Optional stackStatic Optional prepareOptionalclientOptional clientOptional clientProtected configurationOptional useMTLSProtected requestOptional Returns Promise<Response>OptionalclientOptional clientOptional clientProtected configurationOptional useMTLSProtected requestOptional Returns Promise<Response>OptionalclientOptional clientOptional clientProtected configurationOptional useMTLSProtected requestOptional Returns Promise<Response>Optional Returns FetchErrorOptional stackReadonly statusReadonly statusOptional Returns RequiredErrorOptional stackOptional Returns ResponseErrorOptional stackStatic Optional prepareReadonly statusReadonly statusOptional stackReadonly statusReadonly statusProtectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Optional initOverrides: InitOverrideProtectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Optional initOverrides: InitOverrideProtectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Optional stackStatic Optional prepareReadonlyactions: ActionsManager = ...Readonly anomalyReadonly attackReadonly blacklistsReadonly brandingReadonly clientReadonly clientsProtected configurationReadonly connectionsReadonly customReadonly deviceReadonly emailReadonly emailsReadonly grantsReadonly guardianReadonly hooksReadonly jobsReadonly keysReadonly logReadonly logsReadonly organizationsReadonly promptsReadonly resourceReadonly rolesReadonly rulesReadonly rulesReadonly statsReadonly tenantsReadonly ticketsReadonly userReadonly usersReadonly usersReadonly actionsReadonly anomalyReadonly attackReadonly blacklistsReadonly brandingReadonly clientReadonly clientsProtected configurationReadonly connectionsReadonly customReadonly deviceReadonly emailReadonly emailsReadonly grantsReadonly guardianReadonly hooksReadonly jobsReadonly keysReadonly logReadonly logsReadonly organizationsReadonly promptsReadonly resourceReadonly rolesReadonly rulesReadonly rulesReadonly statsReadonly tenantsReadonly ticketsReadonly userReadonly usersReadonly usersProtectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Optional initOverrides: InitOverrideOptional initOverrides: InitOverrideProtectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideOptional Optional initOverrides: InitOverrideProtected requestOptional Returns Promise<Response>Protectedconfiguration: ConfigurationProtected requestOptional Returns Promise<Response>Optional stackStatic Optional prepareOptionalOptional clientOptional clientOptional clientOptional clientOptional clockOptional fetchOptionalOptional headersOptionalOptional idOptional retryOptionalOptional telemetryOptional timeoutOptionalOptional useMTLSOptional initOptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalOptional redirect_This is required only if it was set at the /authorize endpoint. The values must match.
OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalInherited from AuthorizationCodeGrantRequest.code
Cryptographically random key that was used to generate the code_challenge passed to /authorize.
Optional redirect_OptionalOptionalclientId
The name of the database configured to your client.
The user's email address.
Optional organizationThe organization_id of the Organization associated with the user.
OptionalclientAssertionSigningKey.
Optional client_Optionalclient_assertion_type.
Optional client_Specify this to override the parent class's clientId
Optional client_Specify this to override the parent class's clientSecret
The unique identifier of the target API you want to access.
Optional client_OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalOptionalSpecify this to override the parent class's clientId
The device code previously returned from the /oauth/device/code endpoint.
Optional initOptional nonceOptional organizationOptionalAPI Identifier of the API for which you want to get an Access Token.
Optional client_OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalThe user's verification code.
The user's email address.
Optional scopeUse openid to get an ID Token, or openid profile email to also include user profile information in the ID Token.
OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalInherited from Omit.code
The user's phone number.
Optional scopeOptionalOptionalThe unique identifier of the target API you want to access.
Optional client_OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalResource Owner's secret.
Optional realmOptionalhttps://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow#realm-support.
Optional scopeString value of the different scopes the application is asking for. Multiple scopes are separated with whitespace.
Resource Owner's identifier, such as a username or email address.
OptionalThe unique identifier of the target API you want to access.
Optional authorization_A JSON stringified array of objects. It can carry fine-grained authorization data in OAuth messages as part of Rich Authorization Requests (RAR) Reference
Optional client_OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalOptional code_A Base64-encoded SHA-256 hash of the code_verifier used for the Authorization Code Flow with PKCE.
Optional connectionName of the connection.
Optional invitationThe id of an invitation to accept.
Optional nonceThe nonce.
Optional organizationThe organization to log the user in to.
URI to redirect to.
Optional requestAllows JWT-Secured Authorization Request (JAR), when JAR & PAR request are used together. Reference
Optional response_The response_mode to use.
The response_type the client expects.
Optional scopeScopes to request. Multiple scopes must be separated by a space character.
Optional stateState value to be passed back on successful authorization.
This URI is a single-use reference to the respective request data in the subsequent authorization request.
OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalThe Refresh Token to use.
Optional scopeOptional
OptionalOptional client_OptionalOptional client_OptionalOptional client_OptionalThe Refresh Token you want to revoke.
The user's email address
Optional sendOptionallink will be sent.
Optional
The user's email address
Optional sendOptionallink will be sent.
The users phone number.
OptionalclientId
The name of the database configured to your client.
The user's email address.
Optional family_The user's family name(s).
Optional given_The user's given name(s).
Optional nameThe user's full name.
Optional nicknameThe user's nickname.
The user's desired password.
Optional pictureA URI pointing to the user's picture.
Optional user_Optional usernameThe user's username. Only valid if the connection requires a username.
Email address of the new user.
Indicates whether the email has been verified or not.
Optional family_The user's family name(s).
Optional given_The user's given name(s).
Optional nameThe user's full name.
Optional nicknameThe user's nickname.
Optional pictureA URI pointing to the user's picture.
Optional user_Optional usernameUsername of this user.
OptionalThe unique identifier of the target API you want to access.
Optional client_Specify this to override the parent class's clientId
Optional scopeOptional
Externally-issued identity artifact, representing the user.
The access token.
The duration in secs that the access token is valid.
Optional id_The user's ID Token.
Optional refresh_The refresh token, available with the offline_access scope.
The token type of the access token.
OptionalOptional clientOptional fetchOptionalOptional headersOptionalOptional retryOptionalOptional telemetryOptional timeoutOptionalOptionalPass your own http agent to support proxies.
Optional fetchProvide your own fetch implementation.
Optional headersCustom headers that will be added to every request.
Optional middlewareProvide a middleware that will run either before the request, after the request or when the request fails.
Optional retryRetry configuration.
Optional timeoutTimeout in ms before aborting the request (default 10,000)
Optional responseOptional postOptional preOptional headersOptional queryOptional
Optional maxOptional
Optional retryOptional
OptionalTrue if the draft of the action should be updated with the reverted version.
List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
Type of client used to determine which settings are applicable. Can be spa, native, non_interactive, or regular_web.
Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
List of audiences/realms for SAML protocol. Used by the wsfed addon.
ID of this client.
Client secret (which you must not make public).
Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
The content (HTML, CSS, JS) of the custom login page.
Whether a custom login page is to be used (true) or the default provided login page (false).
The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
Free text description of this client (max length: 140 characters).
HTML form template to be used for WS-Federation.
Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).
List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, and urn:ietf:params:oauth:grant-type:device_code.
Initiate login uri, must be https
Whether this client a first party client (true) or not (false).
URL of the logo to display for this client. Recommended size is 150x150 pixels.
Name of this client (min length: 1 character, does not allow < or >).
Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false).
Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.
Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require.
Signing certificates associated with this client.
Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
Whether Single Sign On is disabled (true) or enabled (true). Defaults to true.
Name of the tenant this client belongs to.
Defines the requested authentication method for the token endpoint. Can be none (public client without a client secret), client_secret_post (client uses HTTP POST parameters), or client_secret_basic (client uses HTTP Basic).
Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
Okta Access Gateway SSO configuration
AWS token lifetime in seconds
AWS principal ARN, e.g. arn:aws:iam::010616021751:saml-provider/idpname
AWS role ARN, e.g. arn:aws:iam::010616021751:role/foo
Entity to request a token for. e.g. my-blob. If blank the computed SAS will apply to the entire storage container.
Indicates if the issued token has permission to delete the blob.
Indicates if the issued token has permission to read the content, properties, metadata and block list. Use the blob as the source of a copy operation.
Indicates if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
Container to request a token for. e.g. my-container.
Indicates if issued token has permission to delete any blob in the container.
Indicates if the issued token has permission to list blobs in the container.
Indicates if the issued token has permission to read the content, properties, metadata or block list of any blob in the container. Use any blob in the container as the source of a copy operation
Indicates that for any blob in the container if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
Expiration in minutes for the generated token (default of 5 minutes).
Shared access policy identifier defined in your storage account resource.
Access key associated with this storage account.
Entity you want to request a token for. e.g. my-queue.'
Optional expiration in minutes for the generated token. Defaults to 5 minutes.
Your Azure Service Bus namespace. Usually the first segment of your Service Bus URL (e.g. https://acme-org.servicebus.windows.net would be acme-org).
Primary Key associated with your shared access policy.
Your shared access policy name defined in your Service Bus entity.
Your custom domain found in your Egnyte URL. e.g. https://acme-org.egnyte.com would be acme-org.
ID of the Service Account you have created (shown as client_email in the generated JSON file, SDK v3+ tokens only).
Optional expiration in seconds for the generated token. Defaults to 3600 seconds (SDK v3+ tokens only).
Private Key for signing the token (SDK v3+ tokens only).
Optional ID of the private key to obtain kid header in the issued token (SDK v3+ tokens only).
Google Firebase Secret. (SDK 2 only).
OptionalOptional expiration in minutes for the generated token. Defaults to 5 minutes.
Authentication Key identifier used to sign the Layer token.
Optional principalName of the property used as the unique user id in Layer. If not specified user_id is used.
Private key for signing the Layer token.
Provider ID of your Layer account
Microsoft Dynamics CRM application URL.
Optional Auth0 database connection for testing an already-configured Office 365 tenant.
Your Office 365 domain name. e.g. acme-org.com.
Arbitrary logical URL that identifies the Saleforce resource. e.g. https://acme-org.com.
Consumer Key assigned by Salesforce to the Connected App.
Community name.
Community url section.
Name of the property in the user object that maps to a Salesforce username. e.g. email.
Consumer Key assigned by Salesforce to the Connected App.
Community name.
Community url section.
Name of the property in the user object that maps to a Salesforce username. e.g. email.
NameID element of the Subject which can be used to express the user's identity. Defaults to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.
Requested scope for SAP APIs.
Service account password to use to authenticate API calls to the token endpoint.
Your SAP OData server OAuth2 token endpoint URL.
Name of the property in the user object that maps to a SAP username. e.g. email.
URL prefix only if running Sentry Community Edition, otherwise leave should be blank.
Generated slug for your Sentry organization. Found in your Sentry URL. e.g. https://sentry.acme.com/acme-org/ would be acme-org.
Internal SharePoint application URL.
Slack team name.
SpringCM ACS URL, e.g. https://na11.springcm.com/atlas/sso/SSOEndpoint.ashx.
SSO integration name
SSO integration version installed
Your master key for Windows Azure Mobile Services.
Zendesk account name usually first segment in your Zendesk URL. e.g. https://acme-org.zendesk.com would be acme-org.
A list of unique and previously created credential IDs enabled on the client for Private Key JWT authentication.
Credential ID
Optional allowed_List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.
