Documentation Powered by ReDoc

Invite API (v1)

Download OpenAPI specification:Download

Invite external API endpoints

Authentication

openId

Security Scheme Type OAuth2
authorizationCode OAuth Flow
Authorization URL: https://connect.test2.surfconext.nl/oidc/authorize
Token URL: https://connect.test2.surfconext.nl/oidc/token
Scopes:
  • openid -

    openid

apiTokens

User generated API token

Security Scheme Type API Key
Header parameter name: X-API-TOKEN

apiHeaders

CRM authentication

Security Scheme Type API Key
Header parameter name: API-KEY

basic_auth

Security Scheme Type HTTP
HTTP Authorization Scheme basic

user-controller

Remove institution admin rights

Remove institution admin status from an invited user

Authorizations:
openId (openid) apiTokens
path Parameters
userId
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Remove application manager rights

Clear application manager applications for a user

Authorizations:
openId (openid) apiTokens
path Parameters
userId
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Log frontend error

Log client-side error payload on the server

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
property name*
any

Responses

Request samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Search users by application

Search and paginate users and their roles within the institution admin's organization

Authorizations:
openId (openid) apiTokens
query Parameters
query
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "name"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

Search users

Search and paginate all users (super user only)

Authorizations:
openId (openid) apiTokens
query Parameters
force
boolean
Default: true
query
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "name"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

Get user details by ID

Retrieve details and roles for a specific user by their ID

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "id": 0,
  • "sub": "string",
  • "superUser": true,
  • "eduPersonPrincipalName": "string",
  • "givenName": "string",
  • "familyName": "string",
  • "middleName": "string",
  • "name": "string",
  • "subjectId": "string",
  • "eduId": "string",
  • "uid": "string",
  • "schacHomeOrganization": "string",
  • "organizationGUID": "string",
  • "institutionAdmin": true,
  • "institutionAdminByInvite": true,
  • "email": "string",
  • "internalPlaceholderIdentifier": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "lastActivity": "2019-08-24T14:15:22Z",
  • "crmContactId": "string",
  • "userRoles": [
    ],
  • "userApplications": [
    ],
  • "applications": [
    ],
  • "institution": {
    }
}

Microsoft invitation accept return

Handle callback redirect after Microsoft graph invitation acceptance

Authorizations:
openId (openid) apiTokens
path Parameters
manageId
required
string
userId
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "contentType": "string"
}

Get current authenticated user

Retrieve user details and roles for the currently authenticated user

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "id": 0,
  • "sub": "string",
  • "superUser": true,
  • "eduPersonPrincipalName": "string",
  • "givenName": "string",
  • "familyName": "string",
  • "middleName": "string",
  • "name": "string",
  • "subjectId": "string",
  • "eduId": "string",
  • "uid": "string",
  • "schacHomeOrganization": "string",
  • "organizationGUID": "string",
  • "institutionAdmin": true,
  • "institutionAdminByInvite": true,
  • "email": "string",
  • "internalPlaceholderIdentifier": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "lastActivity": "2019-08-24T14:15:22Z",
  • "crmContactId": "string",
  • "userRoles": [
    ],
  • "userApplications": [
    ],
  • "applications": [
    ],
  • "institution": {
    }
}

User logout

Clear authentication session and log out current user

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

User login redirect

Redirect user to client or welcome application login flow

Authorizations:
openId (openid) apiTokens
query Parameters
app
string
Default: "client"

Responses

Response samples

Content type
application/json
{
  • "contentType": "string"
}

Get institution admins

Retrieve list of institution admins for the current user's organization

Authorizations:
openId (openid) apiTokens
query Parameters
includeMe
boolean
Default: false

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get institution admins by role

Retrieve institution admins associated with a specific role

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get user configuration

Get configuration information and authentication status for the current user session

Authorizations:
openId (openid) apiTokens
query Parameters
required
object (User)
guest
boolean
Default: false

