Identity and Access Management - Cloud Services Platform Operations Index

All available Identity and Access Management - Cloud Services Platform Operations

Auto Entitlement Policy

DELETE

Remove Auto Entitlement Policies From Organization By Organization Id And Policy Id Using DELETE

Remove the Auto Entitlement Policy from the organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Auto Entitlement Policies By Organization Id Using GET

List the Auto Entitlement Policies for an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	❌
Organization Admin	✔️	❌
Organization Owner	✔️	❌

POST

Create Auto Entitlement Policy For Organization By Orgnization Id Using POST

Create Auto Entitlement Policy for an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Auto Entitlement Policy By Organization Id And Policy Id Using GET

Get the Auto Entitlement Policy by the identifier for an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	❌
Organization Admin	✔️	❌
Organization Owner	✔️	❌

PATCH

Update Auto Entitlement Policy By Organization Id And Policy Id Using PATCH

Update an Auto Entitlement Policy Detail of an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

DELETE

Remove Domains From Auto Entitlement Policy By Organization Id And Policy Id Using DELETE

Remove Domains from an Auto Entitlement Policy of an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Add Domains To Auto Entitlement Policy By Organization Id And Policy Id Using POST

Add set of domains to the Auto Entitlement Policy of an Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

Consent

GET

Get Consents By Organization Id Using GET

Get all active and requested consents for a particular organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

DELETE

Revoke Consent Using DELETE

Revoke consent before it expires

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

POST

Approve Consent Using POST

Approve or reject the consent.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

Id P Registration

POST

Set Alternate Urls Active Using POST

Select the alternate set of IdP URLs to be active

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Active Idp Using GET

Return either 'primary' or 'alternate' depending on the set of URLs selected for this IdP

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Set Primary Urls Active Using POST

Select the primary set of IdP URLs to be active

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

Open Id Connect (oidc) Endpoints

GET

Get Oidc User Info Using GET

Display the content of the given access token if the token is valid. Also includes the group_ids and group_names if the client is registered with group_id, group_names scopes. If the token is invalid or expired, an error will be returned. If group_ids and group_names are both requested, they will be in the same order in both the claims. If the token was obtained using an API token, the groups information will be available only if the openid scope was selected.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Anonymous	✔️	✔️

Organization

GET

Get Organization By Id Using GET

Get organization details.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

PATCH

Update Organization By Organization Id Using PATCH

Update organization details.
Note: The type of the organization can only be changed by the Platform operator. If you want to reset the organization type pass an empty string.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Activate Organization Refresh Tokens With Api Token Path Using POST

Activates the deactivated tokens provided. Max 15 tokens can be activated in a request. Note: Partial success, please read response which tokenIds could not be activated

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

POST

Deactivate Organization Refresh Tokens With Api Token Path Using POST

Deactivates the tokens provided. Max 15 tokens can be deactivated in a request. Note: Partial success, please read response which tokenIds could not be deactivated

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

DELETE

Remove Clients From Organization By Organization Id Using DELETE

Remove OAuth clients from organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

GET

Get Organization Clients By Organization Id Using GET

Get OAuth clients that were granted with roles in the organization. Default start page is 1, default limit is 200.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

POST

Assign Roles To Clients On Organization Using POST

Assign roles to the specified OAuth client/s in the organization.
User with Developer Role can assign only Organization Member and Developer.
Note: in case of partial success the caller must read the response to see which client ids have not been added successfully

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

GET

Get Groups In Organizations By Organization Id And Group Search Term Using GET

Search groups in organization having display name which "contains" search term.
Search results limited to first 20 results. Please refine the search term for accurate results.
Organization members will receive basic group information. Organization owners will additionally receive role details of the groups.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

DELETE

Delete Organization Idp Registration Using DELETE

Unlinks the organization from the IdP Registration.
Validation: Caller must be organization owner and their IdP should be same as passed in request.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

GET

Get Org Linked Idp Details Using GET

Gets IDP Details linked to the organization
Validation: Only Organization Owner with same IdP can retrieve the details.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

POST

Link Org To Idp Using POST

Links the organization to the IdP Registration of the given domain.
Validation: Caller must be organization owner and their IdP should be linked to domain in request.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