Optional allowed_Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
Optional allowed_Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
Optional app_Type of client used to determine which settings are applicable. Can be spa, native, non_interactive, or regular_web.
Optional callbacksComma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.
Optional client_List of audiences/realms for SAML protocol. Used by the wsfed addon.
Optional client_Optional client_Optional cross_Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).
Optional cross_URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
Optional custom_The content (HTML, CSS, JS) of the custom login page.
Optional custom_true if the custom login page is to be used, false otherwise. Defaults to true
Optional custom_The content (HTML, CSS, JS) of the custom login page. (Used on Previews)
Optional descriptionFree text description of this client (max length: 140 characters).
Optional encryption_Optional form_HTML form template to be used for WS-Federation.
Optional grant_List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, and urn:ietf:params:oauth:grant-type:device_code.
Optional initiate_Initiate login uri, must be https
Optional is_Whether this client a first party client or not
Optional jwt_Optional logo_URL of the logo to display for this client. Recommended size is 150x150 pixels.
Optional mobileName of this client (min length: 1 character, does not allow < or >).
Optional native_Optional oidc_Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false).
Optional oidc_Optional organization_Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.
Optional organization_Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require.
Optional refresh_Optional ssoApplies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).
Optional sso_true to disable Single Sign On, false otherwise (default: false)
Optional token_Defines the requested authentication method for the token endpoint. Can be none (public client without a client secret), client_secret_post (client uses HTTP POST parameters), or client_secret_basic (client uses HTTP Basic).
Optional web_Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
Optional azure_Optional azure_Optional boxOptional cloudbeesOptional concurOptional dropboxOptional echosignOptional egnyteOptional firebaseOptional layerOptional mscrmOptional newrelicOptional oagOkta Access Gateway SSO configuration
Optional office365Optional rmsOptional salesforceOptional salesforce_Optional salesforce_Optional samlpOptional sap_Optional sentryOptional sharepointOptional slackOptional springcmOptional sso_Optional wamsOptional wsfedOptional zendeskOptional zoomOptionalAWS token lifetime in seconds
Optional principalAWS principal ARN, e.g. arn:aws:iam::010616021751:saml-provider/idpname
Optional roleAWS role ARN, e.g. arn:aws:iam::010616021751:role/foo
OptionalYour Azure storage account name. Usually first segment in your Azure storage URL. e.g. https://acme-org.blob.core.windows.net would be the account name acme-org.
Optional blobEntity to request a token for. e.g. my-blob. If blank the computed SAS will apply to the entire storage container.
Optional blob_Indicates if the issued token has permission to delete the blob.
Optional blob_Indicates if the issued token has permission to read the content, properties, metadata and block list. Use the blob as the source of a copy operation.
Optional blob_Indicates if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
Optional containerContainer to request a token for. e.g. my-container.
Optional container_Indicates if issued token has permission to delete any blob in the container.
Optional container_Indicates if the issued token has permission to list blobs in the container.
Optional container_Indicates if the issued token has permission to read the content, properties, metadata or block list of any blob in the container. Use any blob in the container as the source of a copy operation
Optional container_Indicates that for any blob in the container if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
Optional expirationExpiration in minutes for the generated token (default of 5 minutes).
Optional signedShared access policy identifier defined in your storage account resource.
Optional storageAccess key associated with this storage account.
OptionalEntity you want to request a token for. e.g. my-queue.'
Optional expirationOptional expiration in minutes for the generated token. Defaults to 5 minutes.
Optional namespaceYour Azure Service Bus namespace. Usually the first segment of your Service Bus URL (e.g. https://acme-org.servicebus.windows.net would be acme-org).
Optional sasPrimary Key associated with your shared access policy.
Optional sasYour shared access policy name defined in your Service Bus entity.
OptionalYour custom domain found in your EchoSign URL. e.g. https://acme-org.echosign.com would be acme-org.
OptionalYour custom domain found in your Egnyte URL. e.g. https://acme-org.egnyte.com would be acme-org.
OptionalID of the Service Account you have created (shown as client_email in the generated JSON file, SDK v3+ tokens only).
Optional lifetime_Optional expiration in seconds for the generated token. Defaults to 3600 seconds (SDK v3+ tokens only).
Optional private_Private Key for signing the token (SDK v3+ tokens only).
Optional private_Optional ID of the private key to obtain kid header in the issued token (SDK v3+ tokens only).
Optional secretGoogle Firebase Secret. (SDK 2 only).
OptionalYour New Relic Account ID found in your New Relic URL after the /accounts/ path. e.g. https://rpm.newrelic.com/accounts/123456/query would be 123456.
OptionalOptional Auth0 database connection for testing an already-configured Office 365 tenant.
Optional domainYour Office 365 domain name. e.g. acme-org.com.
OptionalArbitrary logical URL that identifies the Saleforce resource. e.g. https://acme-org.com.
OptionalConsumer Key assigned by Salesforce to the Connected App.
Optional communityCommunity name.
Optional community_Community url section.
Optional principalName of the property in the user object that maps to a Salesforce username. e.g. email.
OptionalConsumer Key assigned by Salesforce to the Connected App.
Optional communityCommunity name.
Optional community_Community url section.
Optional principalName of the property in the user object that maps to a Salesforce username. e.g. email.
Optional authnOptional createOptional destinationOptional digestOptional issuerOptional lifetimeOptional mapOptional mapOptional mappingsOptional nameOptional nameOptional passthroughOptional recipientOptional signOptional signatureOptionalIf activated in the OAuth 2.0 client configuration (transaction SOAUTH2) the SAML attribute client_id must be set and equal the client_id form parameter of the access token request.
Optional nameNameID element of the Subject which can be used to express the user's identity. Defaults to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.
Optional scopeRequested scope for SAP APIs.
Optional serviceService account password to use to authenticate API calls to the token endpoint.
Optional tokenYour SAP OData server OAuth2 token endpoint URL.
Optional usernameName of the property in the user object that maps to a SAP username. e.g. email.
OptionalURL prefix only if running Sentry Community Edition, otherwise leave should be blank.
Optional org_Generated slug for your Sentry organization. Found in your Sentry URL. e.g. https://sentry.acme.com/acme-org/ would be acme-org.
Optional urlInternal SharePoint application URL.
OptionalSpringCM ACS URL, e.g. https://na11.springcm.com/atlas/sso/SSOEndpoint.ashx.
OptionalSSO integration name
Optional versionSSO integration version installed
OptionalYour master key for Windows Azure Mobile Services.
OptionalZendesk account name usually first segment in your Zendesk URL. e.g. https://acme-org.zendesk.com would be acme-org.
OptionalZoom account name usually first segment of your Zoom URL, e.g. https://acme-org.zoom.us would be acme-org.
Fully defined credentials that will be enabled on the client for Private Key JWT authentication.
OptionalAlgorithm which will be used with the credential. Can be one of RS256, RS384, PS256. If not specified, RS256 will be used.
Credential type. Supported types: public_key.
Optional expires_The ISO 8601 formatted date representing the expiration of the credential. If not specified (not recommended), the credential never expires.
Optional nameFriendly name for a credential.
Optional parse_Parse expiry from x509 certificate. If true, attempts to parse the expiry date from the provided PEM.
PEM-formatted public key (SPKI and PKCS1) or X509 certificate. Must be JSON escaped.
OptionalEncryption certificate for public key in X.590 (.CER) format.
Optional pubEncryption Public RSA Key.
Optional subjectEncryption certificate name for this certificate in the format /CN={domain}.
OptionalAlgorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Optional lifetime_Number of seconds the JWT will be valid for (affects exp claim).
Optional scopesOptional iosOptionalApp package name found in AndroidManifest.xml.
Optional sha256_SHA256 fingerprints of the app's signing certificate. Multiple fingerprints can be used to support different versions of your app, such as debug and production builds.
OptionalAssigned by the developer to the app as its unique identifier inside the store, usually is a reverse domain plus the app name: com.you.MyApp
Optional team_Identifier assigned to the account that signs and upload the app to the store
Optional facebookOptionalDetermine whether or not to allow signing in natively using an Apple authorization code
OptionalDetermine whether or not to allow signing in natively using Facebook
Comma-separated list of URLs that are valid to call back from Auth0 for OIDC backchannel logout. Currently only one URL is allowed.
Encryption certificate for public key in X.590 (.CER) format.
Encryption Public RSA Key.
Encryption certificate name for this certificate in the format /CN={domain}.
The audience (API identifier) of this client grant.
ID of the client.
ID of the client grant.
Scopes allowed for this client grant.
The audience (API identifier) of this client grant
ID of the client.
Scopes allowed for this client grant.
Algorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Number of seconds the JWT will be valid for (affects exp claim).
Whether the client secret is base64 encoded (true) or unencoded (false).
App package name found in AndroidManifest.xml.
SHA256 fingerprints of the app's signing certificate. Multiple fingerprints can be used to support different versions of your app, such as debug and production builds.
Assigned by developer to the app as its unique identifier inside the store. Usually this is a reverse domain plus the app name, e.g. com.you.MyApp.
Identifier assigned to the Apple account that signs and uploads the app to the store.
Determine whether or not to allow signing in natively using an Apple authorization code
Determine whether or not to allow signing in natively using Facebook
Comma-separated list of URLs that are valid to call back from Auth0 for OIDC backchannel logout. Currently only one URL is allowed.
Refresh token expiration types, one of: expiring, non-expiring
Optional idle_Period (in seconds) for which refresh tokens will remain valid without use
Optional infinite_Prevents tokens from expiring without use when true (takes precedence over idle_token_lifetime values)
Optional infinite_Prevents tokens from having a set lifetime when true (takes precedence over token_lifetime values)
Optional leewayPeriod in seconds where the previous refresh token can be exchanged without triggering breach detection
Refresh token rotation types, one of: rotating, non-rotating
Optional token_Period (in seconds) for which refresh tokens will remain valid
Signing certificate public key in X.590 (.CER) format.
Signing certificate public key and chain in PKCS#7 (.P7B) format.
Subject name for this certificate in the format /CN={domain}.
Optional allowed_Ids of clients that will be allowed to perform delegation requests. Clients that will be allowed to make delegation request. By default, all your clients will be allowed. This field allows you to specify specific clients
Optional allowed_URLs that are valid to redirect to after logout from Auth0.
Optional allowed_A set of URLs that represents valid origins for CORS
Optional app_The type of application this client represents
Optional callbacksA set of URLs that are valid to call back from Auth0 when authenticating users
Optional client_List of audiences for SAML protocol
Optional client_Optional client_Optional client_The secret used to sign tokens for the client
Optional cross_true if this client can be used to make cross-origin authentication requests, false otherwise if cross origin is disabled
Optional cross_URL for the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.
Optional custom_The content (HTML, CSS, JS) of the custom login page
Optional custom_true if the custom login page is to be used, false otherwise.
Optional custom_Optional descriptionFree text description of the purpose of the Client. (Max character length: 140)
Optional encryption_Optional form_Form template for WS-Federation protocol
Optional grant_A set of grant types that the client is authorized to use
Optional initiate_Initiate login uri, must be https
Optional is_Whether this client a first party client or not
Optional jwt_Optional logo_The URL of the client logo (recommended size: 150x150)
Optional mobileOptional nameThe name of the client. Must contain at least one character. Does not allow '<' or '>'.
