Admin APIv2.1pilot-root.1kosmos.net/adminapiOpenAPI
1Kosmos · Admin Backend

Admin API

The control plane behind AdminX — manage users, communities, authentication modules, providers and policy across your tenant.

Authentication → All products

The Web Admin Backend powers the 1Kosmos AdminX console. Programmatically manage users, communities and login settings; configure authentication modules, WebAuthn, hardware tokens and SAML / OIDC service and identity providers; run reports; and control branding and policy across your tenant. This is the control plane for your 1Kosmos deployment.

233 endpoints

across 61 resource groups.

ECDSA-signed

every request is signed with your key pair.

JSON over HTTPS

predictable REST, conventional status codes.

OpenAPI 3.0

Download the spec →

Reference

Base URL

All Admin API endpoints are relative to your environment host. Examples on this page use the 1Kosmos pilot environment — swap in your production root when you go live.

Pilot https://pilot-root.1kosmos.net/adminapi

Content type

Requests and responses use application/json.

GEThttps://pilot-root.1kosmos.net/adminapi/healthz
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/healthz' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
Security

Authentication

Admin API uses ECDSA key-pair authentication. Each request carries your credentials as HTTP headers; verification-grade calls additionally sign the request body. Retrieve the system signing key from /publickeys.

Credentials
keyIdECDSA Public Keyheader
keySecretHawk Key Secret / ECDSA Private Keyheader
AuthorizationAuthentication headerheader
x-jwt-tokenAuthentication headerheader
licenseLicense key from License Microserviceheader
GEThttps://pilot-root.1kosmos.net/adminapi/healthz
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/healthz' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
Reference

Errors

Admin API uses conventional HTTP status codes: 2xx success, 4xx a problem with the request, 5xx a service-side error.

StatusMeaningDescription
200 / 204OKThe request succeeded.
400Bad RequestValidation failed.
401UnauthorizedMissing or invalid credentials.
403ForbiddenAuthenticated, but not permitted.
404Not FoundThe resource does not exist.
500Server ErrorSomething went wrong on our side.
4XXerror response
{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Validation error"
}
Admin API

Users

Create, query, update and manage user records.

GET/users/user/documents

Fetch documents from user wallet

Returns array of user documents.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns array of user documents. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize 🔒
publickeyrequiredstringPublic Key / Try Authorize 🔒
GEThttps://pilot-root.1kosmos.net/adminapi/users/user/documents
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/users/user/documents' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following array: ``` [ { "type": "type", "id": "id", "proofedBy": "proofedBy", "category": "identity_document", "doe": "12345678", "proofs": ["array", "of", "proofs"] } ] ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
GET/users/user/ial

Get IAL of the user

Get IAL of the user.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ial of the user. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/users/user/ial
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/users/user/ial' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
// no response body
GET/users/user/ip

Returns ip address of caller

Returns ip address of caller. Caller must be a tenant or community admin with active jwt in authorization header.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the ip address of the calling client. This API throws an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/users/user/ip
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/users/user/ip' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following array: ``` { "ip": "192.68.24.56", } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/accesscodes/fetch

Fetch list of Accesscodes

Fetch accesscode list based on uids.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the list of users invited accesscodes.

This API throw an error if something goes wrong.

Permissions

Administrators can get any access codes of any user within their own community. Basic users can only fetch their own access codes.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
userrequiredobject—
communityrequiredobject—
uidsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/users/accesscodes/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/accesscodes/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user": {"uid": "string", "username": "string", "authModuleId": "string"}, "community": {"id": "string", "name": "string", "publicKey": "string"}, "uids": ["string optional", "property 'uids' optional"]}'
RESPONSE
200
400
401
500
Success
{
  "status": "string"
}
POST/users/count

Count all basic users.

  • Any valid key can be used to count users.
  • Auth module must be available for the community.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

query (optional)

query : object

The query to filter users.