GET

Get Organization Invitations By Organization Id Using GET

Get invitations for specific organization. If expand parameter is passed to the request user invitation roles will be returned in the response.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Invite Users Using POST

Create/Revoke Organization User Invitation.
Note: When passing the action query param with value revoke the invitations for the given usernames will be revoked.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

DELETE

Revoke User Invitation By Organization Id And User Invitation Id Using DELETE

Revoke invitation of a user (by invitation ID).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get User Invitation By Organization Id And User Invitation Id Using GET

Get invitation of a user in an organization (by invitation id).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Organization Roles By Organization Id Using GET

Get list of organization roles. Expand parameter is supported. If it is true, organization roles will be returned in the response.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Sub Organizations By Organization Id Using GET

Get sub-organizations of the specified parent organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

POST

Activate Organization Refresh Tokens Using POST Deprecated

Activates the deactivated tokens provided. Max 15 tokens can be activated in a request. Note: Partial success, please read response which tokenIds could not be activated

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

POST

Deactivate Organization Refresh Tokens Using POST Deprecated

Deactivates the tokens provided. Max 15 tokens can be deactivated in a request. Note: Partial success, please read response which tokenIds could not be deactivated

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	❌

GET

Get Users In Organization By Organization Id And User Search Term Using GET Deprecated

Search users in organization having username, firstName, lastName or email which "contains" search term.
e.g. search for "test" will return [email protected] if [email protected] is part of the organization.
Search results limited to first 20 results. Please refine the search term for accurate results.
Organization members will receive basic user information. Organization owners and Service Owners (for organizations that have access to the service) will additionally receive role details of the users.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Search Organization Users By Organization Id And Roles Search Term Using POST

Search all users who have at least one of the specified roles and/or resource.
Search by resource can be exact match or by resource starting with given term. At most one of the filters resource or resourceStartsWith may be provided.
For all users found by these search criteria the result contains all users roles, no matter if they are part of the search criteria or not.
To search by resource starting with given term provide resourceStartsWith.
If resource is empty then unscoped role assignments will be returned.
When role is provided and resource is null all role assignments will be returned.
When filterResults flag is true the result is filtered by search parameters from the request: resource, resourceStartsWith and roles names.
In this case the result contains just the roles that match the search criteria.
Paginated results - by default start index of results is 1 and default number of search results per page is 200.
Searching access restricted to Organization Owners, Read-only operators and Service Owners (for organizations that have access to the service).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Project Admin	✔️	✔️

DELETE

Remove Users From Organization By Organization Id Using DELETE

Remove users from organization by user ids.
User ids will be of the format : e.g. vmware.com:820e7ca5-4024-407e-8db4-f552d5d03403.
Pay attention: in case of partial success the caller must read the response to see which users have not been added successfully

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Organization Users By Organization Id Using GET

Get response encapsulating organization users.
Fetched page is according to the page start and page limit passed as optional parameters.
Optionally provide "serviceDefinitionId" to filter users having access to a service. Organization Members are permitted to see only basic user information. Organization owners, read-only administrators and organization admins will see also organization and service roles of the users and userProfile if expandProfile is passed.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

Organization Groups

DELETE

Remove Groups From Organization By Organization Id And Groups Id Using DELETE

Remove groups from organization.
Note:

1. Removing an organization custom group permanently deletes the group.
2. DEPRECATED: Response field failed will be deprecated. You can use the field failures instead.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Organization Groups By Organization Id Using GET

Get groups of a specific organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Create Custom Group In Organization By Organization Id Using POST

Create a new custom group in organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Search Groups Within Organization By Organization Id And Group Roles Using POST

Get all groups within organization that have certain role(s) and/or resource, including subgroups if they have a role assigned to their parent group (which affects them as well).
For all groups found by these search criteria the result contains all groups roles, no matter if they are part of the search criteria or not.
Search by resource can be exact match or by resource starting with given term. At most one of the filters resource or resourceStartsWith may be provided.
To search by resource starting with given term provide resourceStartsWith.
If resource is empty then unscoped role assignments will be returned.
When role is provided and resource is null all role assignments will be returned.
When filterResults flag is true the result is filtered by search parameters from the request: resource, resourceStartsWith and roles names.
In this case the result contains just the roles that match the search criteria.
Paginated results - by default start index of results is 1 and default number of search results per page is 200.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Group In Organization By Organization Id And Group Id Using GET