Optional native_Optional oidc_Whether this client will conform to strict OIDC specifications
Optional oidc_Optional organization_Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.
Optional organization_Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require.
Optional refresh_Optional ssotrue to use Auth0 instead of the IdP to do Single Sign On, false otherwise (default: false)
Optional sso_true to disable Single Sign On, false otherwise (default: false)
Optional token_Defines the requested authentication method for the token endpoint. Possible values are 'none' (public client without a client secret), 'client_secret_post' (client uses HTTP POST parameters) or 'client_secret_basic' (client uses HTTP Basic)
Optional web_A set of URLs that represents valid web origins for use with web message response mode
Optional azure_Optional azure_Optional boxOptional cloudbeesOptional concurOptional dropboxOptional echosignOptional egnyteOptional firebaseOptional layerOptional mscrmOptional newrelicOptional oagOkta Access Gateway SSO configuration
Optional office365Optional rmsOptional salesforceOptional salesforce_Optional salesforce_Optional samlpOptional sap_Optional sentryOptional sharepointOptional slackOptional springcmOptional sso_Optional wamsOptional wsfedOptional zendeskOptional zoomOptionalEncryption certificate
Optional pubEncryption public key
Optional subjectCertificate subject
OptionalAlgorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Optional lifetime_The amount of time (in seconds) that the token will be valid after being issued
Optional scopesOptional iosOptionalApplication package name found in AndroidManifest.xml
Optional sha256_The SHA256 fingerprints of your app's signing certificate. Multiple fingerprints can be used to support different versions of your app, such as debug and production builds
OptionalAssigned by the developer to the app as its unique identifier inside the store, usually is a reverse domain plus the app name: com.you.MyApp
Optional team_Identifier assigned to the account that signs and upload the app to the store
OptionalComma-separated list of URLs that are valid to call back from Auth0 for OIDC backchannel logout. Currently only one URL is allowed.
Connection name used in login screen
The connection's identifier
True if the connection is domain level
The name of the connection
Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.
The type of the connection, related to the identity provider
OptionalConnection name used in the new universal login experience
Optional enabled_The identifiers of the clients for which the connection is to be enabled. If the array is empty or the property is not specified, no clients are enabled
Optional is_Optional metadataThe name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128
Optional optionsOptional realmsDefines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.
The identity provider identifier for the connection
Optional authentication_Optional basic_Optional customOptional disable_Optional enable_Optional enabledSet to true to use a legacy user store
Optional ext_Optional ext_Optional ext_Optional ext_Optional ext_Optional ext_Optional gateway_Optional import_Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store
Optional non_An array of user fields that should not be stored in the Auth0 database (https://manage.local.dev.auth0.com/docs/security/data-security/denylist)
Optional passkey_Optional passwordPassword strength level
Optional password_Optional password_Optional password_Optional password_Optional set_Determines whether the 'name', 'given_name', 'family_name', 'nickname', and 'picture' attributes can be independently updated when using an external IdP. Possible values are 'on_each_login' (default value, it configures the connection to automatically update the root attributes from the external IdP with each user login. When this setting is used, root attributes cannot be independently updated), 'on_first_login' (configures the connection to only set the root attributes on first login, allowing them to be independently updated thereafter)
Optional upstream_Options for adding parameters in the request to the upstream IdP
Optional validationOptional passwordOptionalDetermines whether passkeys are enabled
OptionalDetermines whether passwords are enabled
Optional change_Optional createOptional get_Optional loginOptional verifyThe audience to be added to the JWT payload.
The Authorization header type.
The secret to be used for signing tokens.
Optional secret_Set to true if the provided secret is base64 encoded.
Optional subjectThe subject to be added to the JWT payload.
OptionalControls the UI used to challenge the user for their passkey.
Optional local_Enables or disables enrollment prompt for local passkey when user authenticates using a cross-device passkey for the connection.
Optional progressive_Enables or disables progressive enrollment of passkeys for the connection.
OptionalMinimum password length
OptionalCustom Password Dictionary. An array of up to 200 entries.
Optional sizeOptionalThe connection name used in the new universal login experience. If display_name is not included in the request, the field will be overwritten with the name value.
Optional enabled_The identifiers of the clients for which the connection is to be enabled. If the property is not specified, no clients are enabled. If the array is empty, the connection will be disabled for every client.
Optional is_Optional metadataOptional optionsOptional realmsDefines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.
Optional authentication_Optional basic_Optional customOptional disable_Optional enable_Optional enabledSet to true to use a legacy user store
Optional ext_Optional ext_Optional ext_Optional ext_Optional ext_Optional ext_Optional gateway_Optional import_Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store
Optional non_An array of user fields that should not be stored in the Auth0 database (https://manage.local.dev.auth0.com/docs/security/data-security/denylist)
Optional passkey_Optional passwordPassword strength level
Optional password_Optional password_Optional password_Optional password_Optional set_Determines whether the 'name', 'given_name', 'family_name', 'nickname', and 'picture' attributes can be independently updated when using an external IdP. Possible values are 'on_each_login' (default value, it configures the connection to automatically update the root attributes from the external IdP with each user login. When this setting is used, root attributes cannot be independently updated), 'on_first_login' (configures the connection to only set the root attributes on first login, allowing them to be independently updated thereafter)
Optional upstream_Options for adding parameters in the request to the upstream IdP
Optional validationOptionalThe HTTP header to fetch the client's IP address
ID of the custom domain.
Domain name.
Optional origin_Intermediate address.
Whether this is a primary domain (true) or not (false).
Custom domain configuration status. Can be disabled, pending, pending_verification, or ready.
Optional tls_The TLS version policy
Custom domain provisioning type. Can be auth0_managed_certs or self_managed_certs.
Optional verificationOptionalForce action deletion detaching bindings
The ID of the action to delete.
The ID of the authentication method to delete.
The ID of the user in question.
The ID of the user in question.
ID of the user to delete.
The ID of the theme
ID of the client grant to delete.
ID of the client to delete.
The id of the connection to delete
ID of the client.
ID of the credential to delete.
ID of the custom domain to delete.
ID of the credential to delete.
Connection identifier
Organization identifier
ID of the enrollment to be deleted.
ID of the grant to delete.
user_id of the grant to delete.
ID of the hook to delete.
Organization identifier
The id of the user invitation.
IP address to unblock.
The id of the log stream to delete
Organization identifier
List of user IDs to remove from the organization.
ID of the user to remove a multifactor configuration from.
The multi-factor provider. Supported values 'duo' or 'google-authenticator'
Organization identifier
User ID of the organization member to remove roles from.
List of roles IDs associated with the organization member to remove.
Organization identifier
ID of the user to remove permissions from.
List of permissions to remove from this user.
ID or the audience of the resource server to delete.
ID of the role to remove permissions from.
ID of the role to delete.
ID of the rule to delete.
Key of the rules config variable to delete.
ID of the hook whose secrets to delete.
The user_id of the user to update.
Should be any of a username, phone number, or email.
OptionalIDP access token returned only if scope read:user_idp_tokens is defined
Optional access_IDP access token secret returned only if scope read:user_idp_tokens is defined.
The name of the connection for the identity.
Optional istrue if the identity provider is a social provider, falses otherwise
Optional profileThe type of identity provider.
Optional refresh_IDP refresh token returned only if scope read:user_idp_tokens is defined.
The unique identifier for the user for the identity.
ID of the primary user account.
Identity provider name of the secondary linked account (e.g. google-oauth2).
ID of the secondary linked account (e.g. 123456789081523216417 part after the | in google-oauth2|123456789081523216417).
ID of the user to remove roles from.
List of roles IDs to remove from the user.
The email of the user to delete
The id of the connection (currently only database connections are supported)
ID of the user to delete.
Optionalclient_id of the client (application) this credential is for.
Optional device_Unique identifier for the device. NOTE: This field is generally not populated for refresh_tokens and rotating_refresh_tokens
Optional device_User agent for this device
Optional idID of this device.
Optional typeType of credential. Can be public_key, refresh_token, or rotating_refresh_token.
Optional user_user_id this credential is associated with.
Optionalclient_id of the client (application) this credential is for.
Unique identifier for the device. Recommend using Android_ID on Android and identifierForVendor.
Name for this device easily recognized by owner.
Type of credential. Must be public_key.
Base64 encoded string containing the credential.
Email address to use as "from" when no other address specified.
Whether the provider is enabled (true) or disabled (false).
Name of the email provider. Can be mailgun, mandrill, sendgrid, ses, sparkpost, smtp, azure_cs, or ms365.
Optional default_Email address to use as "from" when no other address specified.
Optional enabledWhether the provider is enabled (true) or disabled (false).
Name of the email provider. Can be mailgun, mandrill, sendgrid, ses, sparkpost, smtp, azure_cs, or ms365.
Optional settingsSpecific provider setting
API User.
AWS or SparkPost region.
SMTP host.
SMTP port.
SMTP username.
Optional default_Email address to use as "from" when no other address specified.
Optional enabledWhether the provider is enabled (true) or disabled (false).
Optional nameName of the email provider. Can be mailgun, mandrill, sendgrid, ses, sparkpost, smtp, azure_cs, or ms365.
Optional settingsSpecific provider setting
Body of the email template.
Whether the template is enabled (true) or disabled (false).
Senders from email address.
Optional includeWhether the reset_email and verify_email templates should include the user's email address as the email parameter in the returnUrl (true) or whether no email address should be included in the redirect (false). Defaults to true.
Optional resultURL to redirect the user to after a successful action.
Subject line of the email.
Syntax of the template body.
Template name. Can be verify_email, verify_email_by_code, reset_email, welcome_email, blocked_account, stolen_credentials, enrollment_email, mfa_oob_code, user_invitation, change_password (legacy), or password_reset (legacy).
Optional urlLifetime in seconds that the link within the email will be valid for.
ID for this enrollment.
Optional identifierDevice identifier. This is usually the phone identifier.
Optional last_Optional nameDevice name (only for push notification).
Optional phone_Phone number.
Optional statusStatus of this enrollment. Can be pending or confirmed.
Optionalalternate email to which the enrollment email will be sent. Optional - by default, the email will be sent to the user's default address
Optional send_Send an email to the user to start the enrollment
user_id for the enrollment ticket
Whether this factor is enabled (true) or disabled (false).
Optional nameFactor name. Can be sms, push-notification, email, duo otp webauthn-roaming, webauthn-platform, or recovery-code.
Optional trial_Whether trial limits have been exceeded.
The ID of the action to retrieve.
The ID of the action.
The ID of the action version.
Page index of the results being returned. First page is 0.
Number of results per page. Paging is disabled if parameter not sent.
The total result count.
The action to which this verison belongs.
The id of the action to which this version belongs.
The time when this version was built successfully.
The source code of this specific version of the action.
The time when this version was created.
The list of third party npm modules, and their versions, that this specific version depends on.
Indicates if this speciic version is the currently one deployed.
Any errors that occurred while the version was being built.
The unique id of an action version.
The index of this version in list of versions for the action.
The Node runtime. For example: node12
The list of secrets that are included in an action or a version of an action.
The build status of this specific version.
The list of triggers that this version supports. At this time, a version can only target a single trigger at a time.
The time when a version was updated. Versions are never updated externally. Only Auth0 will update an action version as it is beiing built.
The ID of the action.
Optional pageUse this field to request a specific page of the list results.
