPs. This implements a backend-to-backend integration for authentication.
version: ''
servers:
- url: https://api.sbx.transmitsecurity.io/cis
description: Sandbox environment
- url: https://api.transmitsecurity.io/cis
description: Production environment (US)
- url: https://api.eu.transmitsecurity.io/cis
description: Production environment (EU)
- url: https://api.ca.transmitsecurity.io/cis
description: Production environment (CA)
- url: https://api.au.transmitsecurity.io/cis
description: Production environment (AU)
security: []
tags:
- name: Applications
paths:
/v1/applications/{app_id}/organizations/{organization_id}/role-groups/set:
post:
operationId: setAssignedRoleGroups
summary: Set org's role groups
description: 'Update the role groups of the organization for a specific application, which will replace any existing role groups for the organization. These role groups must first be created for the application. Once added to the organization, roles that belong to these role groups can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:edit`, `orgs:edit`.'
parameters:
- name: app_id
required: true
in: path
description: ID of the application to set the roles to
schema:
type: string
- name: organization_id
required: true
in: path
description: ID of the organization to set the roles to
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRoleGroupIds'
responses:
'202':
description: ''
security:
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{app_id}/organizations/{organization_id}/role-groups:
get:
operationId: getAssignedRoleGroups
summary: Get org's role groups
description: 'Retrieves all role groups that were added to the organization for a specific application. Roles that belong to these role groups can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:read`, `orgs:read`.'
parameters:
- name: app_id
required: true
in: path
description: ID of the application to assign the roles to
schema:
type: string
- name: organization_id
required: true
in: path
description: ID of the organization to assign the roles to
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-getAssignedRoleGroups
type: object
required:
- result
description: ''
properties:
result:
$ref: '#/components/schemas/RoleGroupsAndDefaultOrgRolesDto'
security:
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{app_id}/organizations/{organization_id}/roles-and-groups/set:
post:
operationId: setAssignedRolesAndGroups
summary: Set org's roles and role groups
description: 'Update the roles and role groups of the organization for a specific application, which will replace any existing assignments. These roles and role groups must first be created for the application. Once added to the organization, roles that belong to these role groups or are directly assigned can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:edit`, `orgs:edit`.'
parameters:
- name: app_id
required: true
in: path
description: ID of the application
schema:
type: string
- name: organization_id
required: true
in: path
description: ID of the organization
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/RolesAndRoleGroupsInputDto'
responses:
'202':
description: ''
security:
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{app_id}/organizations/{organization_id}/roles-and-groups:
get:
operationId: getAssignedRolesAndGroups
summary: Get org's roles and role groups
description: 'Retrieves all roles and role groups that were added to the organization for a specific application. Roles that belong to these role groups or are directly assigned can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:read`, `orgs:read`.'
parameters:
- name: app_id
required: true
in: path
description: ID of the application
schema:
type: string
- name: organization_id
required: true
in: path
description: ID of the organization
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-getAssignedRolesAndGroups
type: object
required:
- result
description: ''
properties:
result:
$ref: '#/components/schemas/RolesAndRoleGroupsDto'
security:
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{appId}/clients:
post:
operationId: createAppClient
summary: Create client
description: 'Create a new client. <br><br>**Required permissions**: `apps:create`, `apps:edit`.'
parameters:
- name: appId
required: true
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiCreateOidcClientInput'
- $ref: '#/components/schemas/ApiCreateSamlClientInput'
responses:
'201':
description: ''
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiOidcClient'
- $ref: '#/components/schemas/ApiSamlClient'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'409':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/IdentifierIsTakenHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
get:
operationId: getAppClients
summary: Get all clients
description: 'Retrieves a list of clients for an application. <br><br>**Required permissions**: `apps:read`.'
parameters:
- name: appId
required: true
in: path
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
items:
anyOf:
- $ref: '#/components/schemas/ApiOidcClient'
- $ref: '#/components/schemas/ApiSamlClient'
type: array
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
delete:
operationId: deleteAppClients
summary: Delete all clients
description: Deletes all clients for an application.
parameters:
- name: appId
required: true
in: path
schema:
type: string
responses:
'204':
description: ''
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{appId}/clients/{clientId}:
get:
operationId: getAppClientById
summary: Get client by ID
description: 'Retrieves a client by client ID. <br><br>**Required permissions**: `apps:read`.'
parameters:
- name: clientId
required: true
in: path
description: ID of the client to retrieve
schema:
type: string
- name: appId
required: true
in: path
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiOidcClient'
- $ref: '#/components/schemas/ApiSamlClient'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
put:
operationId: updateAppClient
summary: Update client
description: 'Update a client. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `apps:edit`, `apps:create`.'