Get details of a group within organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

PATCH

Update Group Details In Organization By Organization Id And Group Id Using PATCH

Update details of a custom group within organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Nested Enterprise Groups From Custom Group By Organization Id And Group Id Using GET

Get nested enterprise groups from custom group

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Group Roles On Organization By Organization Id And Group Id Using GET

Get roles of a group within organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

PATCH

Update Group Roles On Organization By Organization Id And Group Id Using PATCH

Update roles of a group within organization.
Note: Email notification for updating group roles of group with more than 500 users will not be sent to its users.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

DELETE

Remove Users From Custom Group In Organization By Organization Id And Group Id And User Ids Using DELETE

Removes users from custom group within organization.
Note: Only users of custom groups can be removed.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get Users In Group Within Organization By Organization Id And Group Id Using GET

Get users in group within organization. Optionally filtered by given firstName, lastName or email with 'contains' match. Optionally filter the users by using onlyDirectUsers with true to return only direct users and not return the users from nested groups.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Add Users To Custom Group In Organization By Organization Id And Group Id Using POST

Adds users to custom group within organization.
Note: Users can only be added to custom groups.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

Organization Managed Oauth Apps (clients)

DELETE

Delete Organization O Auth Application By Organization Id Using DELETE

Delete Organization Managed OAuth Apps.
Pay attention: in case of partial success the caller must read the response to see which apps haven't been removed

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

GET

Get All Organization O Auth Applications By Orgainzation Id Using GET

Get all Organization Managed OAuth Apps that were created and are owned by the organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

POST

Create Organization O Auth Application By Organization Id Using POST

Create Organization Managed OAuth App. The created app will be owned by the organization.
Client ID and Client Secret are generated automatically if not provided. Clients can be created with open redirect Urls, using allowOpenRedirectUris = true. In this case, the redirectUris field must not be specified. Such clients will allow redirection to any custom url. This feature can only be used in non-production environments.
Important:

• If the grant type is client_delegate the refreshTokenTTL is limited to 14 days.
• Refresh token ttl should higher than access token ttl. Default access token ttl is 10 minutes. Default refresh token ttl is 90 days.
• If client deletion is in progress, 409 error will be thrown. Please try again later.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

POST

Search Organization Clients By Role Names Using POST

Search all clients who have at least one of the specified roles and/or resource.
Search by resource can be exact match or by resource starting with given term. At most one of the filters resource or resourceStartsWith may be provided.
For all clients found by these search criteria the result contains all clients roles, no matter if they are part of the search criteria or not.
To search by resource starting with given term provide resourceStartsWith.
If resource is empty then unscoped role assignments will be returned.
When role is provided and resource is null all role assignments will be returned.
Paginated results - by default start index of results is 1 and default number of search results per page is 15.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌
Developer	✔️	❌

GET

Get Organization O Auth Application By Organization Id And Application Id Using GET

Get Organization Managed OAuth App that was created and is owned by the organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

PATCH

Update Organization O Auth Application By Organization Id And Application Id Using PATCH

Update Organization Managed OAuth App that was created and is owned by the organization
Important:

• Changing the client secret via the client management APIs will reset existing secret rotation (meaning, the provided secret in the management APIs will be the only valid secret).
• If the grant type is client_delegate the refreshTokenTTL is limited to 14 days.
• Refresh token ttl should higher than access token ttl. Default access token ttl is 10 minutes. Default refresh token ttl is 90 days.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

DELETE

Delete Old Client Secret Via Owner Client Rotation By Organization Id And O Auth App Id Using DELETE

Once the rotation is done, the new secret will become the client's only valid secret.
Important:
1.The old client secret will be expired after 48 hours.
2.Changing the client secret via the client management APIs will reset existing secret rotation (meaning, the provided secret in the management APIs will be the only valid secret).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

POST

Set New Client Secret Via Owner Client Rotation By Organization Id And Application Id Using POST