Returns

Returns number of users.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains object below:

{
    "tenantId": "ObjectId required, ID of Tenant",
    "communityId": "ObjectId required, ID of Community",
    "moduleId": "ObjectId required, ID of authModule",
    "query": "object (optional)",
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
queryobject—
POSThttps://pilot-root.1kosmos.net/adminapi/users/count
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/count' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxx", "moduleId": "xxxxxxxxxxxxxxxxxxxxxxxx", "query": {}}'
RESPONSE
200
400
401
Success Users count result. ``` { "count": 50, "id": "ObjectID", "type": "azuread", } ```
{
  "id": "xxxxxxxxxxxxxxxxxxxxxxxx",
  "type": "azuread",
  "count": 12
}
POST/users/countAll

Get users counts

Get users counts for all authmodules .

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Returns

Returns the users info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/countAll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/countAll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "moduleId": "string"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "count": 50 } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/users/fetch

Fetch users

Fetch list of users.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

pSize (default to 25) / max 100

pSize : number

pIndex (default 0)

pIndex : number

query (optional)

query : object

attributes (optional)

attributes : array

Returns

Returns the users info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
pSizenumber—
pIndexnumber—
attributesarray<object>—
POSThttps://pilot-root.1kosmos.net/adminapi/users/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "moduleId": "string", "pSize": 25, "pIndex": 0, "attributes": ["firstname"]}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
POST/users/find

Find User

Find User.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

email (optional)

email : string

username (optional)

username : string

checkAliases (optional)

checkAliases : boolean

fetchFromExternalSources (optional)

fetchFromExternalSources: boolean

Returns

Returns the matched users.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
emailstring—
usernamestring—
checkAliasesboolean—
fetchFromExternalSourcesboolean—
POSThttps://pilot-root.1kosmos.net/adminapi/users/find
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/find' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "email": "string optional", "username": "string optional", "checkAliases": false, "fetchFromExternalSources": false}'
RESPONSE
200
400
401
500
Success
{
  "users": [
    {
      "username": "xxxxx",
      "usernameHash": "xxxxx",
      "email1": "xxxxx",
      "email1Hash": "xxxxx",
      "email2": "xxxxx",
      "email2Hash": "xxxxx",
      "phone": "xxxxx",
      "phoneHash": "xxxxx",
      "deviceName": "xxxxx",
      "aliasUsed": "xxxxxx",
      "user_token": "xxxxx"
    }
  ]
}
POST/users/request/invite

User Request invites

Send invitation to user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

user_token (required)

user_token : string

deliveryMethod (required)

deliveryMethod : string

google_token (required)

google_token : string

license (optional, if valid license was provided, bypass captcha checking)

license : string

Returns

Returns invitation object.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
user_tokenstring—
deliveryMethodstring—
google_tokenstring—
licensestring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/request/invite
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/request/invite' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "user_token": "string", "deliveryMethod": "email1|email2", "google_token": "string", "license": "string"}'
RESPONSE
200
400
401
500
Success
{
  "emailResult": {
    "status": true,
    "statusCode": 200,
    "message": "https://1k-dev.1kosmos.net/acr,",
    "error": "string",
    "gatewatId": "string",
    "resultId": "string",
    "messageId": "string",
    "ts": "string"
  },
  "link": "string",
  "code": "string"
}
POST/users/resend/invite

Resend Invite to user

Resend Invite to same user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

code (required)

code : string

emailTo (required)

emailTo : string

firstname (required)

firstname : string

lastname (required)

lastname : string

captchaToken (required unless a valid license is provided)

captchaToken : string

license (optional - if provided and valid, CAPTCHA is bypassed)

license : string

Returns

Returns the resend invited users object.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
codestring—
emailTostring—
firstnamestring—
lastnamestring—
captchaTokenstring—
licensestring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/resend/invite
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/resend/invite' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"code": "string", "emailTo": "string", "firstname": "string", "lastname": "string", "captchaToken": "string", "license": "string"}'
RESPONSE
200
400
401
500
Success
{
  "emailResult": {
    "status": true,
    "statusCode": 200,
    "message": "https://1k-dev.1kosmos.net/acr,",
    "error": "string",
    "gatewatId": "string",
    "resultId": "string",
    "messageId": "string",
    "ts": "string"
  },
  "link": "string",
  "code": "string"
}
POST/users/user/alternate_mfa/session/{code}/poll

Poll UWL2.0 session for alternate MFA option

Returns OK status.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Params

code (required)