Responses

Response samples

Content type
application/json
{
  • "clientUrl": "string",
  • "welcomeUrl": "string",
  • "serverUrl": "string",
  • "serverWelcomeUrl": "string",
  • "eduidEntityId": "string",
  • "roleSearchRequired": true,
  • "pastDateAllowed": true,
  • "performanceSeedAllowed": true,
  • "groupUrnPrefix": "string",
  • "authenticated": true,
  • "name": "string",
  • "eduidIdpSchacHomeOrganization": "string",
  • "missingAttributes": [
    ],
  • "languages": "string",
  • "environment": "string",
  • "acrRequirements": [
    ]
}

Get application managers

Retrieve list of application managers for the current user's organization

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete a user

Delete an existing user by ID (super user only)

Authorizations:
openId (openid) apiTokens
path Parameters
userId
required
integer <int64>

Responses

user-role-controller

Update UserRole expiration date

Update the expiration end date of an existing UserRole

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
userRoleId
required
integer <int64>
endDate
string <date-time>

Responses

Request samples

Content type
application/json
{
  • "userRoleId": 0,
  • "endDate": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Add Role to a User

Provision the User if the User is unknown and add the Role(s)

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
roleIdentifiers
required
Array of integers <int64> non-empty
intendedAuthority
string
Enum: "SUPER_USER" "INSTITUTION_ADMIN" "APPLICATION_MANAGER" "MANAGER" "INVITER" "GUEST"
sub
string
email
required
string
eduPersonPrincipalName
string
givenName
string
familyName
string
name
string
schacHomeOrganization
string
guestRoleIncluded
boolean

Responses

Request samples

Content type
application/json
{
  • "roleIdentifiers": [
    ],
  • "intendedAuthority": "SUPER_USER",
  • "sub": "string",
  • "email": "string",
  • "eduPersonPrincipalName": "string",
  • "givenName": "string",
  • "familyName": "string",
  • "name": "string",
  • "schacHomeOrganization": "string",
  • "guestRoleIncluded": true
}

Response samples

Content type
application/json
{
  • "id": 0,
  • "sub": "string",
  • "superUser": true,
  • "eduPersonPrincipalName": "string",
  • "givenName": "string",
  • "familyName": "string",
  • "middleName": "string",
  • "name": "string",
  • "subjectId": "string",
  • "eduId": "string",
  • "uid": "string",
  • "schacHomeOrganization": "string",
  • "organizationGUID": "string",
  • "institutionAdmin": true,
  • "institutionAdminByInvite": true,
  • "email": "string",
  • "internalPlaceholderIdentifier": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "lastActivity": "2019-08-24T14:15:22Z",
  • "crmContactId": "string",
  • "userRoles": [
    ],
  • "userApplications": [
    ],
  • "applications": [
    ],
  • "institution": {
    }
}

Search UserRoles with pagination

Search and paginate UserRoles for the specified Role, filtered by guest status and search query

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>
guests
required
boolean
query Parameters
query
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "name"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

Get UserRoles by Role

Get all UserRoles for the specified Role

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get managers by Role

Get all managers for the specified Role

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>

Responses

Response samples

Content type
application/json
[
  • "string"
]

Get consequences of deleting a Role

Get all UserRoles and user information that will be affected by deleting the specified Role

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete UserRole

Delete an existing UserRole by ID, or update authority if guest role is included

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>
isGuest
required
boolean

Responses

Delete Role from a User by remote SCIM identifiers

Lookup the User and Role by their remote provisioned SCIM identifiers and delete the UserRole

Authorizations:
openId (openid) apiTokens
path Parameters
remote_user_scim_identifier
required
string
remote_group_scim_identifier
required
string

Responses

system-controller

Seed performance test data

Generate seed roles and users for performance testing (super user only)

Authorizations:
openId (openid)
query Parameters
numberOfRole
integer <int32>
Default: 500
numberOfUsers
integer <int32>
Default: 75000