Optional per_This field specify the maximum number of results to be returned by the server. 20 by default
The list of actions.
Page index of the results being returned. First page is 0.
Number of results per page.
The total result count.
True if all of an Action's contents have been deployed.
The time when this action was built successfully.
The source code of the action.
The time when this action was created.
The list of third party npm modules, and their versions, that this action depends on.
The unique ID of the action.
installed_integration_id is the fk reference to the InstalledIntegration entity.
The name of an action.
The Node runtime. For example: node12, defaults to node12
The list of secrets that are included in an action or a version of an action.
The build status of this action.
The list of triggers that this action supports. At this time, an action can only target a single trigger at a time.
The time when this action was updated.
name is the name of the npm module, e.g. lodash
registry_url is an optional value used primarily for private npm registries.
description is the version of the npm module, e.g. 4.17.1
catalog_id refers to the ID in the marketplace catalog
feature_type is the type of the integration.
short_description is the brief description of the integration, which is used for display purposes in cards
url_slug refers to the url_slug in the marketplace catalog
The id of the associated IntegrationRelease
required_configuration declares all the necessary configuration fields for an integration to work.
The default value for this parameter.
The lengthier description for this parameter.
The short label for this parameter.
The name of the parameter.
The temp flag for if this parameter is required (experimental; for Labs use only).
The allowable options for this param.
Placeholder text for this parameter.
The flag for if this parameter is required.
The display value of an option suitable for displaying in a UI.
The value of an option that will be used within the application.
Major is the major number of a semver
Minior is the minior number of a semver
The name of the particular secret, e.g. API_KEY.
The time when the secret was last updated.
Optionalcompatible_triggers informs which other trigger supports the same event and api.
Optional default_Runtime that will be used when none is specified when creating an action.
Optional runtimesruntimes supported by this trigger.
Optional statusstatus points to the trigger status.
Optional versionThe version of a trigger. v1, v2, etc.
The version of a trigger. v1, v2, etc.
OptionalThe name of the action to retrieve.
Optional deployedOptional filter to only retrieve actions that are deployed.
Optional installedOptional. When true, return only installed actions. When false, return only custom actions. Returns all actions by default.
Optional pageUse this field to request a specific page of the list results.
Optional per_The maximum number of results to be returned by the server in single response. 20 by default
Optional triggerAn actions extensibility point. Acceptable values: post-login, credentials-exchange, pre-user-registration, post-user-registration, post-change-password, send-phone-message, password-reset-post-challenge
The paginated authentication methods. Returned in this structure when include_totals is true.
Maximum amount of records to return.
Index of the starting record. Derived from the page and per_page parameters.
Total number of pageable records.
Optional confirmedThe authentication method status
Authenticator creation date
Optional credential_Applies to passkeys only. Whether the credential was backed up.
Optional credential_Applies to passkeys only. The kind of device the credential is stored on as defined by backup eligibility. "single_device" credentials cannot be backed up and synced to another device, "multi_device" credentials can be backed up if enabled by the end-user.
Optional emailApplies to email and email-verification authentication methods only. The email address used to send verification messages.
Optional enrolled_Enrollment date
The ID of the authentication method (auto generated)
Optional identity_Applies to passkeys only. The ID of the user identity linked with the authentication method.
Optional key_Applies to webauthn authentication methods only. The ID of the generated credential.
Optional last_Last authentication
Optional link_The ID of a linked authentication method. Linked authentication methods will be deleted together.
Optional nameA human-readable label to identify the authentication method
Optional phone_Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice.
Optional preferred_The authentication method preferred for phone authenticators.
Optional public_Applies to webauthn authentication methods only. The public key.
Optional user_Applies to passkeys only. The user-agent of the browser used to create the passkey.
Optional typeThe ID of the authentication methods in question.
The ID of the user in question.
The ID of the user in question.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0. Default is 0.
Optional per_Number of results per page. Default is 50.
The list of actions that are bound to this trigger in the order in which they will be executed.
Page index of the results being returned. First page is 0.
Number of results per page.
The total result count.
The time when the binding was created.
The name of the binding.
The unique ID of this binding.
The time when the binding was updated.
OptionalUse this field to request a specific page of the list results.
Optional per_The maximum number of results to be returned in a single request. 20 by default
An actions extensibility point. Acceptable values: post-login, credentials-exchange, pre-user-registration, post-user-registration, post-change-password, send-phone-message, password-reset-post-challenge
URL for the favicon. Must use HTTPS.
URL for the logo. Must use HTTPS.
Accent color.
The ID of the theme
daily, weekly, monthly.
Whether or not breached password detection is active.
List of trusted IP addresses that will not have attack protection enforced against them.
Whether or not brute force attack protections are active.
Maximum number of unsuccessful attempts.
OptionalOptional filter on audience.
Optional client_Optional filter on client_id.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
ID of the client to retrieve.
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
OptionalOptional filter by a comma-separated list of application types.
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional is_Optional filter on whether or not a client is a first-party client.
Optional is_Optional filter on the global client parameter.
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Default value is 50, maximum value is 100
OptionalA comma separated list of fields to include or exclude (depending on include_fields) from the result, empty to retrieve all fields
The id of the connection to retrieve
Optional include_true if the fields specified are to be included in the result, false otherwise (defaults to true)
OptionalA comma separated list of fields to include or exclude (depending on include_fields) from the result, empty to retrieve all fields
Optional fromOptional Id from which to start selection.
Optional include_true if the fields specified are to be included in the result, false otherwise (defaults to true)
Optional include_true if a query summary must be included in the result, false otherwise. Not returned when using checkpoint pagination. Default false.
Optional nameProvide the name of the connection to retrieve
Optional pageThe page number. Zero based
Optional per_The amount of entries per page. Default: no paging is used, all connections are returned
Optional strategyProvide strategies to only retrieve connections with such strategies
Optional takeNumber of results per page. Defaults to 50.
Algorithm which will be used with the credential. Supported algorithms: RS256,RS384,PS256
The ISO 8601 formatted date the credential was created.
The type of credential. Supported types: public_key.
The ISO 8601 formatted date representing the expiration of the credential.
ID of the credential. Generated on creation.
The key identifier of the credential, generated on creation.
The name given to the credential by the user.
The ISO 8601 formatted date the credential was updated.
ID of the client.
ID of the credential.
ID of the client.
ID of the custom domain to retrieve.
Language to update.
Name of the prompt.
OptionalOptional first day of the date range (inclusive) in YYYYMMDD format.
Optional toOptional last day of the date range (inclusive) in YYYYMMDD format.
Optionalclient_id of the devices to retrieve.
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. There is a maximum of 1000 results allowed from this endpoint.
Optional typeType of credentials to retrieve. Must be public_key, refresh_token or rotating_refresh_token. The property will default to refresh_token when paging is requested
Optional user_user_id of the devices to retrieve.
Body of the email template.
Whether the template is enabled (true) or disabled (false).
Senders from email address.
Whether the reset_email and verify_email templates should include the user's email address as the email parameter in the returnUrl (true) or whether no email address should be included in the redirect (false). Defaults to true.
URL to redirect the user to after a successful action.
Subject line of the email.
Syntax of the template body.
Template name. Can be verify_email, verify_email_by_code, reset_email, welcome_email, blocked_account, stolen_credentials, enrollment_email, mfa_oob_code, user_invitation, change_password (legacy), or password_reset (legacy).
Lifetime in seconds that the link within the email will be valid for.
When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection.
ID of the connection.
Enables showing a button for the connection in the organization login page. If false, it will be usable only by HRD.
The name of the enabled connection.
The strategy of the enabled connection.
Connection identifier
Organization identifier
Organization identifier
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
ID of the enrollment to be retrieve.
ID of the user to list enrollments for.
Errors importing the user.
Error code.
Error message.
Error field.
ID of the job.
The time that the execution was started.
ID identifies this specific execution simulation. These IDs would resemble real executions in production.
The overall status of an execution.
The time that the exeution finished executing.
The name of the action that was executed.
The time when the action finished executing.
The time when the action was started.
The ID of the execution to retrieve.
Optionalaudience of the grants to retrieve.
Optional client_client_id of the grants to retrieve.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
Optional user_user_id of the grants to retrieve.
OptionalComma-separated list of fields to include in the result. Leave empty to retrieve all fields.
ID of the hook to retrieve.
OptionalOptional filter on whether a hook is enabled (true) or disabled (false).
Optional fieldsComma-separated list of fields to include in the result. Leave empty to retrieve all fields.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
Optional triggerRetrieves hooks that match the trigger
Auth0 client ID. Used to resolve the application's login initiation endpoint.
The id of the connection to force invitee to authenticate with.
The ISO 8601 formatted timestamp representing the creation time of the invitation.
The ISO 8601 formatted timestamp representing the expiration time of the invitation.
The id of the user invitation.
The invitation url to be send to the invitee.
Organization identifier
List of roles IDs to associated with the user.
The id of the invitation ticket
The invitee's email.
The inviter's name.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Organization identifier
Optional include_Whether specified fields are to be included (true) or excluded (false). Defaults to true.
The id of the user invitation.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Organization identifier
Optional include_Whether specified fields are to be included (true) or excluded (false). Defaults to true.
Optional include_When true, return results inside an object that also contains the start and limit. When false (default), a direct array of results is returned. We do not yet support returning the total invitations count.
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
Optional sortField to sort by. Use field:order where order is 1 for ascending and -1 for descending Defaults to created_at:-1.
IP address to check.
ID of the job.
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
AWS account ID
Optional awsAWS EventBridge partner event source
The region in which the EventBridge event source will be created
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
OptionalPartner Topic
Azure Region Name
Resource Group
Subscription ID
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
Datadog API Key
Datadog region
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
Splunk URL Endpoint
Port
Verify TLS certificate
Splunk token
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
HTTP Source Address
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
Segment write key
The id of the log stream
log stream name
The status of the log stream. Possible values: active, paused, suspended
Mixpanel Project Id
Mixpanel Region
Mixpanel Service Account Password
Mixpanel Service Account Username
Category group name
Filter type. Currently category is the only valid type.
OptionalHTTP Authorization header
Optional httpHTTP JSON format
Optional httpHTTP Content-Type header
Optional httpcustom HTTP headers
HTTP endpoint
OptionalHTTP header name
Optional valueHTTP header value
The id of the log stream to get
log_id of the log to retrieve.
ID of the user of the logs to retrieve
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
Optional sortField to sort by. Use fieldname:1 for ascending order and fieldname:-1 for descending.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional fromLog Event Id from which to start selection from.
Optional include_Whether specified fields are to be included (true) or excluded (false)
Optional include_Return results as an array when false (default). Return results inside an object that also contains a total result count when true.
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent. Default: 50. Max value: 100
Optional qQuery in Lucene query string syntax.
Optional sortField to use for sorting appended with :1 for ascending and :-1 for descending. e.g. date:-1
Optional takeNumber of entries to retrieve when using the from parameter. Default 50, max 100
Email address of this user.
Name of this user.
URL to a picture for this user.
ID of this user.
ID for this role.
Name of this role.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional fromOptional Id from which to start selection.
Organization identifier
Optional include_Whether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
Optional takeNumber of results per page. Defaults to 50.
The list of phone factors to enable on the tenant. Can include sms and voice.
name of the organization to retrieve.