ACR code of this session

Returns

Returns array of user documents. This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
coderequiredstringcode for polling
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/alternate_mfa/session/{code}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/alternate_mfa/session/<code>/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted object: ``` { "ttl_seconds": 60, "type": "user_invitation", "phoneRequired": false, "uuid": "c2c003e2-221b-44de-93cb-f2d388265490", "ttl": 0, "createdBy": "sasha", "tenantId": "5f3d8d0cd866fa61019cf968", "createdTime": 1731676868, "id": "67374ac4e1107a584374b28e", "communityId": "5f3d8d0cd866fa61019cf969", "redeem_result": { "client_ip": "188.26.211.129", "publicKey": "xxxxxxxxxxxxxxxxxx", "deviceId": "4EC9816C-236B-4B02-B826-56A4E4C563B4", "deviceName": "iPhone sasha", "did": "b6f752963b368c91a120d15828ae6c08cd7f230e" }, "accesscodepayload": { "authModuleId": "659c0b3e7fa8735a60fd33d1", "uid": "andrii1", "otp_email": "xxxxxxxxxx@1kosmos.com", "dns": "1k-dev.1kosmos.net", "authType": "none", "userid": "andrii1", "invite_email": "xxxxxxxxx@1kosmos.com" }, "status": "redeemed" } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/detailProfile/fetch

Fetch user Profile details

Fetch user detail.

This endpoint must be accessed by all users to get user profile details.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

user (required)

query : object

attributes (optional)

attributes : array

Returns

Returns the user details.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
userobject—
attributesarray<object>—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/detailProfile/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/detailProfile/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "moduleId": "string", "user": {"username": "string", "uid": "string", "urn": "string"}, "attributes": ["firstname"]}'
RESPONSE
200
400
401
500
Success
{
  "uid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "username": "xxxxxx",
  "moduleId": "xxxxxxx",
  "dguid": "xxxxxx",
  "urn": "xxxxx",
  "type": "xxxxx",
  "mobiles": [],
  "landlines": [],
  "aliases": {},
  "roleValue": "xxxxx",
  "status": "xxxxxx",
  "firstname": "xxxxxxxx",
  "middlename": "xxxxxxxx",
  "lastname": "xxxxxxxx",
  "email": "xxxxx@xxxxxxxx.xxx",
  "phone": "xxxxxxxxxx",
  "disabled": false,
  "isLocked": false,
  "ial": "xxxxx",
  "userProperties": {
    "mobiles": [],
    "landlines": [],
    "aliases": {}
  }
}
POST/users/user/devices/fetch

Fetch devices linked to user

Fetch devices linked to user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the devices information that linked to a user This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
    "user": {
      "uid": "required string",
      "username": "required string",
      "authModuleId": "required string"
     },
    "community": {
      "id": "required string",
      "name": "required string",
      "publicKey": "required string"
     }
}
FieldTypeDescription
userobject—
communityobject—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/devices/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/devices/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user": {"uid": "xxxxxxxx", "username": "xxxxxxxx", "authModuleId": "xxxxxxxx"}, "community": {"id": "xxxxxxxx", "name": "xxxxxxx", "publicKey": "xxxxxxx"}}'
RESPONSE
200
401
404
500
Success
{
  "list": [
    {
      "personId": "xxxxxxxx",
      "userIdList": [
        "xxxxxxxx"
      ],
      "communityId": "xxxxxxxx",
      "publickey": "xxxxxxxx",
      "poi_ial": "xxxxxxxx",
      "pon_ial": "xxxxxxxx",
      "updatedTS": "xxxxxxxx",
      "id": "xxxxxxxx"
    }
  ],
  "devices": [
    {
      "uid": "xxxxxxxx",
      "did": "xxxxxxxx",
      "os": "xxxxxxxx",
      "publickey": "xxxxxxxx",
      "deviceName": "xxxxxxxx",
      "authenticatorId": "xxxxxxxx",
      "authenticatorVersion": "xxxxxxxx",
      "authenticatorName": "xxxxxxxx",
      "clientIp": "xxxxxxxx",
      "userAgent": "xxxxxxxx",
      "locLat": "xxxxxxxx",
      "locLon": "xxxxxxxx",
      "id": "xxxxx"
    }
  ]
}
POST/users/user/devices/has_security_key

Check if user has any security keys registered

Update User details.