Responses

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Get unknown roles

Retrieve roles with unknown Manage application metadata (super user only)

Authorizations:
openId (openid)

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Fix missing landing pages

Update missing application landing pages from Manage provider metadata (super user only)

Authorizations:
openId (openid)

Responses

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Get expiring user roles

Retrieve user roles that will expire within the next 30 days (super user only)

Authorizations:
openId (openid)

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Trigger cron role expiry notifications

Send notifications for roles that are about to expire (super user only)

Authorizations:
openId (openid)

Responses

Response samples

Content type
application/json
{
  • "property1": [
    ],
  • "property2": [
    ]
}

Trigger cron resource cleanup

Clean up expired invitations and tokens (super user only)

Authorizations:
openId (openid)

Responses

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

role-controller

Get roles by application

Search and paginate roles accessible to the authenticated user

Authorizations:
openId (openid) apiTokens
query Parameters
force
boolean
Default: true
query
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "name"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

Update an existing role

Update role name, description, and application usages

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
id
integer <int64>
name
required
string non-empty
shortName
string
description
string
urn
string
defaultExpiryDays
integer <int32>
defaultExpiryDate
string <date-time>
enforceEmailEquality
boolean
eduIDOnly
boolean
requestedAuthnContext
string
overrideSettingsAllowed
boolean
teamsOrigin
boolean
identifier
string
organizationGUID
string
remoteApiUser
string
inviterDisplayName
string
crmRoleId
string
crmRoleName
string
crmRoleAbbrevation
string
userRoleCount
integer <int64>
Array of objects (ApplicationUsage) unique
object (Auditable)
Array of objects

Responses

Request samples

Content type
application/json
{
  • "id": 0,
  • "name": "string",
  • "shortName": "string",
  • "description": "string",
  • "urn": "string",
  • "defaultExpiryDays": 0,
  • "defaultExpiryDate": "2019-08-24T14:15:22Z",
  • "enforceEmailEquality": true,
  • "eduIDOnly": true,
  • "requestedAuthnContext": "string",
  • "overrideSettingsAllowed": true,
  • "teamsOrigin": true,
  • "identifier": "string",
  • "organizationGUID": "string",
  • "remoteApiUser": "string",
  • "inviterDisplayName": "string",
  • "crmRoleId": "string",
  • "crmRoleName": "string",
  • "crmRoleAbbrevation": "string",
  • "userRoleCount": 0,
  • "applicationUsages": [
    ],
  • "auditable": {
    },
  • "applicationMaps": [
    ]
}

Response samples

Content type
application/json
{
  • "id": 0,
  • "name": "string",
  • "shortName": "string",
  • "description": "string",
  • "urn": "string",
  • "defaultExpiryDays": 0,
  • "defaultExpiryDate": "2019-08-24T14:15:22Z",
  • "enforceEmailEquality": true,
  • "eduIDOnly": true,
  • "requestedAuthnContext": "string",
  • "overrideSettingsAllowed": true,
  • "teamsOrigin": true,
  • "identifier": "string",
  • "organizationGUID": "string",
  • "remoteApiUser": "string",
  • "inviterDisplayName": "string",
  • "crmRoleId": "string",
  • "crmRoleName": "string",
  • "crmRoleAbbrevation": "string",
  • "userRoleCount": 0,
  • "applicationUsages": [
    ],
  • "auditable": {
    },
  • "applicationMaps": [
    ]
}

Create a new role

Create a new role with associated applications and permissions

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
name
required
string non-empty

Unique name of the role

description
string

Brief explanation of this role's purpose

defaultExpiryDays
integer <int32>

Number of days until the memberschip automaticly expires. Use either defaultExpiryDays or defaultExpiryDate

defaultExpiryDate
string <date-time>

Specific timestamp end date for this role membership. Use either defaultExpiryDays or defaultExpiryDate

enforceEmailEquality
boolean
Default: false

If true, the user's email must match the invitation email

eduIDOnly
boolean
Default: false

The invite can only be accepted by an eduID account

overrideSettingsAllowed
boolean
Default: false

Allow changing the settings when sending an invite.

