Thoryn Customer-plane Management API

Version v1. This reference is generated from the committed OpenAPI specification (docs/api/product-api.openapi.yaml) and covers 80 resources across 352 operations. It is the customer-plane surface that tenant developers and the thoryn CLI integrate against, served by product-api behind the public api-gateway ingress.

Base URL: https://api.stg.thoryn.org

Conventions

• Versioning — every path is under /api/v1; the API evolves additively within a major version.
• JSON shape — request and response bodies use camelCase field names and RFC 3339 UTC timestamps.
• Collections & pagination — list endpoints return a { data, pagination: { cursor, hasMore } } envelope; page forward by passing the returned cursor back as the cursor query parameter.
• Errors — failures use RFC 9457 problem-details (application/problem+json) with a stable errorCode extension member. Branch on errorCode, not on the type URI or the HTTP status alone.
• Idempotent retries — mutating operations that accept an Idempotency-Key request header deduplicate retried requests.
• Authentication — OAuth 2.0 bearer tokens minted at the authorization hub (client_credentials for machine-to-machine), gated by the per-operation tenant:* scopes below. Per-request tenant isolation is enforced from the tnt claim in the token, never from a path or query parameter.
• Observability — authenticated responses carry X-RateLimit-* headers and a correlation request id for support.

Authentication

Every operation requires an OAuth 2.0 bearer token obtained from the authorization hub via the client_credentials grant (token endpoint https://hub.stg.thoryn.org/oauth2/token). The token carries the caller's granted tenant:* scopes and a tnt tenant claim; product-api rejects any scope the token does not hold with 403 Forbidden and scopes the request to the token's tenant.

Scopes

Scope	Description
tenant:applications.read	Read access to applications.
tenant:applications.write	Manage applications.
tenant:attribute-schema.read	Read access to attribute-schema.
tenant:attribute-schema.write	Manage attribute-schema.
tenant:audit.read	Read access to audit.
tenant:auth-policy.read	Read access to auth-policy.
tenant:auth-policy.write	Manage auth-policy.
tenant:bot.read	Read access to bot.
tenant:bot.write	Manage bot.
tenant:ca_policies.write	Manage ca_policies.
tenant:clients.read	Read access to clients.
tenant:clients.write	Manage clients.
tenant:compliance.export	'export' operations on compliance.
tenant:compliance.read	Read access to compliance.
tenant:compliance.write	Manage compliance.
tenant:dsar.execute	'execute' operations on dsar.
tenant:dsar.read	Read access to dsar.
tenant:entitlement.admin	'admin' operations on entitlement.
tenant:entitlement.approve	'approve' operations on entitlement.
tenant:entitlement.read	Read access to entitlement.
tenant:environments.read	Read access to environments.
tenant:environments.write	Manage environments.
tenant:events.read	Read access to events.
tenant:federation.read	Read access to federation.
tenant:federation.write	Manage federation.
tenant:fga.check	'check' operations on fga.
tenant:fga.read	Read access to fga.
tenant:fga.write	Manage fga.
tenant:geo.read	Read access to geo.
tenant:geo.write	Manage geo.
tenant:guests.invite	'invite' operations on guests.
tenant:guests.manage	'manage' operations on guests.
tenant:hooks.read	Read access to hooks.
tenant:hooks.write	Manage hooks.
tenant:idp.read	Read access to idp.
tenant:idp.write	Manage idp.
tenant:members.read	Read access to members.
tenant:members.write	Manage members.
tenant:migration.entra	'entra' operations on migration.
tenant:migration.read	Read access to migration.
tenant:migration.write	Manage migration.
tenant:orgs.read	Read access to orgs.
tenant:orgs.write	Manage orgs.
tenant:pim.admin	'admin' operations on pim.
tenant:pim.approve	'approve' operations on pim.
tenant:pim.elevate	'elevate' operations on pim.
tenant:policy.read	Read access to policy.
tenant:policy.write	Manage policy.
tenant:roles.read	Read access to roles.
tenant:roles.write	Manage roles.
tenant:security.read	Read access to security.
tenant:security.write	Manage security.
tenant:settings.read	Read access to settings.
tenant:settings.write	Manage settings.
tenant:siem.read	Read access to siem.
tenant:siem.write	Manage siem.
tenant:users.impersonate	'impersonate' operations on users.
tenant:users.import	'import' operations on users.
tenant:users.read	Read access to users.
tenant:users.write	Manage users.
tenant:webhook-schemas.read	Read access to webhook-schemas.
tenant:webhook-schemas.write	Manage webhook-schemas.
tenant:webhooks.read	Read access to webhooks.
tenant:webhooks.write	Manage webhooks.

