{"name":"iam","stage":"ga","description":"Package iam is Hanzo's identity provider: users, organizations, applications, and the OIDC/OAuth2 endpoints every Hanzo service authenticates against.","operations":[{"operationId":"get_iam_.well-known_jwks","method":"GET","href":"/v1/iam/.well-known/jwks","summary":"Publishes the public keys that verify the tokens issued here — the one URL you point a service at so it can check a token itself, offline, without calling back and without holding any secret of ours."},{"operationId":"get_iam_.well-known_oauth-authorization-server","method":"GET","href":"/v1/iam/.well-known/oauth-authorization-server","summary":"Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand."},{"operationId":"get_iam_.well-known_openid-configuration","method":"GET","href":"/v1/iam/.well-known/openid-configuration","summary":"Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand."},{"operationId":"get_iam_account","method":"GET","href":"/v1/iam/account","summary":"Returns the signed-in person's own account and the organization they belong to — what a console reads to draw the account menu."},{"operationId":"put_iam_account","method":"PUT","href":"/v1/iam/account","summary":"Saves the calling person's own profile — the name they are shown by, their picture, a line about themselves and a link."},{"operationId":"get_iam_accounts","method":"GET","href":"/v1/iam/accounts","summary":"Returns the people signed in on this browser, the most recent sign-in first — what the sign-in page lists when an application asks the person to choose an account."},{"operationId":"upsertApplication","method":"POST","href":"/v1/iam/admin/applications/upsert","summary":"Creates an application or updates it in place, so a deployment can declare the applications it needs and run the same declaration on every environment and on every redeploy."},{"operationId":"post_iam_admin_provision","method":"POST","href":"/v1/iam/admin/provision","summary":"Founds an org on someone's behalf — the same onboarding a person gets themselves, driven by one of your own services instead of by them."},{"operationId":"upsertUser","method":"POST","href":"/v1/iam/admin/users/upsert","summary":"Creates a person or updates them in place, so a deployment can declare the accounts it needs and re-run that declaration safely."},{"operationId":"get_iam_applications","method":"GET","href":"/v1/iam/applications","summary":"Returns the applications in one organization, newest first — each product or site your people sign in to, with the sign-in methods and redirect URIs it allows."},{"operationId":"post_iam_applications","method":"POST","href":"/v1/iam/applications","summary":"Registers an application in your organization — one product or site your people sign in to, with its own client credentials, sign-in methods and allowed redirect URIs."},{"operationId":"delete_iam_applications_by_owner_by_name","method":"DELETE","href":"/v1/iam/applications/{owner}/{name}","summary":"Removes an application."},{"operationId":"get_iam_applications_by_owner_by_name","method":"GET","href":"/v1/iam/applications/{owner}/{name}","summary":"Returns one application: its sign-in methods, its allowed redirect URIs and the client credentials your integration authenticates with."},{"operationId":"put_iam_applications_by_owner_by_name","method":"PUT","href":"/v1/iam/applications/{owner}/{name}","summary":"Changes an application's display, its sign-in methods and the redirect URIs it may return to — the call that makes login work from a new host."},{"operationId":"get_iam_audit-logs","method":"GET","href":"/v1/iam/audit-logs","summary":"Returns your organization's audit trail, newest first — who did what, when, and from where."},{"operationId":"post_iam_audit-logs","method":"POST","href":"/v1/iam/audit-logs","summary":"Records an audit entry, so activity from your own systems lands in the same trail as everything the Hanzo Cloud records for you."},{"operationId":"delete_iam_audit-logs_by_owner_by_name","method":"DELETE","href":"/v1/iam/audit-logs/{owner}/{name}","summary":"Removes an audit entry."},{"operationId":"get_iam_audit-logs_by_owner_by_name","method":"GET","href":"/v1/iam/audit-logs/{owner}/{name}","summary":"Returns one audit entry in full: the action, the person or key behind it, and the request it came in on."