organizationGUID
string

The unique identifier of the associated organization, only to be used bu SUPER-admins and internal API's

inviterDisplayName
string

The email address used

requestedAuthnContext
string

The ACR value

Array of objects (ApplicationUsage) unique

Responses

Request samples

Content type
application/json
{
  • "name": "Guest for my application",
  • "description": "Full access to all modules",
  • "defaultExpiryDays": 365,
  • "defaultExpiryDate": "2026-12-31T23:59:59Z",
  • "enforceEmailEquality": false,
  • "eduIDOnly": false,
  • "overrideSettingsAllowed": false,
  • "organizationGUID": "550e8400-e29b-41d4-a716-446655440000",
  • "inviterDisplayName": "550e8400-e29b-41d4-a716-446655440000",
  • "requestedAuthnContext": "https://eduid.nl/trust/linked-institution",
  • "applicationUsages": [
    ]
}

Response samples

Content type
application/json
{
  • "id": 0,
  • "name": "string",
  • "shortName": "string",
  • "description": "string",
  • "urn": "string",
  • "defaultExpiryDays": 0,
  • "defaultExpiryDate": "2019-08-24T14:15:22Z",
  • "enforceEmailEquality": true,
  • "eduIDOnly": true,
  • "requestedAuthnContext": "string",
  • "overrideSettingsAllowed": true,
  • "teamsOrigin": true,
  • "identifier": "string",
  • "organizationGUID": "string",
  • "remoteApiUser": "string",
  • "inviterDisplayName": "string",
  • "crmRoleId": "string",
  • "crmRoleName": "string",
  • "crmRoleAbbrevation": "string",
  • "userRoleCount": 0,
  • "applicationUsages": [
    ],
  • "auditable": {
    },
  • "applicationMaps": [
    ]
}

Get role by ID

Retrieve role details by its unique identifier

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "id": 0,
  • "name": "string",
  • "shortName": "string",
  • "description": "string",
  • "urn": "string",
  • "defaultExpiryDays": 0,
  • "defaultExpiryDate": "2019-08-24T14:15:22Z",
  • "enforceEmailEquality": true,
  • "eduIDOnly": true,
  • "requestedAuthnContext": "string",
  • "overrideSettingsAllowed": true,
  • "teamsOrigin": true,
  • "identifier": "string",
  • "organizationGUID": "string",
  • "remoteApiUser": "string",
  • "inviterDisplayName": "string",
  • "crmRoleId": "string",
  • "crmRoleName": "string",
  • "crmRoleAbbrevation": "string",
  • "userRoleCount": 0,
  • "applicationUsages": [
    ],
  • "auditable": {
    },
  • "applicationMaps": [
    ]
}

Delete a role

Delete an existing role by ID and clean up associated group requests

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

Get roles by application manage ID

Retrieve all roles associated with a specific application manage ID

Authorizations:
openId (openid) apiTokens
path Parameters
manageId
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]

invitation-controller

Resend an invitation

Resend an existing invitation by ID to the invitee

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

Response samples

Content type
application/json
{
  • "property1": 0,
  • "property2": 0
}

Delete an invitation

Delete an existing invitation by ID

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

Accept an invitation

Accept an invitation using invitation ID and hash token

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
hash
string
invitationId
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "hash": "string",
  • "invitationId": 0
}

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Invite member for existing Role

Invite a member for an existing role. An invitation email will be sent. Do not forget to set guestRoleIncluded to true. At least one email must be either present in invites or invitesWithInternalPlaceholderIdentifiers. When using the invitations you can also specify the internalPlaceholderIdentifier, which will be used as the externalId in the SCIM POST to /User.