Description of this role.
ID for this role.
Name of this role.
Organization identifier
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
ID of the user to associate roles with.
Friendly name of this organization.
Organization identifier
The name of this organization.
URL of logo to display on login page
HEX Color for background
HEX Color for primary elements
ID of the organization to retrieve.
OptionalOptional Id from which to start selection.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
Optional sortField to sort by. Use field:order where order is 1 for ascending and -1 for descending. e.g. created_at:1. We currently support sorting by the following fields: name, display_name and created_at.
Optional takeNumber of results per page. Defaults to 50.
Name of the prompt.
Description of this permission.
Name of this permission.
Resource server (API) identifier that this permission is for.
Resource server (API) name this permission is for.
ID of the user to retrieve the permissions for.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
OptionalComma-separated list of fields to include or exclude (dependent upon include_fields) from the result. Leave empty to retrieve name and enabled. Additional fields available include credentials, default_from_address, and settings.
Optional include_Whether specified fields are to be included (true) or excluded (false).
ID or audience of the resource server to retrieve.
Optional include_Whether specified fields are to be included (true) or excluded (false).
OptionalWhether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
ID of the role to list granted permissions.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
Email address of this user.
Name of this user.
URL to a picture for this user.
ID of this user.
OptionalOptional Id from which to start selection.
ID of the role to retrieve a list of users associated with.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
Optional takeNumber of results per page. Defaults to 50.
ID of the role to retrieve.
OptionalReturn results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional name_Optional filter on name (case-insensitive).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
ID of the rule to retrieve.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Key for a rules config variable.
OptionalOptional filter on whether a rule is enabled (true) or disabled (false).
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
ID of the hook to retrieve secrets from.
Key id of the key to retrieve
The public certificate of the signing key
Optional currentTrue if the key is the the current key
Optional current_Optional current_The cert fingerprint
The key id of the signing key
Optional nextTrue if the key is the the next key
Optional pkcs7The public certificate of the signing key in pkcs7 format
Optional previousTrue if the key is the the previous key
Optional revokedTrue if the key is revoked
Optional revoked_The cert thumbprint
ID of the connection to check
List of trusted IP addresses that will not have attack protection enforced against them.
Whether or not suspicious IP throttling attack protections are active.
Total number of attempts allowed per day.
Interval of time, given in milliseconds, at which new attempts are granted.
Total number of attempts allowed.
Interval of time, given in milliseconds, at which new attempts are granted.
OptionalOptional filter on the JWT's aud claim (the client_id to which the JWT was issued).
The custom page template for the New Universal Login Experience
Optional
user_id of the user blocks to retrieve.
Optional
Should be any of a username, phone number, or email.
ID of the user to retrieve the organizations for.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Defaults to 50.
ID of the user to list roles for.
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
Whether this user was blocked by an administrator (true) or is not (false).
Email address of this user.
Whether this email address is verified (true) or unverified (false).
Family name/last name/surname of this user.
Given name/first name/forename of this user.
Array of user identity objects when accounts are linked.
Last IP address from which this user logged in.
Total number of logins this user has performed.
List of multi-factor authentication providers with which this user has enrolled.
Name of this user.
Preferred nickname or alias of this user.
Phone number for this user when using SMS connections. Follows the E.164 recommendation.
Whether this phone number has been verified (true) or not (false).
URL to picture, photo, or avatar of this user.
ID of the user which can be used when interacting with other APIs.
Username of this user.
IDP access token returned only if scope read:user_idp_tokens is defined.
IDP access token secret returned only if scope read:user_idp_tokens is defined.
Name of the connection containing this identity.
Whether this identity is from a social provider (true) or not (false).
The type of identity provider
IDP refresh token returned only if scope read:user_idp_tokens is defined.
Unique identifier of the user user for this identity.
Email address to search for (case-sensitive).
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false). Defaults to true.
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
ID of the user to retrieve.
Optional include_Whether specified fields are to be included (true) or excluded (false).
OptionalConnection filter. Only applies when using search_engine=v1. To filter by connection with search_engine=v2|v3, use q=identities.connection:"connection_name"
Optional fieldsComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Optional include_Return results inside an object that contains the total result count (true) or as a direct array of results (false, default).
Optional pagePage index of the results to return. First page is 0.
Optional per_Number of results per page. Paging is disabled if parameter not sent.
Optional qQuery in Lucene query string syntax. Some query types cannot be used on metadata fields, for details see Searchable Fields.
Optional search_The version of the search engine
Optional sortField to sort by. Use field:order where order is 1 for ascending and -1 for descending. e.g. created_at:1
Whether this hook will be executed (true) or ignored (false).
ID of this hook.
Name of this hook.
Code to be executed when this hook runs.
Trigger ID
Optional enabledWhether this hook will be executed (true) or ignored (false).
Name of this hook.
Code to be executed when this hook runs.
Execution stage of this rule. Can be credentials-exchange, pre-user-registration, post-user-registration, post-change-password, or send-phone-message.
Optional enabledWhether this hook will be executed (true) or ignored (false).
Optional nameName of this hook.
Optional scriptCode to be executed when this hook runs.
Optionalconnection_id of the connection from which users will be exported.
Optional created_When this job was created.
Optional fieldsList of fields to be included in the CSV. Defaults to a predefined set of fields.
Optional formatFormat of the file. Must be json or csv.
ID of this job.
Optional limitLimit the number of records.
Status of this job.
Type of job this is.
API audience the event applies to.
ID of the client (application).
Name of the client (application).
Name of the connection the event relates to.
ID of the connection the event relates to.
Description of this event.
Hostname the event applies to.
IP address of the log event source.
Whether the client was a mobile device (true) or desktop/laptop/server (false).
Unique ID of the event.
Scope permissions applied to the event.
Name of the strategy involved in the event.
Type of strategy involved in the event.
Type of event.
User agent string from the client device that caused the event.
ID of the user involved in the event.
Name of the user involved in the event.
Full city name in English.
Continent the country is located within. Can be AF (Africa), AN (Antarctica), AS (Asia), EU (Europe), NA (North America), OC (Oceania) or SA (South America).
Two-letter Alpha-2 ISO 3166-1 country code.
Three-letter Alpha-3 ISO 3166-1 country code.
Full country name in English.
Global latitude (horizontal) position.
Global longitude (vertical) position.
Time zone name as found in the tz database.
OptionalOptional audienceOptional clientOptional fetchOptionalOptional headersOptionalOptional retryOptionalOptional telemetryOptional timeoutOptionalOptionalOptional audienceOptional clientOptional clientOptional fetchOptionalOptional headersOptionalOptional retryOptionalOptional telemetryOptional timeoutOptionalOptional useMTLSOptionalOptional audienceOptional clientOptional fetchOptionalOptional headersOptionalOptional retryOptionalOptional telemetryOptional timeoutOptionalOptional useMTLSOptionalOptional audienceOptional clientOptional fetchOptionalOptional headersOptionalOptional retryOptionalOptional telemetryOptional timeoutOptionalThe id of the action to update.
OptionalThe source code of the action.
Optional dependenciesThe list of third party npm modules, and their versions, that this action depends on.
Optional nameThe name of an action.
Optional runtimeThe Node runtime. For example: node12, defaults to node12
Optional secretsThe list of secrets that are included in an action or a version of an action.
Optional supported_The list of triggers that this action supports. At this time, an action can only target a single trigger at a time.
The ID of the authentication method to update.
The ID of the user in question.
OptionalA human-readable label to identify the authentication method.
Optional preferred_Preferred phone authentication method
OptionalThe actions that will be bound to this trigger. The order in which they are included will be the order in which they are executed.
OptionalThe name of the binding.
Optional secretsThe list of secrets that are included in an action or a version of an action.
OptionalHow the action is being referred to: action_id or action_name.
Optional valueThe id or name of an action that is being bound to a trigger.
Optional favicon_URL for the favicon. Must use HTTPS.
Optional fontOptional logo_URL for the logo. Must use HTTPS.
Optional primaryAccent color.
OptionalURL for the custom font. The URL must point to a font file and not a stylesheet. Must use HTTPS.
The ID of the theme
Optionalimmediately, daily, weekly, monthly.
Optional enabledWhether or not breached password detection is active.
Optional methodOptionalstandard, enhanced.
Optional shieldsOptionalblock, user_notification, admin_notification.
Optional stageOptionalblock, admin_notification.
OptionalList of trusted IP addresses that will not have attack protection enforced against them.
Optional enabledWhether or not brute force attack protections are active.
Optional max_Maximum number of unsuccessful attempts.
Optional modeOptionalcount_per_identifier_and_ip, count_per_identifier.
Optional shieldsOptionalblock, user_notification.
ID of the client grant to update.
OptionalScopes allowed for this client grant.
ID of the client to update.
The id of the connection to retrieve
ID of the client.
ID of the credential.
OptionalThe ISO 8601 formatted date representing the expiration of the credential.
The id of the custom domain to update
OptionalThe HTTP header to fetch the client's IP address
Optional tls_compatible includes TLS 1.0, 1.1, 1.2, and recommended only includes TLS 1.2
OptionalBody of the email template.
Optional enabledWhether the template is enabled (true) or disabled (false).
Optional fromSenders from email address.
Optional includeWhether the reset_email and verify_email templates should include the user's email address as the email parameter in the returnUrl (true) or whether no email address should be included in the redirect (false). Defaults to true.
Optional resultURL to redirect the user to after a successful action.
Optional subjectSubject line of the email.
Optional syntaxSyntax of the template body.
Optional templateTemplate name. Can be verify_email, verify_email_by_code, reset_email, welcome_email, blocked_account, stolen_credentials, enrollment_email, mfa_oob_code, user_invitation, change_password (legacy), or password_reset (legacy).
Optional urlLifetime in seconds that the link within the email will be valid for.
Connection identifier
Organization identifier
OptionalWhen true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection.
Optional show_Enables showing a button for the connection in the organization login page. If false, it will be usable only by HRD.
ID of the hook to update.
The id of the log stream to get
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional sinkOptional statusThe status of the log stream. Possible values: active, paused, suspended
OptionalDatadog API Key
Datadog region
Splunk URL Endpoint
Port
Verify TLS certificate
Optional splunkSplunk token
OptionalSegment write key
Mixpanel Project Id
Mixpanel Region
Optional mixpanelMixpanel Service Account Password
Mixpanel Service Account Username
ID of the organization to update.
Optional display_Friendly name of this organization.
Optional metadataMetadata associated with the organization, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.
Optional nameThe name of this organization.
Optional logo_URL of logo to display on login page
ID or audience of the resource server to update.
ID of the role to update.
ID of the rule to retrieve.
ID of the hook whose secrets to update.
OptionalList of trusted IP addresses that will not have attack protection enforced against them.
Optional enabledWhether or not suspicious IP throttling attack protections are active.
Optional shieldsOptionalblock, admin_notification.
Optional stageOptional pre-OptionalTotal number of attempts allowed per day.
Optional rateInterval of time, given in milliseconds, at which new attempts are granted.
OptionalTotal number of attempts allowed.
Optional rateInterval of time, given in milliseconds, at which new attempts are granted.
ID of the user to update.
OptionalDescription of this permission.
Optional permission_Name of this permission.
Optional resource_Resource server (API) identifier that this permission is for.
Optional resource_Resource server (API) name this permission is for.