},{"operationId":"put_iam_audit-logs_by_owner_by_name","method":"PUT","href":"/v1/iam/audit-logs/{owner}/{name}","summary":"Corrects an audit entry."},{"operationId":"get_iam_auth_application","method":"GET","href":"/v1/iam/auth/application","summary":"Returns everything a login screen needs to draw itself for one application: its branding, and each sign-in method it offers with the provider details that method needs."},{"operationId":"post_iam_auth_identifier","method":"POST","href":"/v1/iam/auth/identifier","summary":"Answers whether an account holds an email address at an application, and whether that account signs in with a password."},{"operationId":"get_iam_auth_methods","method":"GET","href":"/v1/iam/auth/methods","summary":"Returns the sign-in methods one application actually has switched on, so a login screen can render the right buttons for it without you hard-coding a list that drifts the moment you add a provider."},{"operationId":"get_iam_certs","method":"GET","href":"/v1/iam/certs","summary":"Returns your organization's signing certificates, newest first — the keys the tokens your applications verify are signed with."},{"operationId":"post_iam_certs","method":"POST","href":"/v1/iam/certs","summary":"Adds a signing certificate your applications can verify tokens against — the call you make to stage the next one before a rotation."},{"operationId":"delete_iam_certs_by_owner_by_name","method":"DELETE","href":"/v1/iam/certs/{owner}/{name}","summary":"Removes a signing certificate."},{"operationId":"get_iam_certs_by_owner_by_name","method":"GET","href":"/v1/iam/certs/{owner}/{name}","summary":"Returns one signing certificate — its algorithm, its validity window and its public half."},{"operationId":"put_iam_certs_by_owner_by_name","method":"PUT","href":"/v1/iam/certs/{owner}/{name}","summary":"Changes a signing certificate's settings."},{"operationId":"get_iam_consent","method":"GET","href":"/v1/iam/consent","summary":"Returns the calling person's own privacy and communication choices."},{"operationId":"put_iam_consent","method":"PUT","href":"/v1/iam/consent","summary":"Records the calling person's privacy and communication choices."},{"operationId":"post_iam_delete-membership","method":"POST","href":"/v1/iam/delete-membership","summary":"Takes away a person's or an application's right to act in an organization."},{"operationId":"get_iam_invitations","method":"GET","href":"/v1/iam/invitations","summary":"Returns your organization's invitations, newest first — who has been asked to join, on what terms, and how many seats each invitation still has left."},{"operationId":"post_iam_invitations","method":"POST","href":"/v1/iam/invitations","summary":"Issues an invitation to join your organization — the code or link a new member redeems, with the role they arrive holding and the date it stops working."},{"operationId":"post_iam_invitations_accept","method":"POST","href":"/v1/iam/invitations/accept","summary":"Joins the caller to an organization through an invitation, for a person who already has an account."},{"operationId":"delete_iam_invitations_by_owner_by_name","method":"DELETE","href":"/v1/iam/invitations/{owner}/{name}","summary":"Withdraws an invitation."},{"operationId":"get_iam_invitations_by_owner_by_name","method":"GET","href":"/v1/iam/invitations/{owner}/{name}","summary":"Returns one invitation: who it is for, what it grants on acceptance, and when it expires."},{"operationId":"put_iam_invitations_by_owner_by_name","method":"PUT","href":"/v1/iam/invitations/{owner}/{name}","summary":"Changes an invitation's terms — the role it grants, how many may redeem it, or when it expires."},{"operationId":"post_iam_invitations_by_owner_by_name_send","method":"POST","href":"/v1/iam/invitations/{owner}/{name}/send","summary":"Emails an invitation to the address it is pinned to: who invited them, to which organization, and the link that joins them."},{"operationId":"get_iam_keys","method":"GET","href":"/v1/iam/keys","summary":"Returns the API keys of an organization that you may see, newest first — what each is called, what it may reach, its publishable half, and when it was last used."},{"operationId":"post_iam_keys","method":"POST","href":"/v1/iam/keys","summary":"Issues an API key."