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
intendedAuthority
required
string
Enum: "SUPER_USER" "INSTITUTION_ADMIN" "APPLICATION_MANAGER" "MANAGER" "INVITER" "GUEST"
message
string
language
string
Enum: "en" "nl"
enforceEmailEquality
boolean
eduIDOnly
boolean
requestedAuthnContext
string
guestRoleIncluded
boolean
suppressSendingEmails
boolean
invites
Array of strings
Array of objects (Invite)
roleIdentifiers
Array of integers <int64>
Array of objects (ManageIdentifier)
organizationGUID
string
roleExpiryDate
string <date-time>
expiryDate
required
string <date-time>

Responses

Request samples

Content type
application/json
{
  • "intendedAuthority": "INVITER",
  • "message": "Personal message included in the email",
  • "language": "en",
  • "guestRoleIncluded": true,
  • "suppressSendingEmails": false,
  • "invites": [
    ],
  • "invitesWithInternalPlaceholderIdentifiers": [
    ],
  • "roleIdentifiers": [
    ],
  • "manageIdentifiers": [ ],
  • "roleExpiryDate": 1760788376,
  • "expiryDate": 1730461976
}

Response samples

Content type
application/json
{}

Search invitations

Search and paginate invitations optionally filtered by role ID and search query

Authorizations:
openId (openid) apiTokens
query Parameters
roleId
integer <int64>
query
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "name"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

Get open invitations by Role

Retrieve all open invitations for a specific role ID

Authorizations:
openId (openid) apiTokens
path Parameters
roleId
required
integer <int64>

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get invitation by hash

Retrieve an open invitation using its secure hash token

Authorizations:
openId (openid) apiTokens
query Parameters
hash
required
string

Responses

Response samples

Content type
application/json
{
  • "id": 0,
  • "intendedAuthority": "SUPER_USER",
  • "language": "en",
  • "status": "OPEN",
  • "email": "string",
  • "message": "string",
  • "subInvitee": "string",
  • "enforceEmailEquality": true,
  • "eduIDOnly": true,
  • "requestedAuthnContext": "string",
  • "guestRoleIncluded": true,
  • "createdAt": "2019-08-24T14:15:22Z",
  • "expiryDate": "2019-08-24T14:15:22Z",
  • "roleExpiryDate": "2019-08-24T14:15:22Z",
  • "acceptedAt": "2019-08-24T14:15:22Z",
  • "organizationGUID": "string",
  • "internalPlaceholderIdentifier": "string",
  • "remoteApiUser": "string",
  • "crmContactId": "string",
  • "crmOrganisationId": "string",
  • "roles": [
    ],
  • "applications": [
    ],
  • "emailEqualityConflict": true,
  • "inviter": {
    }
}

Get my invitations

Retrieve all open invitations created by the current authenticated user

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get all open invitations

Retrieve all open invitations (super user only)

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

crm-controller

Create, update CRM role memberships

Add or delete the CRM roles to the CRM contact

Authorizations:
apiHeaders
Request Body schema: application/json
uid
string
schacHomeOrganisation
string
suppressInvitation
boolean
contactId
string
firstname
string
middlename
string
surname
string
email
string
object (CRMOrganisation)
Array of objects (CRMRole)

Responses

Request samples

Content type
application/json
{
  • "uid": "string",
  • "schacHomeOrganisation": "string",
  • "suppressInvitation": true,
  • "contactId": "string",
  • "firstname": "string",
  • "middlename": "string",
  • "surname": "string",
  • "email": "string",
  • "organisation": {
    },
  • "roles": [
    ]
}

Response samples

Content type
application/json
"string"

Delete CRM profile

Delete CRM profile

Authorizations:
apiHeaders
Request Body schema: application/json
uid
string
schacHomeOrganisation
string
suppressInvitation
boolean
contactId
string
firstname
string
middlename
string
surname
string
email
string
object (CRMOrganisation)
Array of objects (CRMRole)