parameters:
- name: clientId
required: true
in: path
description: ID of the client to update
schema:
type: string
- name: appId
required: true
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiUpdateOidcClientInput'
- $ref: '#/components/schemas/ApiUpdateSamlClientInput'
responses:
'200':
description: ''
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiOidcClient'
- $ref: '#/components/schemas/ApiSamlClient'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
delete:
operationId: deleteAppClient
summary: Delete client
description: 'Delete a client. <br><br>**Required permissions**: `apps:delete`, `apps:create`, `apps:edit`.'
parameters:
- name: clientId
required: true
in: path
description: ID of the client to delete
schema:
type: string
- name: appId
required: true
in: path
schema:
type: string
responses:
'204':
description: ''
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
/v1/applications/{appId}/clients/{clientId}/resources:
put:
operationId: updateAppClientResources
summary: Update client resources
description: Update the list of resources that a client is allowed to explicitly request access to
parameters:
- name: clientId
required: true
in: path
schema:
type: string
- name: appId
required: true
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ApiUpdateResourceInAppInput'
responses:
'200':
description: ''
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/ApiOidcClient'
- $ref: '#/components/schemas/ApiSamlClient'
security:
- ClientAccessToken: []
- AdminAccessToken: []
tags:
- Applications
/v1/applications:
post:
operationId: createApp
summary: Create app
description: 'Create a new application with a default client. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:create`, `[appId]:create`.'
parameters: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ApiCreateAppInput'
responses:
'201':
description: ''
content:
application/json:
schema:
title: ApiCreatedResponse-createApp
type: object
required:
- result
description: App successfully created
properties:
result:
$ref: '#/components/schemas/ApiApp'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'409':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/IdentifierIsTakenHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
get:
operationId: getAllApps
summary: Get all apps
description: 'Retrieves a list of all applications with their default clients. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:read`, `apps:list`, `[appId]:read`, `[appId]:list`.'
parameters: []
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-getAllApps
type: object
required:
- result
description: Successfully fetched apps
properties:
result:
type: array
items:
$ref: '#/components/schemas/ApiAppWithoutLogo'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/list:
get:
operationId: getAppsList
summary: Get all apps basic information
description: 'Retrieves a list of all applications with their basic information. <br><br>**Required permissions**: `apps:list`, `users:read`, `organizations:read`, `roles:read`, `orgs:read`, `[appId]:list`.'
parameters: []
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-getAppsList
type: object
required:
- result
description: Successfully fetched apps
properties:
result:
type: array
items:
$ref: '#/components/schemas/ApiBasicApp'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/{appId}:
get:
operationId: getAppById
summary: Get app by ID
description: 'Retrieves an application by application ID with the default client. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:read`, `[appId]:read`.'
parameters:
- name: appId
required: true
in: path
description: ID of the application to retrieve
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-getAppById
type: object
required:
- result
description: Successfully fetched app
properties:
result:
$ref: '#/components/schemas/ApiApp'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
put:
operationId: updateApp
summary: Update app
description: 'Updates an application. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `apps:edit`, `[appId]:edit`.'
parameters:
- name: appId
required: true
in: path
description: ID of the application to update
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ApiUpdateAppInput'
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-updateApp
type: object
required:
- result
description: App successfully updated
properties:
result:
$ref: '#/components/schemas/ApiApp'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
delete:
operationId: deleteApp
summary: Delete app
description: 'Delete an application. <br><br>**Required permissions**: `apps:delete`, `[appId]:delete`.'
parameters:
- name: appId
required: true
in: path
description: ID of the application to delete
schema:
type: string
responses:
'204':
description: ''
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'404':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/NotFoundHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/{appId}/resources:
put:
operationId: updateResourcesInApp
summary: Update app resources
description: Update the list of resources that a default client of the application is allowed to explicitly request access to
deprecated: true
parameters:
- name: appId
required: true
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ApiUpdateResourceInAppInput'
responses:
'200':
description: ''
content:
application/json:
schema:
title: ApiOkResponse-updateResourcesInApp
type: object
required:
- result
description: Resources successfully updated in app
properties:
result:
$ref: '#/components/schemas/ApiApp'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/signing-keys:
post:
operationId: createClientTokenSigningKey
summary: Create signing key
description: 'Create a new signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
parameters: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateTokenSigningKeyInput'
responses:
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'409':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/IdentifierIsTakenHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
get:
operationId: getClientTokenSigningKeys
summary: Get all token signing keys
description: 'Retrieves a list of token signing keys for an application. <br><br>**Required permissions**: `apps:read`, `[appId]:read`.'