},{"operationId":"get_iam_keys_org","method":"GET","href":"/v1/iam/keys/org","summary":"Resolve a PUBLISHABLE key to the organization that owns it"},{"operationId":"get_iam_keys_principal","method":"GET","href":"/v1/iam/keys/principal","summary":"Resolve a SECRET key to the principal it authenticates"},{"operationId":"delete_iam_keys_by_owner_by_name","method":"DELETE","href":"/v1/iam/keys/{owner}/{name}","summary":"Revokes an API key."},{"operationId":"get_iam_keys_by_owner_by_name","method":"GET","href":"/v1/iam/keys/{owner}/{name}","summary":"Returns one API key: what it is called, what it may reach, and when it was issued."},{"operationId":"put_iam_keys_by_owner_by_name","method":"PUT","href":"/v1/iam/keys/{owner}/{name}","summary":"Changes what a key is called, what it may reach, when it expires, or revokes it."},{"operationId":"get_iam_link","method":"GET","href":"/v1/iam/link","summary":"Continues a link in the browser of the person it is for: the browser opens the address POST /v1/iam/link answered, as a top-level navigation, signed in here as that person, and is sent on to the provider."},{"operationId":"post_iam_link","method":"POST","href":"/v1/iam/link","summary":"Starts connecting another sign-in identity to the account you are already signed in as."},{"operationId":"get_iam_linked-accounts","method":"GET","href":"/v1/iam/linked-accounts","summary":"Returns the sign-in identities linked to the calling person's account — every provider they can currently sign in with."},{"operationId":"post_iam_login","method":"POST","href":"/v1/iam/login","summary":"Signs a person in with the credential they typed, and — when the request is part of an OAuth flow — hands back the one-time code that finishes it."},{"operationId":"get_iam_memberships","method":"GET","href":"/v1/iam/memberships","summary":"Answers either question about who belongs where: which organizations one person can act in, or who can act in one organization."},{"operationId":"post_iam_memberships","method":"POST","href":"/v1/iam/memberships","summary":"Lets a person or an application act in an organization."},{"operationId":"delete_iam_mfa","method":"DELETE","href":"/v1/iam/mfa","summary":"Turns a factor off, so sign-in stops asking for it."},{"operationId":"post_iam_mfa_preferred","method":"POST","href":"/v1/iam/mfa/preferred","summary":"Picks which second factor an account is asked for first when it has more than one."},{"operationId":"post_iam_mfa_setup_enable","method":"POST","href":"/v1/iam/mfa/setup/enable","summary":"Finishes the enrolment: from here the account's sign-ins ask for this factor."},{"operationId":"post_iam_mfa_setup_initiate","method":"POST","href":"/v1/iam/mfa/setup/initiate","summary":"Starts enrolling a factor and hands over whatever the person needs to prove they hold it: app a fresh secret and the otpauth:// URL to render as a QR code sms a code texted to the number on the account email a code mailed to the address on the account Nothing is switched on yet, so abandoning this step leaves the account exactly as it was."},{"operationId":"get_iam_oauth_authorize","method":"GET","href":"/v1/iam/oauth/authorize","summary":"Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow."},{"operationId":"post_iam_oauth_authorize","method":"POST","href":"/v1/iam/oauth/authorize","summary":"Starts a sign-in — the address you send a browser to, and the beginning of every OAuth and OpenID Connect flow."},{"operationId":"get_iam_oauth_callback","method":"GET","href":"/v1/iam/oauth/callback","summary":"Completes the round-trip: it resolves and burns the single-use transaction (checking expiry + browser binding), exchanges and verifies the IdP response, links or provisions the local user, and mints the iam authorization code the relying party expects — then redirects to the original redirect_uri with code + state."},{"operationId":"post_iam_oauth_callback","method":"POST","href":"/v1/iam/oauth/callback","summary":"Completes the round-trip: it resolves and burns the single-use transaction (checking expiry + browser binding), exchanges and verifies the IdP response, links or provisions the local user, and mints the iam authorization code the relying party expects — then redirects to the original redirect_uri with code + state."