Responses

Request samples

Content type
application/json
{
  • "uid": "string",
  • "schacHomeOrganisation": "string",
  • "suppressInvitation": true,
  • "contactId": "string",
  • "firstname": "string",
  • "middlename": "string",
  • "surname": "string",
  • "email": "string",
  • "organisation": {
    },
  • "roles": [
    ]
}

Response samples

Content type
application/json
"string"

Send invite for CRM role memberships

Send invite for CRM role memberships

Authorizations:
apiHeaders
Request Body schema: application/json
org_id
string
guid
string
email
string
Array of objects (CRMRole)

Responses

Request samples

Content type
application/json
{
  • "org_id": "string",
  • "guid": "string",
  • "email": "string",
  • "roles": [
    ]
}

Response samples

Content type
application/json
"string"

Resend an invitation

Resend an invitation based on the CRM OrganisationID and CRM ContactID

Authorizations:
apiHeaders
Request Body schema: application/json
org_id
string
guid
string

Responses

Request samples

Content type
application/json
{
  • "org_id": "string",
  • "guid": "string"
}

Response samples

Content type
application/json
{
  • "timestamp": "string",
  • "status": 0,
  • "key": "string",
  • "message": "string"
}

Remove all CRM roles memberships from a user

Remove all CRM roles memberships from a user

Authorizations:
apiHeaders
Request Body schema: application/json
org_id
string
guid
string

Responses

Request samples

Content type
application/json
{
  • "org_id": "string",
  • "guid": "string"
}

Response samples

Content type
application/json
"string"

Query for connection status

Lookup the organisation and return all connected users

Authorizations:
apiHeaders
Request Body schema: application/json
org_guid
string

Responses

Request samples

Content type
application/json
{
  • "org_guid": "string"
}

Response samples

Content type
application/json
{
  • "property1": {
    },
  • "property2": {
    }
}

Get all CRM organisations

Authorizations:
apiHeaders

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete CRM organisation

Authorizations:
apiHeaders
Request Body schema: application/json
organisationId
string
abbrev
string
name
string

Responses

Request samples

Content type
application/json
{
  • "organisationId": "string",
  • "abbrev": "string",
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

syncReport

Authorizations:
openIdapiTokensapiHeadersbasic_auth

Responses

Response samples

Content type
application/json
{
  • "property1": {
    },
  • "property2": {
    }
}

Query for profiles

Based on either 'uid'/'idp' OR 'guid'/'role' search for users and include the CRM roles

Authorizations:
basic_authapiHeaders
query Parameters
uid
string
idp
string
guid
string
role
string

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "code": 0,
  • "profiles": [
    ]
}

Query for profiles

Based on either 'uid'/'idp' OR 'guid'/'role' search for users and include the CRM roles

Authorizations:
basic_authapiHeaders
query Parameters
uid
string
idp
string
guid
string
role
string

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "code": 0,
  • "profiles": [
    ]
}

validation-controller

validate

Authorizations:
openIdapiTokensapiHeadersbasic_auth
Request Body schema: application/json
type
required
string
value
required
string non-empty

Responses

Request samples

Content type
application/json
{
  • "type": "string",
  • "value": "string"
}

Response samples

Content type
application/json
{
  • "property1": true,
  • "property2": true
}

api-token-controller

Get API tokens by institution

Retrieve API tokens for the authenticated user or organization

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an API token

Create and persist a new API token using the token generated in the current session

Authorizations:
openId (openid) apiTokens
Request Body schema: application/json
id
integer <int64>
organizationGUID
string
hashedValue
string
superUserToken
boolean
description
required
string non-empty
createdAt
string <date-time>

Responses

Request samples

Content type
application/json
{
  • "id": 0,
  • "organizationGUID": "string",
  • "hashedValue": "string",
  • "superUserToken": true,
  • "description": "string",
  • "createdAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "id": 0,
  • "organizationGUID": "string",
  • "superUserToken": true,
  • "description": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "owner": "string"
}

Generate a new API token

Generate a new unhashed API token and store it temporarily in the session

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Delete an API token

Delete an existing API token by ID

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
integer <int64>

Responses

internal-invite-controller

Create a Role

Create a Role linked to a SP in Manage. Note that the required application object needs to be pre-configured during deployment.

