Pim

Privileged Identity Management — just-in-time role elevation with approval.

Base URL: https://api.stg.thoryn.org

Operations

Method	Path	Summary	Scopes
GET	/api/v1/pim/activations	Pim List Activations	tenant:pim.elevate
POST	/api/v1/pim/activations	Pim Request Activation	tenant:pim.elevate
GET	/api/v1/pim/activations/active-scopes	Pim Get Active Scopes	tenant:pim.elevate
POST	/api/v1/pim/activations/{id}/approve	Pim Approve Activation	tenant:pim.approve
POST	/api/v1/pim/activations/{id}/revoke	Pim Revoke Activation	tenant:pim.approve or tenant:pim.elevate
GET	/api/v1/pim/eligible	Pim List Eligible	tenant:pim.elevate

Operation details

GET /api/v1/pim/activations

Pim List Activations

• Operation ID: pimListActivations
• Required scopes: tenant:pim.elevate

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/pim/activations

Pim Request Activation

• Operation ID: pimRequestActivation
• Required scopes: tenant:pim.elevate

Request body (required): application/json → ActivationRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/pim/activations/active-scopes

Pim Get Active Scopes

• Operation ID: pimGetActiveScopes
• Required scopes: tenant:pim.elevate

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/pim/activations/{id}/approve

Pim Approve Activation

• Operation ID: pimApproveActivation
• Required scopes: tenant:pim.approve

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/pim/activations/{id}/revoke

Pim Revoke Activation

• Operation ID: pimRevokeActivation
• Required scopes: tenant:pim.approve or tenant:pim.elevate

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/pim/eligible

Pim List Eligible

• Operation ID: pimListEligible
• Required scopes: tenant:pim.elevate

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)