},{"operationId":"get_iam_oauth_delegation_keys","method":"GET","href":"/v1/iam/oauth/delegation/keys","summary":"Serves the public half of every delegation key, as a JWKS, to a confidential client allowed to delegate — the one resource server that verifies what it is handed, reading with the credential it delegates with."},{"operationId":"post_iam_oauth_device","method":"POST","href":"/v1/iam/oauth/device","summary":"Starts a sign-in on a device with no browser and no keyboard — a TV, a CLI, a headless box."},{"operationId":"post_iam_oauth_device_info","method":"POST","href":"/v1/iam/oauth/device/info","summary":"Answers \"what am I approving?\" for a pending device code."},{"operationId":"post_iam_oauth_federation_mfa","method":"POST","href":"/v1/iam/oauth/federation/mfa","summary":"Completes a sign-in that came in through another identity provider and still owes a second factor."},{"operationId":"post_iam_oauth_introspect","method":"POST","href":"/v1/iam/oauth/introspect","summary":"Answers whether an access token is still good, and what it is good for — the check a resource server of yours makes before honouring a token it did not mint."},{"operationId":"get_iam_oauth_logout","method":"GET","href":"/v1/iam/oauth/logout","summary":"Ends a sign-in and sends the browser somewhere sensible."},{"operationId":"post_iam_oauth_logout","method":"POST","href":"/v1/iam/oauth/logout","summary":"Ends a sign-in and sends the browser somewhere sensible."},{"operationId":"post_iam_oauth_refresh_token","method":"POST","href":"/v1/iam/oauth/refresh_token","summary":"Exchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a refresh token, or your own client credentials when the caller is a program rather than a person."},{"operationId":"post_iam_oauth_revoke","method":"POST","href":"/v1/iam/oauth/revoke","summary":"Retires a token before it expires — what you call when someone signs out or a credential may have leaked."},{"operationId":"post_iam_oauth_token","method":"POST","href":"/v1/iam/oauth/token","summary":"Exchanges what your application is holding for the tokens it needs — the one-time code from a finished sign-in, a refresh token, or your own client credentials when the caller is a program rather than a person."},{"operationId":"get_iam_oauth_userinfo","method":"GET","href":"/v1/iam/oauth/userinfo","summary":"Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is calling you without your application storing anything itself."},{"operationId":"post_iam_oauth_userinfo","method":"POST","href":"/v1/iam/oauth/userinfo","summary":"Returns the profile claims for whoever the access token belongs to — the standard OpenID Connect way to find out who is calling you without your application storing anything itself."},{"operationId":"post_iam_onboard","method":"POST","href":"/v1/iam/onboard","summary":"Finishes setting up the account of whoever is calling — it creates their organization if they have none and puts them in it, so a person who has just signed up lands somewhere they can work."},{"operationId":"listOrganizations","method":"GET","href":"/v1/iam/organizations","summary":"Returns the organizations you can act in, the ones you belong to first and the rest after, newest first, narrowed by an optional query against the name or the display name."},{"operationId":"createOrganization","method":"POST","href":"/v1/iam/organizations","summary":"Makes a new organization — the account your users, applications, roles, projects and workspaces are all named inside."},{"operationId":"setOrganizationAvatar","method":"POST","href":"/v1/iam/organizations/avatar","summary":"Changes how an organization appears across Hanzo: the square mark beside its name, as an uploaded image or as a single emoji."},{"operationId":"setOrganizationProfile","method":"POST","href":"/v1/iam/organizations/profile","summary":"Changes how an organization reads: its display name, its website and its favicon."},{"operationId":"releaseOrganizationName","method":"DELETE","href":"/v1/iam/organizations/tombstones/{owner}/{name}","summary":"Frees the name of a deleted organization so it can be founded again."},{"operationId":"getOrganizationTombstone","method":"GET","href":"/v1/iam/organizations/tombstones/{owner}/{name}","summary":"Returns what holds a deleted organization's name: when it was deleted and who founded it."