Transmit Security Applications API

openapi: 3.2.0
info:
  version: '1.0'
  title: One-Time Login Applications API
  description: Login users using one-time login methods like magic links or OTPs. This implements a backend-to-backend integration for authentication.
servers:
- url: https://api.sbx.transmitsecurity.io/cis
  description: Sandbox environment
- url: https://api.transmitsecurity.io/cis
  description: Production environment (US)
- url: https://api.eu.transmitsecurity.io/cis
  description: Production environment (EU)
- url: https://api.ca.transmitsecurity.io/cis
  description: Production environment (CA)
- url: https://api.au.transmitsecurity.io/cis
  description: Production environment (AU)
security: []
tags:
- name: Applications
paths:
  /v1/applications/{app_id}/organizations/{organization_id}/role-groups/set:
    post:
      operationId: setAssignedRoleGroups
      summary: Set org's role groups
      description: 'Update the role groups of the organization for a specific application, which will replace any existing role groups for the organization. These role groups must first be created for the application. Once added to the organization, roles that belong to these role groups can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:edit`, `orgs:edit`.'
      parameters:
      - name: app_id
        required: true
        in: path
        description: ID of the application to set the roles to
        schema:
          type: string
      - name: organization_id
        required: true
        in: path
        description: ID of the organization to set the roles to
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiRoleGroupIds'
      responses:
        '202':
          description: ''
      security:
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{app_id}/organizations/{organization_id}/role-groups:
    get:
      operationId: getAssignedRoleGroups
      summary: Get org's role groups
      description: 'Retrieves all role groups that were added to the organization for a specific application. Roles that belong to these role groups can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:read`, `orgs:read`.'
      parameters:
      - name: app_id
        required: true
        in: path
        description: ID of the application to assign the roles to
        schema:
          type: string
      - name: organization_id
        required: true
        in: path
        description: ID of the organization to assign the roles to
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-getAssignedRoleGroups
                type: object
                required:
                - result
                description: ''
                properties:
                  result:
                    $ref: '#/components/schemas/RoleGroupsAndDefaultOrgRolesDto'
      security:
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{app_id}/organizations/{organization_id}/roles-and-groups/set:
    post:
      operationId: setAssignedRolesAndGroups
      summary: Set org's roles and role groups
      description: 'Update the roles and role groups of the organization for a specific application, which will replace any existing assignments. These roles and role groups must first be created for the application. Once added to the organization, roles that belong to these role groups or are directly assigned can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:edit`, `orgs:edit`.'
      parameters:
      - name: app_id
        required: true
        in: path
        description: ID of the application
        schema:
          type: string
      - name: organization_id
        required: true
        in: path
        description: ID of the organization
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RolesAndRoleGroupsInputDto'
      responses:
        '202':
          description: ''
      security:
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{app_id}/organizations/{organization_id}/roles-and-groups:
    get:
      operationId: getAssignedRolesAndGroups
      summary: Get org's roles and role groups
      description: 'Retrieves all roles and role groups that were added to the organization for a specific application. Roles that belong to these role groups or are directly assigned can be assigned to members of the organization to control their access to the application. <br><br>**Required permissions**: `organizations:read`, `orgs:read`.'
      parameters:
      - name: app_id
        required: true
        in: path
        description: ID of the application
        schema:
          type: string
      - name: organization_id
        required: true
        in: path
        description: ID of the organization
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-getAssignedRolesAndGroups
                type: object
                required:
                - result
                description: ''
                properties:
                  result:
                    $ref: '#/components/schemas/RolesAndRoleGroupsDto'
      security:
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{appId}/clients:
    post:
      operationId: createAppClient
      summary: Create client
      description: 'Create a new client. <br><br>**Required permissions**: `apps:create`, `apps:edit`.'
      parameters:
      - name: appId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/ApiCreateOidcClientInput'
              - $ref: '#/components/schemas/ApiCreateSamlClientInput'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/ApiOidcClient'
                - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentifierIsTakenHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
    get:
      operationId: getAppClients
      summary: Get all clients
      description: 'Retrieves a list of clients for an application. <br><br>**Required permissions**: `apps:read`.'
      parameters:
      - name: appId
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                items:
                  anyOf:
                  - $ref: '#/components/schemas/ApiOidcClient'
                  - $ref: '#/components/schemas/ApiSamlClient'
                type: array
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
    delete:
      operationId: deleteAppClients
      summary: Delete all clients
      description: Deletes all clients for an application.
      parameters:
      - name: appId
        required: true
        in: path
        schema:
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{appId}/clients/{clientId}:
    get:
      operationId: getAppClientById
      summary: Get client by ID
      description: 'Retrieves a client by client ID. <br><br>**Required permissions**: `apps:read`.'