OptionalThe source code of the action.
Optional dependenciesThe list of third party npm modules, and their versions, that this action depends on.
The name of an action.
Optional runtimeThe Node runtime. For example: node12, defaults to node12
Optional secretsThe list of secrets that are included in an action or a version of an action.
The list of triggers that this action supports. At this time, an action can only target a single trigger at a time.
Optionalname is the name of the npm module, e.g. lodash
Optional registry_registry_url is an optional value used primarily for private npm registries.
Optional versiondescription is the version of the npm module, e.g. 4.17.1
OptionalThe name of the particular secret, e.g. API_KEY.
Optional valueThe value of the particular secret, e.g. secret123. A secret's value can only be set upon creation. A secret's value will never be returned by the API.
Optional created_Authentication method creation date
Optional emailApplies to email authentication methods only. The email address used to send verification messages.
Optional idThe ID of the newly created authentication method (automatically generated by the application)
Optional key_Applies to webauthn authenticators only. The id of the credential.
Optional nameA human-readable label to identify the authentication method.
Optional phone_Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice.
Optional preferred_Preferred phone authentication method
Optional public_Applies to webauthn authenticators only. The public key.
Optional relying_Applies to webauthn authenticators only. The relying party identifier.
Optional totp_Base32 encoded secret for TOTP generation
The ID of the user to whom the new authentication method will be assigned.
OptionalApplies to email authentication methods only. The email address used to send verification messages.
Optional key_Applies to email webauthn authenticators only. The id of the credential.
Optional nameA human-readable label to identify the authentication method.
Optional phone_Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice.
Optional preferred_Preferred phone authentication method.
Optional public_Applies to email webauthn authenticators only. The public key.
Optional relying_Applies to email webauthn authenticators only. The relying party identifier.
Optional totp_Base32 encoded secret for TOTP generation.
Display Name
Theme Id
Optional displayDisplay Name
Button border radius
Button border weight
Buttons style
Input border radius
Input border weight
Inputs style
Show widget shadow
Widget border weight
Widget corner radius
OptionalBase Focus Color
Optional base_Base Hover Color
Body text
Error
Header
Icons
Input background
Input border
Input filled text
Input labels & placeholders
Links & focused components
Primary button
Primary button label
Secondary button border
Secondary button label
Success
Widget background
Widget border
Font URL
Links style
Reference text size
Body text bold
Body text size
Buttons text bold
Buttons text size
Input Labels bold
Input Labels size
Links bold
Links size
Subtitle bold
Subtitle size
Title bold
Title size
Background color
Background image url
Page Layout
Header text alignment
Logo height
Logo position
Logo url
Social buttons layout
ID of the client.
Credential type. Supported types: public_key, cert_subject_dn or x509_cert
Optional nameFriendly name for a credential.
OptionalThe HTTP header to fetch the client's IP address
ID of the custom domain.
Domain name.
Whether this is a primary domain (true) or not (false).
Custom domain configuration status. Can be disabled, pending, pending_verification, or ready.
Optional tls_The TLS version policy
Custom domain provisioning type. Can be auth0_managed_certs or self_managed_certs.
OptionalDomain verification methods.
OptionalThe name of the txt record for verification
Domain verification method.
Value used to verify the domain.
OptionalHTTP header to fetch client IP header. Ex: CF-Connecting-IP, X-Forwarded-For or True-Client-IP.
Domain name.
Optional tls_compatible includes TLS 1.0, 1.1, 1.2, and recommended only includes TLS 1.2
Custom domain provisioning type. Must be auth0_managed_certs or self_managed_certs.
Optional verification_Custom domain verification method. Must be txt.
The ID of an action.
The ID of an action.
The ID of an action version.
The credential's identifier
Body of the email template.
Whether the template is enabled (true) or disabled (false).
Senders from email address.
Optional includeWhether the reset_email and verify_email templates should include the user's email address as the email parameter in the returnUrl (true) or whether no email address should be included in the redirect (false). Defaults to true.
Optional resultURL to redirect the user to after a successful action.
Subject line of the email.
Syntax of the template body.
Template name. Can be verify_email, verify_email_by_code, reset_email, welcome_email, blocked_account, stolen_credentials, enrollment_email, mfa_oob_code, user_invitation, change_password (legacy), or password_reset (legacy).
Optional urlLifetime in seconds that the link within the email will be valid for.
URL representing the ticket.
OptionalID of the client. If provided for tenants using New Universal Login experience, the user will be prompted to redirect to the default login route of the corresponding application once the ticket is used. See Configuring Default Login Routes for more details.
Optional identityOptional includeWhether to include the email address as part of the returnUrl in the reset_email (true), or not (false).
Optional organization_(Optional) Organization ID – the ID of the Organization. If provided, organization parameters will be made available to the email template and organization branding will be applied to the prompt. In addition, the redirect link in the prompt will include organization_id and organization_name query string parameters.
Optional result_URL the user will be redirected to in the classic Universal Login experience once the ticket is used.
Optional ttl_Number of seconds for which the ticket is valid before expiration. If unspecified or set to 0, this value defaults to 432000 seconds (5 days).
user_id of for whom the ticket should be created.
Organization identifier
OptionalWhen true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection.
Single connection ID to add to the organization.
Optional show_Enables showing a button for the connection in the organization login page. If false, it will be usable only by HRD.
ID of the primary user account to link a second user account to.
Optionalconnection_id of the secondary user account being linked when more than one auth0 database provider exists.
Optional link_JWT for the secondary account being linked. If sending this parameter, provider, user_id, and connection_id must not be sent.
Optional providerIdentity provider of the secondary user account being linked.
Optional user_Organization identifier
Auth0 client ID. Used to resolve the application's login initiation endpoint.
Optional connection_The id of the connection to force invitee to authenticate with.
Optional rolesList of roles IDs to associated with the user.
Optional send_Whether the user will receive an invitation email (true) or no email (false), true by default
Optional ttl_Number of seconds for which the invitation is valid before expiration. If unspecified or set to 0, this value defaults to 604800 seconds (7 days). Max value: 2592000 seconds (30 days).
Optional user_Optional _idOptional blockedOptional clientIDOptional created_Optional emailOptional email_Optional globalOptional global_Optional identitiesOptional lastIPOptional lastOptional loginsOptional metadataOptional updated_Optional user_OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
AWS account ID
The region in which the EventBridge event source will be created
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
Azure Region Name
Resource Group
Subscription ID
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalOnly logs events matching these filters will be delivered by the stream. If omitted or empty, all events will be delivered.
Optional namelog stream name
Optional startThe optional datetime (ISO 8601) to start streaming logs from
OptionalCategory group name
Optional typeFilter type. Currently category is the only valid type.
Organization identifier
List of user IDs to add to the organization as members.
Organization identifier
ID of the user to associate roles with.
List of roles IDs to associated with the user.
Friendly name of this organization.
Organization identifier
The name of this organization.
When true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection.
ID of the connection.
Enables showing a button for the connection in the organization login page. If false, it will be usable only by HRD.
Optional display_Friendly name of this organization.
Optional enabled_Connections that will be enabled for this organization. See POST enabled_connections endpoint for the object format. (Max of 10 connections allowed)
Optional metadataThe name of this organization.
Optional logo_URL of logo to display on login page
OptionalWhen true, all users that log in with this connection will be automatically granted membership in the organization. When false, users must be granted membership in the organization before logging in with this connection.
ID of the connection.
Optional show_Enables showing a button for the connection in the organization login page. If false, it will be usable only by HRD.
URL representing the ticket.
OptionalID of the client. If provided for tenants using New Universal Login experience, the user will be prompted to redirect to the default login route of the corresponding application once the ticket is used. See Configuring Default Login Routes for more details.
Optional connection_ID of the connection. If provided, allows the user to be specified using email instead of user_id. If you set this value, you must also send the email parameter. You cannot send user_id when specifying a connection_id.
Optional emailEmail address of the user for whom the tickets should be created. Requires the connection_id parameter. Cannot be specified when using user_id.
Optional includeWhether to include the email address as part of the returnUrl in the reset_email (true), or not (false).
Optional mark_Whether to set the email_verified attribute to true (true) or whether it should not be updated (false).
Optional organization_(Optional) Organization ID – the ID of the Organization. If provided, organization parameters will be made available to the email template and organization branding will be applied to the prompt. In addition, the redirect link in the prompt will include organization_id and organization_name query string parameters.
Optional result_URL the user will be redirected to in the classic Universal Login experience once the ticket is used.
Optional ttl_Number of seconds for which the ticket is valid before expiration. If unspecified or set to 0, this value defaults to 432000 seconds (5 days).
Optional user_user_id of for whom the ticket should be created.
ID of the user to assign permissions to.
List of permissions to add to this user.
New account recovery code.
ID of the user to regenerate a multi-factor authentication recovery code for.
ID of the role to add permissions to.
array of resource_server_identifier, permission_name pairs.
Name of this permission.
Resource server (API) identifier that this permission is for.
ID of the role to assign users to.
user_id's of the users to assign the role to.
ID of the client that will rotate secrets.
The id of the hook to retrieve
Next key certificate
Next key id
The id of the action to test.
The ticket_id used to identify the enrollment
The url you can use to start enrollment
ID of the user to associate roles with.
List of roles IDs to associated with the user.
Optionalconnection_id of the connection from which users will be exported.
Optional fieldsList of fields to be included in the CSV. Defaults to a predefined set of fields.
Optional formatFormat of the file. Must be json or csv.
Optional limitLimit the number of records.
OptionalTitle of the column in the exported CSV.
Name of the field in the profile.
connection_id of the connection to which users will be imported.
Optional external_Customer-defined ID.
Optional send_Whether to send a completion email to all tenant owners when the job is finished (true) or not (false).
Optional upsertWhether to update users if they already exist (true) or to ignore them (false).
Optionalclient_id of the client (application). If no value provided, the global Client ID will be used.
Optional identityOptional organization_(Optional) Organization ID – the ID of the Organization. If provided, organization parameters will be made available to the email template and organization branding will be applied to the prompt. In addition, the redirect link in the prompt will include organization_id and organization_name query string parameters.
user_id of the user to send the verification email to.
Identity provider name of the identity (e.g. google-oauth2).
user_id of the identity to be verified.
OptionalCNAME API key header.
Optional custom_The HTTP header to fetch the client's IP address
ID of the custom domain.
Domain name.
Optional origin_Intermediate address.
Whether this is a primary domain (true) or not (false).
Custom domain configuration status. Can be disabled, pending, pending_verification, or ready.
Optional tls_The TLS version policy
Custom domain provisioning type. Can be auth0_managed_certs or self_managed_certs.
Optional verificationID of the custom domain to verify.
Whether identifier first is enabled or not
Which login experience to use. Can be new or classic.
Use WebAuthn with Device Biometrics as the first authentication factor
OptionalWhether identifier first is enabled or not
Optional universal_Which login experience to use. Can be new or classic.
Optional webauthn_Use WebAuthn with Device Biometrics as the first authentication factor
Optional p12Optional sandboxOptional created_Authentication method creation date
Optional emailApplies to email authentication methods only. The email address used to send verification messages.
Optional idThe ID of the newly created authentication method (automatically generated by the application)
Optional key_Applies to webauthn authenticators only. The id of the credential.