},{"operationId":"deleteOrganization","method":"DELETE","href":"/v1/iam/organizations/{owner}/{name}","summary":"Removes an organization and everything named inside it."},{"operationId":"getOrganization","method":"GET","href":"/v1/iam/organizations/{owner}/{name}","summary":"Returns one organization: its display, its defaults and the sign-in rules everyone in it inherits."},{"operationId":"updateOrganization","method":"PUT","href":"/v1/iam/organizations/{owner}/{name}","summary":"Changes an organization's display, its defaults and the sign-in rules everyone in it inherits."},{"operationId":"put_iam_password","method":"PUT","href":"/v1/iam/password","summary":"Replaces the calling person's password."},{"operationId":"get_iam_permissions","method":"GET","href":"/v1/iam/permissions","summary":"Returns the permissions in one organization, newest first — each one a grant saying which people or roles may do what, and to which resources."},{"operationId":"post_iam_permissions","method":"POST","href":"/v1/iam/permissions","summary":"Grants a permission — the call that gives a person or a role the ability to do something."},{"operationId":"delete_iam_permissions_by_owner_by_name","method":"DELETE","href":"/v1/iam/permissions/{owner}/{name}","summary":"Revokes a permission."},{"operationId":"get_iam_permissions_by_owner_by_name","method":"GET","href":"/v1/iam/permissions/{owner}/{name}","summary":"Returns one permission: who it grants to, what it allows, and the resources it covers."},{"operationId":"put_iam_permissions_by_owner_by_name","method":"PUT","href":"/v1/iam/permissions/{owner}/{name}","summary":"Changes who a permission grants to, what it allows, or the resources it covers."},{"operationId":"post_iam_preferences","method":"POST","href":"/v1/iam/preferences","summary":"Saves the calling person's own settings and returns the full set afterwards."},{"operationId":"get_iam_projects","method":"GET","href":"/v1/iam/projects","summary":"Returns your organization's projects, newest first — the scope people pick between when their work is separated by product or client rather than by team."},{"operationId":"post_iam_projects","method":"POST","href":"/v1/iam/projects","summary":"Makes a project inside your organization — the scope people pick between when their work is separated by product or client rather than by team."},{"operationId":"delete_iam_projects_by_owner_by_name","method":"DELETE","href":"/v1/iam/projects/{owner}/{name}","summary":"Removes a project."},{"operationId":"get_iam_projects_by_owner_by_name","method":"GET","href":"/v1/iam/projects/{owner}/{name}","summary":"Returns one project: what it is called and how it is set up."},{"operationId":"put_iam_projects_by_owner_by_name","method":"PUT","href":"/v1/iam/projects/{owner}/{name}","summary":"Changes a project's settings."},{"operationId":"listProviders","method":"GET","href":"/v1/iam/providers","summary":"Returns your organization's providers, newest first — the identity providers your people sign in with, and the senders and connectors your applications go through."},{"operationId":"addProvider","method":"POST","href":"/v1/iam/providers","summary":"Adds an identity provider your people can sign in with, or a service your applications send through — a social or enterprise login, an email or SMS sender, a storage or payment connector."},{"operationId":"deleteProvider","method":"DELETE","href":"/v1/iam/providers/{owner}/{name}","summary":"Removes a provider."},{"operationId":"getProvider","method":"GET","href":"/v1/iam/providers/{owner}/{name}","summary":"Returns one provider: what it connects to and how it is configured."},{"operationId":"updateProvider","method":"PUT","href":"/v1/iam/providers/{owner}/{name}","summary":"Changes a provider's settings or rotates the credentials it holds."},{"operationId":"get_iam_registry_jwks","method":"GET","href":"/v1/iam/registry/jwks","summary":"Publishes the public key your registry uses to verify the tokens issued above — the one URL to configure so the registry trusts logins without holding any secret of its own."},{"operationId":"get_iam_registry_token","method":"GET","href":"/v1/iam/registry/token","summary":"Signs a container client in to your registry."},{"operationId":"post_iam_registry_token","method":"POST","href":"/v1/iam/registry/token","summary":"Signs a container client in to your registry."