      parameters:
      - name: clientId
        required: true
        in: path
        description: ID of the client to retrieve
        schema:
          type: string
      - name: appId
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/ApiOidcClient'
                - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
    put:
      operationId: updateAppClient
      summary: Update client
      description: 'Update a client. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `apps:edit`, `apps:create`.'
      parameters:
      - name: clientId
        required: true
        in: path
        description: ID of the client to update
        schema:
          type: string
      - name: appId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/ApiUpdateOidcClientInput'
              - $ref: '#/components/schemas/ApiUpdateSamlClientInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/ApiOidcClient'
                - $ref: '#/components/schemas/ApiSamlClient'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
    delete:
      operationId: deleteAppClient
      summary: Delete client
      description: 'Delete a client. <br><br>**Required permissions**: `apps:delete`, `apps:create`, `apps:edit`.'
      parameters:
      - name: clientId
        required: true
        in: path
        description: ID of the client to delete
        schema:
          type: string
      - name: appId
        required: true
        in: path
        schema:
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications/{appId}/clients/{clientId}/resources:
    put:
      operationId: updateAppClientResources
      summary: Update client resources
      description: Update the list of resources that a client is allowed to explicitly request access to
      parameters:
      - name: clientId
        required: true
        in: path
        schema:
          type: string
      - name: appId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiUpdateResourceInAppInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/ApiOidcClient'
                - $ref: '#/components/schemas/ApiSamlClient'
      security:
      - ClientAccessToken: []
      - AdminAccessToken: []
      tags:
      - Applications
  /v1/applications:
    post:
      operationId: createApp
      summary: Create app
      description: 'Create a new application with a default client. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:create`, `[appId]:create`.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiCreateAppInput'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                title: ApiCreatedResponse-createApp
                type: object
                required:
                - result
                description: App successfully created
                properties:
                  result:
                    $ref: '#/components/schemas/ApiApp'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentifierIsTakenHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
    get:
      operationId: getAllApps
      summary: Get all apps
      description: 'Retrieves a list of all applications with their default clients. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:read`, `apps:list`, `[appId]:read`, `[appId]:list`.'
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-getAllApps
                type: object
                required:
                - result
                description: Successfully fetched apps
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiAppWithoutLogo'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/list:
    get:
      operationId: getAppsList
      summary: Get all apps basic information
      description: 'Retrieves a list of all applications with their basic information. <br><br>**Required permissions**: `apps:list`, `users:read`, `organizations:read`, `roles:read`, `orgs:read`, `[appId]:list`.'
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-getAppsList
                type: object
                required:
                - result
                description: Successfully fetched apps
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiBasicApp'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/{appId}:
    get:
      operationId: getAppById
      summary: Get app by ID
      description: 'Retrieves an application by application ID with the default client. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. <br><br>**Required permissions**: `apps:read`, `[appId]:read`.'
      parameters:
      - name: appId
        required: true
        in: path
        description: ID of the application to retrieve
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-getAppById
                type: object
                required:
                - result
                description: Successfully fetched app
                properties:
                  result:
                    $ref: '#/components/schemas/ApiApp'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
    put:
      operationId: updateApp
      summary: Update app
      description: 'Updates an application. The fields marked as deprecated are now managed on the client level. To update a default client, create additional clients, or fetch all app clients, use `/clients` or `applications/{appId}/clients` endpoints. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `apps:edit`, `[appId]:edit`.'
      parameters:
      - name: appId
        required: true
        in: path
        description: ID of the application to update
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiUpdateAppInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-updateApp
                type: object
                required:
                - result
                description: App successfully updated
                properties:
                  result:
                    $ref: '#/components/schemas/ApiApp'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
    delete:
      operationId: deleteApp
      summary: Delete app
      description: 'Delete an application. <br><br>**Required permissions**: `apps:delete`, `[appId]:delete`.'
      parameters:
      - name: appId
        required: true
        in: path
        description: ID of the application to delete
        schema:
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/{appId}/resources:
    put:
      operationId: updateResourcesInApp
      summary: Update app resources
      description: Update the list of resources that a default client of the application is allowed to explicitly request access to
      deprecated: true
      parameters:
      - name: appId
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiUpdateResourceInAppInput'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                title: ApiOkResponse-updateResourcesInApp
                type: object
                required:
                - result
                description: Resources successfully updated in app
                properties:
                  result:
                    $ref: '#/components/schemas/ApiApp'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/signing-keys:
    post:
      operationId: createClientTokenSigningKey
      summary: Create signing key
      description: 'Create a new signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTokenSigningKeyInput'
      responses:
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentifierIsTakenHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
    get:
      operationId: getClientTokenSigningKeys
      summary: Get all token signing keys
      description: 'Retrieves a list of token signing keys for an application. <br><br>**Required permissions**: `apps:read`, `[appId]:read`.'