Once a 'newClientSecret' is set, both the old and the new secret can be used.
Important:
1.The old client secret will be expired after 48 hours.
2.Changing the client secret via the client management APIs will reset existing secret rotation (meaning, the provided secret in the management APIs will be the only valid secret).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

PUT

Update Organization O Auth Application Secret By Orgnization Id And Application Id Using PUT

Regenerate Organization Managed OAuth App Secret An empty JSON body {} is required in order to invoke the API.
Important:
Changing the client secret via the client management APIs will reset existing secret rotation (meaning, the provided secret in the management APIs will be the only valid secret).

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️
Developer	✔️	✔️

Organization Trust Management

GET

Get Trust Member Organizations Using GET

Get organization's trust members.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Create Trust Member Organization Using POST

Create trust member organization. Only HIERARCHY and PARTNER trust types are allowed

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

POST

Invite Member Orgs Using POST

Invite member organizations to management organization by creating a pending hierarchical organization trusts between each member organization and the management organization. The member org can then update the trust to become active.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

GET

Get Organization Trusts Using GET

Get organization trusts.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Create Organization Trust Using POST

Create organization trust between two organizations. Org owner can ONLY create trust type of CUSTOM.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

DELETE

Remove Organization Trust Using DELETE

Remove organization trust.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

PATCH

Update Organization Trust Using PATCH

Update organization trust.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

POST

Create Trust Member Organization V2 Using POST

Create trust member organization. Only HIERARCHY and PARTNER trust types are allowed

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Owner	✔️	✔️

Principal User

GET

Get Loggedin User Using GET

Get principal user information.
Principal user is identified via a token. The token should be passed in a header called csp-auth-token.If expandProfile is passed in the request user profile information will be also returned.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

POST

Generate User Api Token Using POST

Programmatically Generate User Api Token. The following restrictions are in place: .

1. 'All Roles' or high privilege organization roles are not allowed as a scope for the new API token (few exceptions apply)
2. Organization ID in Access token (in headers) and ID token (in request body) should be the same.
3. Maximum number of 50 API tokens is allowed.
4. In non-production environments it is possible to choose for which of your organizations to generate token.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Loggedin User Organizations Using GET Deprecated

Get organizations of principal user.
Principal user is identified via a token. The token should be passed in a header called csp-auth-token.If expand parameter is passed, detailed information for the organizations will be returned.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Logged In User Groups On Organization By Organization Id Using GET

Get Principal User Groups Information Within the Specified Organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Logged In User Info Using GET

Get principal user information and roles by organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Logged In User Roles On Organization By Organization Id Using GET

Get principal user roles within the specified organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Logged In User Service Roles On Organization By Organization Id Using GET

Get principal user service roles within the specified organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

PUT

Set Default Organization Using PUT Deprecated

Set default organization for principal user.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

GET

Get Loggedin User Organizations V2 Using GET

Get organizations of principal user.
Principal user is identified via a token. The token should be passed in a header called csp-auth-token.If expand parameter is passed, detailed information for the organizations will be returned.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
All Roles	✔️	❌

User

GET

Get User Groups By User Email And Organization Id Using GET

Get user groups by account identifier

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get User Custom Roles By User Id And Organization Id Using GET

Get user custom roles in an organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

POST

Search Users In Idp By Names And Email Using POST

Search users in idp by names and email.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Member	✔️	✔️
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get User Groups By User Id And Organization Id Using GET

Get user groups by userId

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get User Info By User Id And Organization Id Using GET

Get user information for a specific organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	❌
Organization Owner	✔️	❌

GET

Get User Organization Roles By User Id And Organization Id Using GET

Get user roles in an organization.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

GET

Get User Service Roles By User Id And Organization Id Using GET

Get user service roles in an organization.
The query parameter 'serviceDefinitionLink' is used for filtering for specific service definition.

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️

PATCH

Update User Roles By User Id And Organization Id Using PATCH

Update service and organization roles of a user in the organization

Access Policy

Role	User Accounts	Service Accounts (Client Credentials Applications)
Organization Admin	✔️	✔️
Organization Owner	✔️	✔️