Authorizations:
basic_auth
Request Body schema: application/json
name
required
string non-empty

Unique name of the role

description
string

Brief explanation of this role's purpose

defaultExpiryDays
integer <int32>

Number of days until the memberschip automaticly expires. Use either defaultExpiryDays or defaultExpiryDate

defaultExpiryDate
string <date-time>

Specific timestamp end date for this role membership. Use either defaultExpiryDays or defaultExpiryDate

enforceEmailEquality
boolean
Default: false

If true, the user's email must match the invitation email

eduIDOnly
boolean
Default: false

The invite can only be accepted by an eduID account

overrideSettingsAllowed
boolean
Default: false

Allow changing the settings when sending an invite.

organizationGUID
string

The unique identifier of the associated organization, only to be used bu SUPER-admins and internal API's

inviterDisplayName
string

The email address used

requestedAuthnContext
string

The ACR value

Array of objects (ApplicationUsage) unique

Responses

Request samples

Content type
application/json
"{\n \"name\": \"Required role name\",\n \"description\": \"Required role description\",\n \"defaultExpiryDays\": 365,\n \"inviterDisplayName\": \"Free format field used in the invitation emails for this role (can be email address)\"\n \"applicationUsages\": [\n {\n \"landingPage\": \"https://landingpage.com\",\n \"application\": {\n \"manageId\": \"4\",\n \"manageType\": \"SAML20_SP\"\n }\n }\n ]\n}\n"

Response samples

Content type
application/json
{
  • "id": 42114,
  • "name": "Required role name",
  • "shortName": "required_role_name",
  • "description": "Required role description",
  • "urn": "urn:mace:surf.nl:test.surfaccess.nl:74fd8059-7558-4454-8393-fd84f74c4907:required_role_name",
  • "defaultExpiryDays": 365,
  • "enforceEmailEquality": false,
  • "eduIDOnly": false,
  • "overrideSettingsAllowed": false,
  • "teamsOrigin": false,
  • "identifier": "74fd8059-7558-4454-8393-fd84f74c4907",
  • "remoteApiUser": "SP Dashboard",
  • "applicationUsages": [
    ],
  • "auditable": {
    },
  • "applicationMaps": []
}

Invite member for existing Role

Invite a member for an existing role. An invitation email will be sent. Do not forget to set guestRoleIncluded to true.At least one email must be either present in invites or invitations. When using the invitations you can also specify the internalPlaceholderIdentifier, which will be used as the id in the SCIM POST to /User.

Authorizations:
basic_auth
Request Body schema: application/json
intendedAuthority
required
string
Enum: "SUPER_USER" "INSTITUTION_ADMIN" "APPLICATION_MANAGER" "MANAGER" "INVITER" "GUEST"
message
string
language
string
Enum: "en" "nl"
enforceEmailEquality
boolean
eduIDOnly
boolean
requestedAuthnContext
string
guestRoleIncluded
boolean
suppressSendingEmails
boolean
invites
Array of strings
Array of objects (Invite)
roleIdentifiers
Array of integers <int64>
Array of objects (ManageIdentifier)
organizationGUID
string
roleExpiryDate
string <date-time>
expiryDate
required
string <date-time>

Responses

Request samples

Content type
application/json

Invitation example

"{\n \"intendedAuthority\": \"INVITER\",\n \"message\": \"Personal message included in the email\",\n \"language\": \"en\",\n \"guestRoleIncluded\": true,\n \"invites\": [\n \"admin@service.org\"\n ],\n \"invitations\": [{\n \"email\": \"admin2@service.org\",\n \"internalPlaceholderIdentifier\": \"4EFF937F-EE78-4A54-9FD8-A214FD64D7E1\",\n }],\n \"roleIdentifiers\": [\n 99\n ],\n \"roleExpiryDate\": 1760788376,\n \"expiryDate\": 1730461976\n}\n"

Response samples

Content type
application/json
{}

rolesPerOrganizationApplicationId

Authorizations:
basic_auth
path Parameters
organizationGUID
required
string
manageId
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Delete existing Role

Delete an existing role. The path parameter id is the id returned when creating the role.