Resources

Resource	Description	Operations
AppGallery	Curated application-template gallery for pre-filled OAuth client registration.	2
Applications	OAuth client registration and lifecycle — the convergence-target surface (create, patch, secret rotation with 24h overlap, token-usage observability).	8
AttributeSchema	Tenant-defined, typed attribute definitions that type/validate/render the user and organization metadata bags as opinionated forms, plus curated templates an admin applies to bootstrap a schema (SSO-2543).	7
Audit	Tenant-scoped audit-event query API.	2
AuditEventExport	Audit-event CSV export for offline compliance processing.	2
BotPolicy	Bot & abuse detection configuration (SSO-2614) — enable/disable Cloudflare Turnstile per environment; the site key is public, the secret is write-only (stored in Vault, never returned).	2
CoAdmin		8
ComplianceReport	NIS2 / DORA compliance-evidence report generation and download.	3
ConditionalAccessPolicy		5
Consent		7
ConsentPurpose		7
Directories		4
DirectoryAttributeMapping		3
DirectoryConnector		7
DirectoryGroupRoleMapping		3
DirectoryMembers		2
Dsar	GDPR Article 15 data-subject access requests (execute + fetch results).	3
DsarReturnEndpoint		5
Entitlement	Access packages — catalog, assignment requests, and approvals.	8
EntraAppMigration	Microsoft Entra app-registration bulk import to Thoryn OAuth clients — read-only dry-run reconciliation report (SSO-1326).	1
EntraCaMigration	Microsoft Entra Conditional-Access policy migration to tenant auth policies.	1
Environment	Workspace environments (SSO-2410) — several long-lived sandboxes plus the one platform-managed production plane per workspace: list, create sandbox, rename, suspend/reactivate.	6
ErasureRequest		4
Events	Tenant-facing Events API — poll lifecycle events (user., client., federation.*) forward from a cursor; the signature-free twin of tenant webhooks.	2
FederationConnectionTests	Connection tests for federation members (Microsoft Entra ID, Google Workspace, Okta) run during the attach wizard.	3
FederationMembers		5
FgaCheck		3
FgaImport		1
FgaListObjectsExport		3
FgaModels		3
FgaTuples		2
GeoPolicy		3
Guest	Guest invitations: invite, redeem, revoke, list.	4
Hooks	Actions/Hooks — tenant-configured webhooks into the auth pipeline (register, list, update, delete; secret shown once on create).	10
Impersonation		2
ImpersonationPolicy		2
InvitationPolicy		3
Invitations		4
LegalDocuments		5
LoginExperience		16
LoginFlow		13
LoginMethodPolicy		3
MeConsent		4
MeLinkedIdentities		1
MeOrganizations		1
MigrationSource		6
NamedLocation		5
OrgMembershipProjection		2
OrganizationAttributeSchema		5
OrganizationConnections		3
OrganizationDomains		4
OrganizationMemberRoles		1
Organizations	B2B Organizations — the tenant's own customer companies (SSO-1897): org CRUD, membership, and email invitations (token shown once on invite).	13
Permissions	RBAC permission catalog (SSO-1891).	4
Pim	Privileged Identity Management — just-in-time role elevation with approval.	6
PimEligibilityAdmin	PIM eligibility administration (SSO-1321) — define who may request elevation (create/list/read/revoke eligible assignments); gated on tenant:pim.admin.	4
Policy		4
RecordsOfProcessing		1
RiskEvents	Anomalous-login / risk-detection signals (impossible travel, new device, credential stuffing) — one severity-filterable, cursor-paginated stream for the admin risk dashboard (SSO-2143).	1
Roles	RBAC roles and role-permission bindings (SSO-1891).	8
ScimDeprovisionEndpoint		5
SecurityPolicy		3
Siem	SIEM audit-event streaming configuration.	4
SsfPoll		1
SsfReceiver		5
TenantAuditRetention	Per-tenant audit retention window configuration.	2
TenantAuthenticationPolicy	Per-tenant authentication policy (MFA requirements, session rules).	3
TenantCapabilities	Tenant capability families — self-service entitlement toggles.	2
TenantIpRule	Tenant IP allow/deny rules enforced at the gateway.	3
TenantProvisioning		2
TestDataWipe		1
TokenClaims	Per-application token-claim enrichment configuration.	3
TrustCenter		6
UserDirectory		8
UserImport	Bulk user import — synchronous batches and asynchronous jobs, with pre-hashed passwords carried over so migrated users sign in without a reset (SSO-1992).	9
UserPermissions	Effective permission resolution per user (RBAC read model).	1
UserRoles	User-to-role assignments (RBAC).	3
Users	Tenant user management — CRUD plus lifecycle (suspend/reactivate/soft-delete), metadata, sessions/force-logout, unlock, password-reset-on-behalf, and risk-state (SSO-1884).	21
WebhookClaimSchema	Webhook claim-schema registration for token enrichment.	4
WebhookEndpoint	Preview. The WebhookEndpoint push-subscription API is live in preview: register an endpoint, subscribe it to catalog event types, receive signed (X-Thoryn-Signature) deliveries, and read each endpoint's recent delivery attempts. Delivery is currently wired for the user.created event on a best-effort (at-most-once) basis; full event-catalog coverage and at-least-once delivery hardening (retries, dead-letter) are still in progress. Tracked under SSO-1885.	6