},{"operationId":"get_iam_roles","method":"GET","href":"/v1/iam/roles","summary":"Returns your organization's roles, newest first — each a named group of people that permissions are granted to."},{"operationId":"post_iam_roles","method":"POST","href":"/v1/iam/roles","summary":"Makes a role — a named group of people that permissions are granted to."},{"operationId":"delete_iam_roles_by_owner_by_name","method":"DELETE","href":"/v1/iam/roles/{owner}/{name}","summary":"Removes a role."},{"operationId":"get_iam_roles_by_owner_by_name","method":"GET","href":"/v1/iam/roles/{owner}/{name}","summary":"Returns one role: who is in it, and the roles it includes."},{"operationId":"put_iam_roles_by_owner_by_name","method":"PUT","href":"/v1/iam/roles/{owner}/{name}","summary":"Changes who is in a role, or which roles it includes."},{"operationId":"get_iam_scim_v2_resourcetypes","method":"GET","href":"/v1/iam/scim/v2/ResourceTypes","summary":"Returns the kinds of record this directory provisions and the address of each, so your identity provider discovers them rather than having them configured by hand."},{"operationId":"get_iam_scim_v2_resourcetypes_by_name","method":"GET","href":"/v1/iam/scim/v2/ResourceTypes/{name}","summary":"Returns one provisionable record kind in full."},{"operationId":"get_iam_scim_v2_schemas","method":"GET","href":"/v1/iam/scim/v2/Schemas","summary":"Returns the attribute definitions this directory understands, so your identity provider knows which fields it may send and what they mean before it sends any."},{"operationId":"get_iam_scim_v2_schemas_by_id","method":"GET","href":"/v1/iam/scim/v2/Schemas/{id}","summary":"Returns one attribute definition in full."},{"operationId":"get_iam_scim_v2_serviceproviderconfig","method":"GET","href":"/v1/iam/scim/v2/ServiceProviderConfig","summary":"Tells your identity provider which parts of SCIM this directory supports, so it configures itself instead of you filling in a form."},{"operationId":"get_iam_scim_v2_users","method":"GET","href":"/v1/iam/scim/v2/Users","summary":"Returns the people in your organization to your identity provider, in the standard SCIM shape, so an IdP can reconcile its directory against ours."},{"operationId":"post_iam_scim_v2_users","method":"POST","href":"/v1/iam/scim/v2/Users","summary":"Provisions a person from your identity provider — how a new hire gets an account here automatically when they are added over there."},{"operationId":"delete_iam_scim_v2_users_by_owner_by_name","method":"DELETE","href":"/v1/iam/scim/v2/Users/{owner}/{name}","summary":"Deprovisions a person — how removing someone in your identity provider removes their access here."},{"operationId":"get_iam_scim_v2_users_by_owner_by_name","method":"GET","href":"/v1/iam/scim/v2/Users/{owner}/{name}","summary":"Returns one person in the standard SCIM shape."},{"operationId":"patch_iam_scim_v2_users_by_owner_by_name","method":"PATCH","href":"/v1/iam/scim/v2/Users/{owner}/{name}","summary":"Applies a partial change from your identity provider — one attribute moved, not the whole record resent."},{"operationId":"put_iam_scim_v2_users_by_owner_by_name","method":"PUT","href":"/v1/iam/scim/v2/Users/{owner}/{name}","summary":"Overwrites a person's SCIM attributes with what your identity provider sends — how a change made there lands here."},{"operationId":"get_iam_service-accounts","method":"GET","href":"/v1/iam/service-accounts","summary":"Returns your organization's service accounts — what each is called and when it was created."},{"operationId":"post_iam_service-accounts","method":"POST","href":"/v1/iam/service-accounts","summary":"Makes a service account — an identity for a program rather than a person, for a script, a bot or a deployment that has to authenticate on its own."},{"operationId":"delete_iam_service-accounts_by_name","method":"DELETE","href":"/v1/iam/service-accounts/{name}","summary":"Serves DELETE /v1/iam/service-accounts/:name."},{"operationId":"post_iam_service-accounts_by_name_keys","method":"POST","href":"/v1/iam/service-accounts/{name}/keys","summary":"Serves POST /v1/iam/service-accounts/:name/keys: mint a fresh key, invalidating the prior one, and return the new raw secret exactly once."