parameters: []
responses:
'200':
description: ''
content:
application/json:
schema:
items:
anyOf:
- $ref: '#/components/schemas/ApiTokenSigningKey'
type: array
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/signing-keys/upload:
post:
operationId: uploadClientTokenSigningKey
summary: Upload signing key
description: 'Upload a new signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
parameters: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UploadTokenSigningKey'
responses:
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
'409':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/IdentifierIsTakenHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
/v1/applications/signing-keys/{id}:
put:
operationId: updateTokenSigningKey
summary: Update a signing key
description: 'Update a signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
parameters:
- name: id
required: true
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateTokenSigningKey'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/ApiTokenSigningKey'
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
delete:
operationId: deleteClientTokenSigningKey
summary: Delete signing key
description: 'Delete a signing key. <br><br>**Required permissions**: `apps:delete`, `[appId]:delete`, `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
parameters:
- name: id
required: true
in: path
description: ID of the signing key to delete
schema:
type: string
responses:
'204':
description: ''
'400':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestHttpError'
security:
- ClientAccessToken: []
tags:
- Applications
components:
schemas:
RolesAndRoleGroupsDto:
type: object
properties:
role_groups:
description: Role groups
type: array
items:
$ref: '#/components/schemas/ApiRoleGroup'
default_organization_roles:
description: Default organization roles
type: array
items:
$ref: '#/components/schemas/ApiRole'
roles:
description: Assigned roles
type: array
items:
$ref: '#/components/schemas/ApiRole'
required:
- role_groups
- default_organization_roles
- roles
MessageConfiguration:
type: object
properties:
primaryColor:
type: string
description: Primary color of the email, specified as a Hex color
from:
type: string
description: Origin of the email message
subject:
type: string
description: Subject of the email message
required:
- primaryColor
ApiCreateOidcClientInput:
type: object
properties:
name:
type: string
description: Name of the client
example: My Client
description:
type: string
description: Short description of the client
resources:
description: List of resources IDs associated with this client
type: array
items:
type: string
authentication_protocol:
type: string
enum:
- oidc
- saml
description: Authentication protocol used by the client
default: oidc
client_group_id:
type: string
description: Id of client group to associate with
default_custom_claims:
type: array
description: List of client default custom claims
items:
type: string
enum:
- tid
- fname
- lname
- mname
- email
- email_verified
- phone_number
- phone_number_verified
- groups
- new_user
- birthday
- language
- city
- address
- country
- street_address
- address_type
- webauthn
- roles
- ts_roles
- role_values
- ts_permissions
- permissions
- approval_data
- custom_group_data
- username
- secondary_phone_numbers
- secondary_emails
- picture
- created_at
- last_auth
- auth_time
- external_account_id
- external_user_id
- app_name
- custom_data
- custom_app_data
- ai_actor
default_user_info_claims:
type: array
description: List of client default custom claims returned by the UserInfo endpoint. Mutually exclusive with sync_id_token_claims_to_userinfo=true in the same request.
items:
type: string
enum:
- tid
- fname
- lname
- mname
- email
- email_verified
- phone_number
- phone_number_verified
- groups
- new_user
- birthday
- language
- city
- address
- country
- street_address
- address_type
- webauthn
- roles
- ts_roles
- role_values
- ts_permissions
- permissions
- approval_data
- custom_group_data
- username
- secondary_phone_numbers
- secondary_emails
- picture
- created_at
- last_auth
- auth_time
- external_account_id
- external_user_id
- app_name
- custom_data
- custom_app_data
- ai_actor
sync_id_token_claims_to_userinfo:
type: boolean
description: When true, UserInfo custom claims are kept in sync with default_custom_claims (the ID Token list). Mutually exclusive with explicit default_user_info_claims in the same request.
default: false
short_cookies_samesite_type:
type: string
enum:
- lax
- none
description: 'Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"'
default: lax
redirect_uris:
description: List of URIs approved for redirects for your client
example:
- https://www.example.com/login
type: array
items:
type: string
client_type:
type: string
enum:
- web
- native
description: Client type
default: web
device_authorization:
description: Configuration for an [OAuth Device Authorization Flow](https://www.rfc-editor.org/rfc/rfc8628)
allOf:
- $ref: '#/components/schemas/ApiDeviceAuthConfiguration'
ciba_authorization:
description: CIBA authorization flow configuration
allOf:
- $ref: '#/components/schemas/ApiCibaAuthConfiguration'
is_third_party:
type: boolean
description: Is third party client
allowed_scopes:
description: Allowed scopes
type: array
items:
# --- truncated at 32 KB (117 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/transmit-security/refs/heads/main/openapi/transmit-security-applications-api-openapi.yml