Optional nameA human-readable label to identify the authentication method.
Optional phone_Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice.
Optional preferred_Preferred phone authentication method
Optional public_Applies to webauthn authenticators only. The public key.
Optional relying_Applies to webauthn authenticators only. The relying party identifier.
Optional totp_Base32 encoded secret for TOTP generation
Optional typeThe ID of the user in question.
OptionalApplies to email authentication methods only. The email address used to send verification messages.
Optional nameAA human-readable label to identify the authentication method.
Optional phone_Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice.
Optional preferred_The preferred authentication method for phone authentication method.
Optional totp_Applies to totp authentication methods only. The base32 encoded secret for TOTP generation.
Language to update.
Name of the prompt.
Whether this factor is enabled (true) or disabled (false).
Whether this factor is enabled (true) or disabled (false).
Name of the prompt.
Key for a rules config variable.
Value for a rules config variable.
Key of the rules config variable to set (max length: 127 characters).
Value for a rules config variable.
Revoked key certificate
Revoked key id
Key id of the key to revoke
Optional aws_Optional aws_Optional sns_Optional sns_OptionalTwilio Authentication token
Optional fromFrom number
Optional messaging_Copilot SID
Optional sidTwilio SID
Whether refresh tokens can be issued for this API (true) or not (false).
Whether authorization polices are enforced (true) or unenforced (false).
ID of the API (resource server).
Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
Whether this is an Auth0 system API (true) or a custom API (false).
Friendly name for this resource server. Can not contain < or > characters.
List of permissions (scopes) that this API uses.
Algorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Secret used to sign tokens when using symmetric algorithms (HS256).
Whether to skip user consent for applications flagged as first party (true) or not (false).
Dialect of access tokens that should be issued. access_token is a JWT containing standard Auth0 claims; rfc9068_profile is a JWT conforming to the IETF JWT Access Token Profile. access_token_authz and rfc9068_profile_authz additionally include RBAC permissions claims.
Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
Expiration value (in seconds) for access tokens issued for this API via Implicit or Hybrid Flows. Cannot be greater than the token_lifetime value.
OptionalWhether refresh tokens can be issued for this API (true) or not (false).
Optional clientOptional enforce_Whether to enforce authorization policies (true) or to ignore them (false).
Unique identifier for the API used as the audience parameter on authorization calls. Can not be changed once set.
Optional nameFriendly name for this resource server. Can not contain < or > characters.
Optional scopesList of permissions (scopes) that this API uses.
Optional signing_Algorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Optional signing_Secret used to sign tokens when using symmetric algorithms (HS256).
Optional skip_Whether to skip user consent for applications flagged as first party (true) or not (false).
Optional token_Dialect of access tokens that should be issued. access_token is a JWT containing standard Auth0 claims; rfc9068_profile is a JWT conforming to the IETF JWT Access Token Profile. access_token_authz and rfc9068_profile_authz additionally include RBAC permissions claims.
Optional token_Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
OptionalWhether refresh tokens can be issued for this API (true) or not (false).
Optional clientOptional enforce_Whether authorization policies are enforced (true) or not enforced (false).
Optional nameFriendly name for this resource server. Can not contain < or > characters.
Optional scopesList of permissions (scopes) that this API uses.
Optional signing_Algorithm used to sign JWTs. Can be HS256 or RS256. PS256 available via addon.
Optional signing_Secret used to sign tokens when using symmetric algorithms (HS256).
Optional skip_Whether to skip user consent for applications flagged as first party (true) or not (false).
Optional token_Dialect of access tokens that should be issued. access_token is a JWT containing standard Auth0 claims; rfc9068_profile is a JWT conforming to the IETF JWT Access Token Profile. access_token_authz and rfc9068_profile_authz additionally include RBAC permissions claims.
Optional token_Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
OptionalDescription of the role.
Name of the role.
OptionalDescription of this role.
Optional nameName of this role.
Whether the rule is enabled (true), or disabled (false).
ID of this rule.
Name of this rule.
Order that this rule should execute in relative to other rules. Lower-valued rules execute first.
Code to be executed when this rule runs.
Execution stage of this rule. Can be login_success, login_failure, or pre_authorize.
OptionalWhether the rule is enabled (true), or disabled (false).
Name of this rule.
Optional orderOrder that this rule should execute in relative to other rules. Lower-valued rules execute first.
Code to be executed when this rule runs.
OptionalWhether the rule is enabled (true), or disabled (false).
Optional nameName of this rule.
Optional orderOrder that this rule should execute in relative to other rules. Lower-valued rules execute first.
Optional scriptCode to be executed when this rule runs.
OptionalUser-friendly description of this scope.
Value of this scope.
Twilio Authentication token
From number
Copilot SID
Twilio SID
OptionalApproximate date and time the first event occurred in ISO 8601 format.
Optional dateDate these events occurred in ISO 8601 format.
Optional leaked_Number of breached-password detections on this date (subscription required).
Optional loginsNumber of logins on this date.
Optional signupsNumber of signups on this date.
Optional updated_Date and time this stats entry was last updated in ISO 8601 format.
Message sent to the user when they are invited to enroll with a phone number.
Message sent to the user when they are prompted to verify their account.
Whether to accept an organization name instead of an ID on auth endpoints
URLs that are valid to redirect to after logout from Auth0.
Whether to enable flexible factors for MFA in the PostLogin action
Default audience for API authorization.
Name of connection used for password grants at the /tokenendpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.
The default absolute redirection uri, must be https
Supported locales for the user interface.
Friendly name for this tenant.
Number of hours for which a session can be inactive before the user must log in again.
URL of logo to be shown for this tenant (recommended size: 150x150)
Selected sandbox version for the extensibility environment.
Available sandbox versions for the extensibility environment.
Number of hours a session will stay valid.
End-user support email address.
End-user support URL.
Custom change password HTML (Liquid syntax supported).
Character set used to generate a User Code. Can be base20 or digits.
Mask used to format a generated User Code into a friendly, readable format.
Whether to show the link to log as part of the default error page (true, default) or not to show the link (false).
URL to redirect to when an error occurs instead of showing the default error page.
Whether the enable_sso setting can be changed (true) or not (false).
If enabled, clients are able to add legacy delegation grants.
If enabled, clients are able to add legacy RO grants.
Whether the legacy /tokeninfo endpoint is enabled for your account (true) or unavailable (false).
Whether to use the older v1 change password flow (true, not recommended except for backward compatibility) or the newer safer flow (false, recommended).
Enables new insights activity page view
Enables beta access to log streaming changes
Whether classic Universal Login prompts include additional security headers to prevent clickjacking (true) or no safeguard (false).
Disables SAML fields map fix for bad mappings with repeated attributes
Whether the impersonation functionality has been disabled (true) or not (false). Read-only.
Enables the email verification flow during login for Azure AD and ADFS connections
Whether the APIs section is enabled (true) or disabled (false).
Whether all current connections should be enabled when a new client (application) is created (true, default) or not (false).
Whether ID tokens can be used to authorize some types of requests to API v2 (true) not not (false).
Whether ID tokens and the userinfo endpoint includes a complete user profile (true) or only OpenID Connect claims (false).
Whether advanced API Authorization scenarios are enabled (true) or disabled (false).
Whether the public sign up process shows a user_exists error (true) or a generic error (false) if the user already exists.
Whether users are prompted to confirm log in before SSO redirection (false) or are not prompted (true).
Enforce client authentication for passwordless start.
Used to allow users to pick what factor to enroll of the available MFA factors.
Do not Publish Enterprise Connections Information with IdP domains on the lock configuration file.
Delete underlying grant when a Refresh Token is revoked via the Authentication API.
Whether to use the custom Guardian HTML (true) or the default Auth0 page (false, default)
Custom Guardian HTML (Liquid syntax is supported).
OptionalComma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
Optional include_Whether specified fields are to be included (true) or excluded (false).
Behavior of the session cookie
Whether to bypass prompting logic (false) when performing OIDC Logout
OptionalWhether to accept an organization name instead of an ID on auth endpoints
Optional allowed_URLs that are valid to redirect to after logout from Auth0.
Optional change_Optional customize_Whether to enable flexible factors for MFA in the PostLogin action
Optional default_Default audience for API Authorization.
Optional default_Name of connection used for password grants at the /token endpoint. The following connection types are supported: LDAP, AD, Database Connections, Passwordless, Windows Azure Active Directory, ADFS.
Optional default_The default absolute redirection uri, must be https
Optional device_Optional enabled_Supported locales for the user interface
Optional error_Optional flagsOptional friendly_Friendly name for this tenant.
Optional guardian_Optional idle_Number of hours for which a session can be inactive before the user must log in again.
Optional picture_URL of logo to be shown for this tenant (recommended size: 150x150)
Optional sandbox_Selected sandbox version for the extensibility environment
Optional session_Optional session_Number of hours a session will stay valid.
Optional sessionsOptional support_End-user support email.
Optional support_End-user support url.
OptionalWhether to use the custom change password HTML (true) or the default Auth0 page (false). Default is to use the Auth0 page.
Optional htmlCustom change password HTML (Liquid syntax supported).
OptionalCharacter set used to generate a User Code. Can be base20 or digits.
Optional maskMask used to format a generated User Code into a friendly, readable format.
OptionalCustom Error HTML (Liquid syntax is supported).
Optional show_Whether to show the link to log as part of the default error page (true, default) or not to show the link (false).
Optional urlURL to redirect to when an error occurs instead of showing the default error page.
OptionalWhether the legacy delegation endpoint will be enabled for your account (true) or not available (false).
Optional allow_Whether the legacy auth/ro endpoint (used with resource owner password and passwordless features) will be enabled for your account (true) or not available (false).
Optional allow_Whether the legacy /tokeninfo endpoint is enabled for your account (true) or unavailable (false).
Optional change_Whether to use the older v1 change password flow (true, not recommended except for backward compatibility) or the newer safer flow (false, recommended).
Optional dashboard_Enables new insights activity page view.
Optional dashboard_Enables beta access to log streaming changes.
Optional disable_Whether classic Universal Login prompts include additional security headers to prevent clickjacking (true) or no safeguard (false).
Optional disable_Disables SAML fields map fix for bad mappings with repeated attributes.
Optional disable_If true, SMS phone numbers will not be obfuscated in Management API GET calls.
Optional enable_Enables the email verification flow during login for Azure AD and ADFS connections.
Optional enable_Whether the APIs section is enabled (true) or disabled (false).
Optional enable_Whether all current connections should be enabled when a new client (application) is created (true, default) or not (false).
Optional enable_Whether emails sent by Auth0 for change password, verification etc. should use your verified custom domain (true) or your auth0.com sub-domain (false). Affects all emails, links, and URLs. Email will fail if the custom domain is not verified.
Optional enable_Whether third-party developers can dynamically register applications for your APIs (true) or not (false). This flag enables dynamic client registration.
Optional enable_Whether ID tokens can be used to authorize some types of requests to API v2 (true) not not (false).
Optional enable_Whether ID tokens and the userinfo endpoint includes a complete user profile (true) or only OpenID Connect claims (false).
Optional enable_Whether advanced API Authorization scenarios are enabled (true) or disabled (false).
Optional enable_Whether the public sign up process shows a user_exists error (true) or a generic error (false) if the user already exists.
Optional enable_Whether users are prompted to confirm log in before SSO redirection (false) or are not prompted (true).