},{"operationId":"listSessions","method":"GET","href":"/v1/iam/sessions","summary":"Returns who is currently signed in to an organization, newest first, and can be narrowed to one person or one application."},{"operationId":"createSession","method":"POST","href":"/v1/iam/sessions","summary":"Records a sign-in and answers with the cookie id it minted."},{"operationId":"deleteSession","method":"DELETE","href":"/v1/iam/sessions/{owner}/{name}/{application}","summary":"Signs a person out of one application — the session ends and every browser carrying it stops being authenticated."},{"operationId":"getSession","method":"GET","href":"/v1/iam/sessions/{owner}/{name}/{application}","summary":"Returns one person's session in one application — when it began and which browsers or devices are still carrying it."},{"operationId":"updateSession","method":"PUT","href":"/v1/iam/sessions/{owner}/{name}/{application}","summary":"Names the browsers a session keeps — signing out the ones you leave off while the session itself stays live."},{"operationId":"post_iam_signin","method":"POST","href":"/v1/iam/signin","summary":"Completes a sign-in: it exchanges the one-time code your application was handed at the end of the login flow for a live session, and returns the signed-in account."},{"operationId":"post_iam_signup","method":"POST","href":"/v1/iam/signup","summary":"Creates an account from the sign-up form and applies the application's own sign-up rules — whether self-service registration is open at all, and which fields it requires."},{"operationId":"get_iam_teams","method":"GET","href":"/v1/iam/teams","summary":"Returns your organization's teams, newest first — each a named set of people that roles and permissions are granted to."},{"operationId":"post_iam_teams","method":"POST","href":"/v1/iam/teams","summary":"Makes a team — a named set of people that roles and permissions grant to."},{"operationId":"delete_iam_teams_by_name","method":"DELETE","href":"/v1/iam/teams/{name}","summary":"Removes a team."},{"operationId":"get_iam_teams_by_name","method":"GET","href":"/v1/iam/teams/{name}","summary":"Returns one team: who is in it."},{"operationId":"put_iam_teams_by_name","method":"PUT","href":"/v1/iam/teams/{name}","summary":"Changes who is in a team."},{"operationId":"put_iam_terms","method":"PUT","href":"/v1/iam/terms","summary":"Records that the signed-in caller accepted the terms and the acceptable use policy, at the versions named."},{"operationId":"listTokens","method":"GET","href":"/v1/iam/tokens","summary":"Returns the access tokens issued in your organization, newest first, and can be narrowed to one organization."},{"operationId":"addToken","method":"POST","href":"/v1/iam/tokens","summary":"Records an access token — the credential an application or integration presents on a caller's behalf."},{"operationId":"post_iam_tokens_issue","method":"POST","href":"/v1/iam/tokens/issue","summary":"Mints an access token for the `?id=\u003cowner\u003e/\u003cname\u003e` target user (optional `?aud=` resource, RFC 8707), issued by the authenticated + allow-listed confidential client."},{"operationId":"deleteToken","method":"DELETE","href":"/v1/iam/tokens/{owner}/{name}","summary":"Revokes an access token."},{"operationId":"getToken","method":"GET","href":"/v1/iam/tokens/{owner}/{name}","summary":"Returns one access token: who and what it was issued to, and when it expires."},{"operationId":"updateToken","method":"PUT","href":"/v1/iam/tokens/{owner}/{name}","summary":"Changes an access token's scope or expiry."},{"operationId":"post_iam_unlink","method":"POST","href":"/v1/iam/unlink","summary":"Disconnects one sign-in identity from an account, so that provider can no longer be used to sign in as that person."},{"operationId":"get_iam_users","method":"GET","href":"/v1/iam/users","summary":"Returns a page of the people in an organization, with the total so you can page through the rest."},{"operationId":"post_iam_users","method":"POST","href":"/v1/iam/users","summary":"Adds a person to your organization."},{"operationId":"delete_iam_users_by_owner_by_name","method":"DELETE","href":"/v1/iam/users/{owner}/{name}","summary":"Removes a person from your organization."},{"operationId":"get_iam_users_by_owner_by_name","method":"GET","href":"/v1/iam/users/{owner}/{name}","summary":"Returns one person in your organization, addressed by their username or by their email address."