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                items:
                  anyOf:
                  - $ref: '#/components/schemas/ApiTokenSigningKey'
                type: array
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/signing-keys/upload:
    post:
      operationId: uploadClientTokenSigningKey
      summary: Upload signing key
      description: 'Upload a new signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UploadTokenSigningKey'
      responses:
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentifierIsTakenHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
  /v1/applications/signing-keys/{id}:
    put:
      operationId: updateTokenSigningKey
      summary: Update a signing key
      description: 'Update a signing key. <br><br>**Required permissions**: `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
      parameters:
      - name: id
        required: true
        in: path
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTokenSigningKey'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiTokenSigningKey'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
    delete:
      operationId: deleteClientTokenSigningKey
      summary: Delete signing key
      description: 'Delete a signing key. <br><br>**Required permissions**: `apps:delete`, `[appId]:delete`, `apps:create`, `[appId]:create`, `apps:edit`, `[appId]:edit`.'
      parameters:
      - name: id
        required: true
        in: path
        description: ID of the signing key to delete
        schema:
          type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestHttpError'
      security:
      - ClientAccessToken: []
      tags:
      - Applications
components:
  schemas:
    ApiAuthenticatorAppPreferences:
      type: object
      properties:
        is_centralized:
          type: boolean
          description: Indicates whether to set the application as the Authentication Hub for this tenant
          default: false
        login_uri:
          type: string
          description: URI of the application that will initiate an authentication flow when centralized login is requested
          example: https://www.example.com/login
      required:
      - is_centralized
      - login_uri
    TotpConfiguration:
      type: object
      properties:
        failuresExpireIn:
          type: number
          description: Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
          default: 15
          example: 15
          minimum: 1
          maximum: 525600
        lockoutTiers:
          description: Progressive lockout tiers based on failed attempts
          type: array
          items:
            $ref: '#/components/schemas/LockoutTier'
        algorithm:
          type: string
          enum:
          - sha1
          - sha256
          - sha512
          description: The algorithm used to generate the TOTP code
          default: sha1
        digits:
          type: number
          description: Number of digits in the generated TOTP code, must be 6 or 8
          example: 6
          default: 6
        period:
          type: number
          description: Number of seconds in which the TOTP code is valid
          example: 30
          default: 30
        window:
          type: number
          description: Number of windows to check for valid TOTP codes
          example: 2
          default: 1
        issuer:
          type: string
          description: TOTP issuer
          example: My Company
        maxFailures:
          type: number
          description: Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
          example: 3
          default: 5
          deprecated: true
        lockoutDuration:
          type: number
          description: TOTP lockout duration (in minutes) after maximum attempts are reached
          example: 15
          default: 15
          deprecated: true
        maxTotpPerUser:
          type: number
          description: Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
          example: 1
          default: 1
    ApiIdTokenEncryptionConfiguration:
      type: object
      properties:
        enabled:
          type: boolean
          description: Determines if ID token encryption is enabled for the client
          default: false
        jwks:
          type: object
          description: A set of JWK keys containing the public keys for the client to use for ID token encryption
      required:
      - enabled
    MessageConfiguration:
      type: object
      properties:
        primaryColor:
          type: string
          description: Primary color of the email, specified as a Hex color
        from:
          type: string
          description: Origin of the email message
        subject:
          type: string
          description: Subject of the email message
      required:
      - primaryColor
    EmailConfiguration:
      type: object
      properties:
        expiresIn:
          type: number
          description: Number of minutes until the email link/code expires
        linksPerUser:
          type: number
          description: Allowed magic links to send a user per minute
        message:
          $ref: '#/components/schemas/MessageConfiguration'
      required:
      - expiresIn
      - linksPerUser
      - message
    LockoutTier:
      type: object
      properties:
        attempts:
          type: number
          description: Number of failed attempts before this tier is triggered
          example: 3
          minimum: 1
        duration:
          type: number
          description: Lockout duration in minutes for this tier
          example: 15
          minimum: 1
          maximum: 525600
      required:
      - attempts
      - duration
    NotFoundHttpError:
      type: object
      properties:
        message:
          type: string
        error_code:
          type: number
          example: 404
      required:
      - message
      - error_code
    PinAuthenticatorConfiguration:
      type: object
      properties:
        failuresExpireIn:
          type: number
          description: Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
          default: 15
          example: 15
          minimum: 1
          maximum: 525600
        lockoutTiers:
          description: Progressive lockout tiers based on failed attempts
          type: array
          items:
            $ref: '#/components/schemas/LockoutTier'
        maxFailures:
          type: number
          description: Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
          example: 3
          default: 5
          deprecated: true
        lockoutDuration:
          type: number
          description: PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
          example: 15
          default: 15
          deprecated: true
    ApiCreateSamlClientInput:
      type: object
      properties:
        name:
          type: string
          description: Name of the client
          example: My Client
        description:
          type: string
          description: Short 

# --- truncated at 32 KB (117 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/transmit-security/refs/heads/main/openapi/transmit-security-applications-api-openapi.yml