Optional enforce_Enforce client authentication for passwordless start.
Optional mfa_Used to allow users to pick what factor to enroll of the available MFA factors.
Optional no_Do not Publish Enterprise Connections Information with IdP domains on the lock configuration file.
Optional revoke_Delete underlying grant when a Refresh Token is revoked via the Authentication API.
Optional trust_Changes email_verified behavior for Azure AD/ADFS connections when enabled. Sets email_verified to false otherwise.
OptionalWhether to use the custom Guardian HTML (true) or the default Auth0 page (false, default)
Optional htmlCustom Guardian HTML (Liquid syntax is supported).
OptionalWhether to bypass prompting logic (false) when performing OIDC Logout
OptionalJWT's aud claim (the client_id to which the JWT was issued).
jti (unique ID within aud) of the blacklisted JWT.
Twilio Authentication token
From number
Copilot SID
Twilio SID
Connection identifier
Identifier (should be any of an email, username, or phone_number)
IP Address
Optional blockedWhether this user was blocked by an administrator (true) or not (false).
Name of the connection this user should be created in.
Optional emailThe user's email.
Optional email_Whether this email address is verified (true) or unverified (false). User will receive a verification email after creation if email_verified is false or not specified
Optional family_The user's family name(s).
Optional given_The user's given name(s).
Optional nameThe user's full name.
Optional nicknameThe user's nickname.
Optional passwordInitial password for this user (mandatory only for auth0 connection strategy).
Optional phone_The user's phone number (following the E.164 recommendation), only valid for users from SMS connections.
Optional phone_Whether this phone number has been verified (true) or not (false).
Optional pictureA URI pointing to the user's picture.
Optional user_The external user's id provided by the identity provider.
Optional user_Optional usernameThe user's username. Only valid if the connection requires a username.
Optional verify_Whether the user will receive a verification email after creation (true) or no email (false). Overrides behavior of email_verified parameter.
OptionalAuthentication method for this enrollment. Can be authenticator, guardian, sms, webauthn-roaming, or webauthn-platform.
Optional enrolled_Start date and time of this enrollment.
Optional idID of this enrollment.
Optional identifierDevice identifier (usually phone identifier) of this enrollment.
Optional last_Last authentication date and time of this enrollment.
Optional nameName of enrollment (usually phone number).
Optional phone_Phone number for this enrollment.
Optional statusStatus of this enrollment. Can be pending or confirmed.
Optional typeType of enrollment.
OptionalAudience of the grant.
Optional clientIDID of the client.
Optional idID of the grant.
Optional scopeScopes included in this grant.
Optional user_ID of the user.
OptionalIDP access token returned if scope read:user_idp_tokens is defined.
Optional access_IDP access token secret returned only if scope read:user_idp_tokens is defined.
Connection name of this identity.
Optional isWhether the identity provider is a social provider (true) or not (false).
Optional profileType of identity provider.
Optional refresh_IDP refresh token returned only if scope read:user_idp_tokens is defined.
OptionalEmail address of this user.
Optional email_Whether this email address is verified (true) or unverified (false).
Optional family_Family name/last name/surname of this user.
Optional given_Given name/first name/forename of this user.
Optional nameName of this user.
Optional phone_Phone number for this user.
Optional phone_Whether this phone number is verified (true) or unverified (false).
Optional usernameUsername of this user.
Optional blockedWhether this user was blocked by an administrator (true) or not (false).
Optional client_Auth0 client ID. Only valid when updating email address.
Optional connectionID of the connection this user should be created in.
Optional emailEmail address of this user.
Optional email_Whether this email address is verified (true) or unverified (false). If set to false the user will not receive a verification email unless verify_email is set to true.
Optional family_Family name/last name/surname of this user.
Optional given_Given name/first name/forename of this user.
Optional nameName of this user.
Optional nicknamePreferred nickname or alias of this user.
Optional passwordNew password for this user (mandatory for non-SMS connections).
Optional phone_The user's phone number (following the E.164 recommendation), only valid for users from SMS connections.
Optional phone_Whether this phone number has been verified (true) or not (false).
Optional pictureURL to picture, photo, or avatar of this user.
Optional user_User metadata to which this user has read/write access.
Optional usernameThe user's username. Only valid if the connection requires a username.
Optional verify_Whether this user will receive a verification email after creation (true) or no email (false). Overrides behavior of email_verified parameter.
Optional verify_Whether this user will receive a text after changing the phone number (true) or no text (false). Only valid when changing phone number.
Optional _idOptional blockedOptional clientIDOptional created_Optional emailOptional email_Optional globalOptional global_Optional identitiesOptional lastIPOptional lastOptional loginsOptional metadataOptional updated_Optional user_Optional country?: stringOptional birthdateOptional family_Optional genderOptional given_Optional localeOptional middle_Optional phone_Optional phone_Optional pictureOptional preferred_Optional profileOptional websiteOptional zoneinfoOptional
External SharePoint application URLs if exposed to the Internet.
Credentials required to use the provider.
An actions extensibility point. Acceptable values: post-login, credentials-exchange, pre-user-registration, post-user-registration, post-change-password, send-phone-message, password-reset-post-challenge
user_id of the secondary user account being linked.
user_id of this identity.
Readonly
Readonly zoom: "zoom"Readonly
Readonly RS384: "RS384"Readonly public_Readonly
Readonly RS256: "RS256"Readonly
Readonly pre_Readonly
Readonly require: "require"Readonly
Readonly none: "none"Readonly
Readonly RS256: "RS256"Readonly
Readonly pre_Readonly
Readonly require: "require"Readonly
Readonly non_Readonly
Readonly rotating: "rotating"Readonly
Readonly none: "none"Readonly
Readonly zoom: "zoom"Readonly
Readonly RS256: "RS256"Readonly
Readonly pre_Readonly
Readonly require: "require"Readonly
Readonly null: "null"Readonly
Readonly button: "button"Readonly
Readonly null: "null"Readonly
Readonly first_Readonly
Readonly yandex: "yandex"Readonly
Readonly null: "null"Readonly
Readonly first_Readonly
Readonly ready: "ready"Readonly
Readonly self_Readonly
Readonly google_Readonly
Readonly yandex: "yandex"Readonly public_Readonly
Readonly rotating_Readonly
Readonly sparkpost: "sparkpost"Readonly
Readonly sparkpost: "sparkpost"Readonly
Readonly welcome_Readonly
Readonly pending: "pending"Readonly
Readonly webauthn_Readonly
Readonly retrying: "retrying"Readonly
Readonly UNSPECIFIED: "UNSPECIFIED"Readonly
Readonly unspecified: "unspecified"Readonly
Readonly retrying: "retrying"Readonly
Readonly send_Readonly
Readonly voice: "voice"Readonly
Readonly voice: "voice"Readonly
Readonly webauthn_Readonly
Readonly weekly: "weekly"Readonly
Readonly standard: "standard"Readonly
Readonly user_Readonly
Readonly block: "block"Readonly
Readonly identifier_Readonly
Readonly user_Readonly
Readonly yandex: "yandex"Readonly
Readonly RS384: "RS384"Readonly
Readonly zh_Readonly
Readonly status: "status"Readonly
Readonly rotating_Readonly
Readonly welcome_Readonly
Readonly welcome_Readonly
Readonly unspecified: "unspecified"Readonly
Readonly send_Readonly
Readonly us_Readonly
Readonly suspended: "suspended"Readonly eventbridge: "eventbridge"Readonly
Readonly westus2: "westus2"Readonly
Readonly suspended: "suspended"Readonly eventgrid: "eventgrid"Readonly
Readonly us5: "us5"Readonly
Readonly suspended: "suspended"Readonly datadog: "datadog"Readonly
Readonly suspended: "suspended"Readonly splunk: "splunk"Readonly
Readonly suspended: "suspended"Readonly sumo: "sumo"Readonly
Readonly suspended: "suspended"Readonly segment: "segment"Readonly
Readonly us: "us"Readonly
Readonly suspended: "suspended"Readonly mixpanel: "mixpanel"Readonly
Readonly user_Readonly category: "category"Readonly
Readonly JSONOBJECT: "JSONOBJECT"Readonly
Readonly suspended: "suspended"Readonly http: "http"Readonly
Readonly voice: "voice"Readonly
Readonly signup_Readonly
Readonly twilio: "twilio"Readonly
Readonly sns: "sns"Readonly
Readonly block: "block"Readonly
Readonly v3: "v3"Readonly
Readonly send_Readonly
Readonly json: "json"Readonly
Readonly voice: "voice"Readonly
Readonly binding_Readonly
Readonly weekly: "weekly"Readonly
Readonly standard: "standard"Readonly
Readonly user_Readonly
Readonly block: "block"Readonly
Readonly identifier_Readonly
Readonly user_Readonly
Readonly x_Readonly
Readonly recommended: "recommended"Readonly
Readonly welcome_Readonly
Readonly welcome_Readonly
Readonly us: "us"Readonly
Readonly us5: "us5"Readonly
Readonly suspended: "suspended"Readonly
Readonly block: "block"Readonly
Readonly voice: "voice"Readonly
Readonly webauthn_Readonly
Readonly voice: "voice"Readonly
Readonly webauthn_Readonly
Readonly sharp: "sharp"Readonly
Readonly sharp: "sharp"Readonly
Readonly underlined: "underlined"Readonly
Readonly right: "right"Readonly
Readonly right: "right"Readonly
Readonly right: "right"Readonly
Readonly top: "top"Readonly
Readonly x509_Readonly
Readonly ready: "ready"Readonly
Readonly self_Readonly
Readonly txt: "txt"Readonly
Readonly x_Readonly
Readonly recommended: "recommended"Readonly
Readonly self_Readonly txt: "txt"Readonly
Readonly welcome_Readonly
Readonly yandex: "yandex"Readonly
Readonly us_Readonly eventbridge: "eventbridge"Readonly
Readonly westus2: "westus2"Readonly eventgrid: "eventgrid"Readonly datadog: "datadog"Readonly splunk: "splunk"Readonly sumo: "sumo"Readonly segment: "segment"Readonly mixpanel: "mixpanel"Readonly
Readonly user_Readonly category: "category"Readonly http: "http"Readonly
Readonly json: "json"Readonly
Readonly yandex: "yandex"Readonly
Readonly ready: "ready"Readonly
Readonly self_Readonly
Readonly new: "new"Readonly
Readonly new: "new"Readonly
Readonly voice: "voice"Readonly
Readonly voice: "voice"Readonly
Readonly webauthn_Readonly
Readonly voice: "voice"Readonly
Readonly totp: "totp"Readonly
Readonly zh_Readonly
Readonly status: "status"Readonly
Readonly welcome_Readonly
Readonly webauthn_Readonly
Readonly signup_Readonly
Readonly RS256: "RS256"Readonly
Readonly token_Readonly
Readonly RS256: "RS256"Readonly
Readonly token_Readonly
Readonly RS256: "RS256"Readonly
Readonly token_Readonly
Readonly digits: "digits"Readonly
Readonly zh_Readonly
Readonly persistent: "persistent"Readonly
Readonly digits: "digits"Readonly
Readonly zh_Readonly false: falseReadonly
Readonly webauthn_Readonly
Readonly pending: "pending"
The Authorization Code received from the initial
/authorizecall.