},{"operationId":"put_iam_users_by_owner_by_name","method":"PUT","href":"/v1/iam/users/{owner}/{name}","summary":"Changes a person's profile, their roles, or the credentials they sign in with."},{"operationId":"delete_iam_users_by_owner_by_name_keys","method":"DELETE","href":"/v1/iam/users/{owner}/{name}/keys","summary":"Clears the target user's key of the requested TYPE (immediate revoke)."},{"operationId":"post_iam_users_by_owner_by_name_keys","method":"POST","href":"/v1/iam/users/{owner}/{name}/keys","summary":"(re)generates the target user's key of the requested TYPE and returns it once, over the shared authorizeMinter + mintTarget seam."},{"operationId":"post_iam_verification-codes","method":"POST","href":"/v1/iam/verification-codes","summary":"Validates the request and asks otp to get a code to the person."},{"operationId":"get_iam_web3_nonce","method":"GET","href":"/v1/iam/web3/nonce","summary":"Starts a wallet sign-in: it returns a one-time challenge for the wallet to sign."},{"operationId":"post_iam_web3_verify","method":"POST","href":"/v1/iam/web3/verify","summary":"Completes a wallet sign-in: it verifies the signed challenge and, if it holds, signs the wallet's owner in."},{"operationId":"listWebauthnCredentials","method":"GET","href":"/v1/iam/webauthn-credentials","summary":"Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered."},{"operationId":"addWebauthnCredential","method":"POST","href":"/v1/iam/webauthn-credentials","summary":"Registers a passkey or security key for a person, so they can sign in with their device instead of a password."},{"operationId":"deleteWebauthnCredential","method":"DELETE","href":"/v1/iam/webauthn-credentials/{owner}/{name}","summary":"Removes a passkey or security key — what you call when a device is lost."},{"operationId":"getWebauthnCredential","method":"GET","href":"/v1/iam/webauthn-credentials/{owner}/{name}","summary":"Returns one passkey or security key: whose it is, what device it lives on, and when it was registered."},{"operationId":"updateWebauthnCredential","method":"PUT","href":"/v1/iam/webauthn-credentials/{owner}/{name}","summary":"Renames a registered passkey or security key, so a person can tell their devices apart."},{"operationId":"get_iam_webauthn_signin_begin","method":"GET","href":"/v1/iam/webauthn/signin/begin","summary":"Starts a passkey sign-in: it returns the challenge the person's authenticator signs."},{"operationId":"post_iam_webauthn_signin_finish","method":"POST","href":"/v1/iam/webauthn/signin/finish","summary":"Verifies the signed challenge and signs the person in."},{"operationId":"get_iam_webauthn_signup_begin","method":"GET","href":"/v1/iam/webauthn/signup/begin","summary":"Starts enrolling a passkey for the signed-in person: it returns the options their browser hands to the authenticator."},{"operationId":"post_iam_webauthn_signup_finish","method":"POST","href":"/v1/iam/webauthn/signup/finish","summary":"Verifies the newly created passkey and stores it, so the person can sign in with their device from then on."},{"operationId":"get_iam_whoami","method":"GET","href":"/v1/iam/whoami","summary":"Tells you who the current caller is — the lightweight check a page makes on load to decide whether to render signed-in or signed-out."},{"operationId":"get_iam_workspaces","method":"GET","href":"/v1/iam/workspaces","summary":"Returns your organization's workspaces, newest first — the scope a team works in, alongside projects rather than instead of them."},{"operationId":"post_iam_workspaces","method":"POST","href":"/v1/iam/workspaces","summary":"Makes a workspace inside your organization — the scope a team works in, alongside projects rather than instead of them."},{"operationId":"delete_iam_workspaces_by_owner_by_name","method":"DELETE","href":"/v1/iam/workspaces/{owner}/{name}","summary":"Removes a workspace."},{"operationId":"get_iam_workspaces_by_owner_by_name","method":"GET","href":"/v1/iam/workspaces/{owner}/{name}","summary":"Returns one workspace: what it is called and how it is set up."},{"operationId":"put_iam_workspaces_by_owner_by_name","method":"PUT","href":"/v1/iam/workspaces/{owner}/{name}","summary":"Changes a workspace's settings."}],"_links":{"describedby":{"href":"/v1/openapi.json?capability=iam"},"self":{"href":"/v1/iam"},"up":{"href":"/v1"}}}