Authorizations:
basic_auth
path Parameters
id
required
integer <int64>

Unique database id of the role

Responses

Response samples

Content type
application/json
{
  • "timestamp": 1717672263253,
  • "status": 400,
  • "error": "BadRequest",
  • "exception": "access.exception.UserRestrictionException",
  • "message": "No access to role",
  • "path": "/api/internal/roles/999"
}

voot-controller

getGroupMemberships

Authorizations:
basic_auth
path Parameters
unspecified_id
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]

user-role-audit-controller

search_1

Authorizations:
openId (openid) apiTokens
query Parameters
query
string
Default: ""
roleId
string
Default: ""
pageNumber
integer <int32>
Default: 0
pageSize
integer <int32>
Default: 10
sort
string
Default: "userEmail"
sortDirection
string
Default: "ASC"

Responses

Response samples

Content type
application/json
{
  • "totalPages": 0,
  • "totalElements": 0,
  • "size": 0,
  • "content": [
    ],
  • "number": 0,
  • "sort": {
    },
  • "pageable": {
    },
  • "numberOfElements": 0,
  • "first": true,
  • "last": true,
  • "empty": true
}

fetchAllRoles

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

profile-controller

roles

Authorizations:
basic_auth
query Parameters
collabPersonId
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]

manage-controller

Get requested authn context values

Retrieve map of configured ACR requirement keys and URLs

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Check provisioning exists for ID

Check if provisioning exists in Manage for the specified application manage ID

Authorizations:
openId (openid) apiTokens
path Parameters
id
required
string

Responses

Response samples

Content type
application/json
true

Get all service providers and relying parties

Retrieve SAML20 SP and OIDC10 RP providers from Manage (super user only)

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get provider by type and ID

Retrieve identity or service provider metadata by entity type and ID (super user only)

Authorizations:
openId (openid) apiTokens
path Parameters
type
required
string
Enum: "SAML20_SP" "OIDC10_RP" "SAML20_IDP" "PROVISIONING" "POLICY"
id
required
string

Responses

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Validate organization GUID

Retrieve identity provider matching the specified organization GUID (super user only)

Authorizations:
openId (openid) apiTokens
path Parameters
organizationGUID
required
string

Responses

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Get identity providers

Retrieve identity providers with institution GUID from Manage (super user only)

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get eduID identity provider

Retrieve eduID identity provider metadata from Manage

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Get applications for current user

Retrieve accessible applications and provisioning configurations for the authenticated user

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
{
  • "property1": [
    ],
  • "property2": [
    ]
}

Get all applications

Retrieve provider metadata for all registered applications (super user only)

Authorizations:
openId (openid) apiTokens

Responses

Response samples

Content type
application/json
[
  • {
    }
]

user-life-cycle-controller

preview

Authorizations:
basic_auth
path Parameters
userId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "string",
  • "name": "string",
  • "data": [
    ]
}

deprovision

Authorizations:
basic_auth
path Parameters
userId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "string",
  • "name": "string",
  • "data": [
    ]
}

dryRun

Authorizations:
basic_auth
path Parameters
userId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "string",
  • "name": "string",
  • "data": [
    ]
}

attribute-aggregator-controller

getGroupMemberships_1

Authorizations:
basic_auth
path Parameters
unspecified_id
required
string
query Parameters
SPentityID
required
string

Responses

Response samples

Content type
application/json
[
  • {
    }
]