This endpoint can be accessed by everyone.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

communityName (required)

communityName : string

communityPublicKey (required)

communityPublicKey : string

tenantTag (required)

tenantTag : string

username (required)

username : string

Returns

Returns hasSecurityKeys = true/false

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
communityNamestring—
communityPublicKeystring—
tenantTagstring—
usernamestring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/devices/has_security_key
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/devices/has_security_key' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"communityName": "xxxxxxxx", "communityPublicKey": "xxxxxxxx", "tenantTag": "xxxxxxxx", "username": "xxxxxxxx"}'
RESPONSE
200
400
401
500
Success data is ECDSA encrypted following object: ``` { hasSecurityKey: true/false } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/document

Fetch document from user wallet by id and type

Returns user document.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns user document. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains encrypted data object:

{
    "type": "document_type",
    "id": "document_id"
}

Every property is required

FieldTypeDescription
typestring—
idstring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/document
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/document' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"type": "document_type", "id": "document_id"}'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted object: ``` { "type": "type", "id": "id", "proofedBy": "proofedBy", "category": "identity_document", "doe": "12345678", "proofs": ["array", "of", "proofs"], "data": {} } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/lock

Lock user.

Lock a user. A user can be locked by an administrator.

This endpoint must be accessed by Help Desk admin and Community administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

username (required)

username : string

lock_duration (required)

lock_duration : number

Returns

204 No Content This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
usernamestring—
lock_durationnumber—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/lock
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/lock' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"username": "xxxxx", "lock_duration": 30}'
RESPONSE
204
401
404
500
No Content
// no response body
POST/users/user/login_options/fetch

Fetch login options linked to user

Fetch login options linked to user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns both the devices information linked to a user and the user's login options - user pin and typing phrases. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
    "user": {
      "uid": "required string",
      "username": "required string",
      "authModuleId": "required string"
     },
    "community": {
      "id": "required string",
      "name": "required string",
      "publicKey": "required string"
     }
}
FieldTypeDescription
userobject—
communityobject—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/login_options/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/login_options/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user": {"uid": "xxxxxxxx", "username": "xxxxxxxx", "authModuleId": "xxxxxxxx"}, "community": {"id": "xxxxxxxx", "name": "xxxxxxx", "publicKey": "xxxxxxx"}}'
RESPONSE
200
401
404
500
Success
{
  "list": [
    {
      "personId": "xxxxxxxx",
      "userIdList": [
        "xxxxxxxx"
      ],
      "communityId": "xxxxxxxx",
      "publicKey": "xxxxxxxx",
      "poi_ial": "xxxxxxxx",
      "pon_ial": "xxxxxxxx",
      "updatedTS": "xxxxxxxx",
      "id": "xxxxxxxx"
    }
  ],
  "devices": [
    {
      "uid": "xxxxxxxx",
      "did": "xxxxxxxx",
      "os": "xxxxxxxx",
      "publickey": "xxxxxxxx",
      "deviceName": "xxxxxxxx",
      "authenticatorId": "xxxxxxxx",
      "authenticatorVersion": "xxxxxxxx",
      "authenticatorName": "xxxxxxxx",
      "clientIp": "xxxxxxxx",
      "userAgent": "xxxxxxxx",
      "locLat": "xxxxxxxx",
      "locLon": "xxxxxxxx",
      "id": "xxxxx"
    }
  ],
  "is_user_pin_enrolled": true,
  "is_typing_phrase_enrolled": true
}
POST/users/user/phoneverify/session/{sessionId}/poll

Poll UWL2.0 session for phone verification

Returns updated user object.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Params

sessionId (required)

uuid of session

Returns

Returns array of user documents. This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
sessionIdrequiredstringsessionId for polling
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/phoneverify/session/{sessionId}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/phoneverify/session/<sessionId>/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following array: ``` { "authModule": "string required, ObjectId of auth module", "username": "string required", "type": "string optional - systemuser or basic", "status": "string optional - active or locked or disabled", "firstname": "string optional", "middlename": "string optional", "lastname": "string optional", "email1": "string optional - valid email address", "email1_verified": "boolean optional", "email2": "string optional - valid email address", "email2_verified": "boolean optional", "phone1": "string optional - only digits", "phone1_verified": "boolean optional", "address": { "house": "string optional", "streetname": "string optional", "city": "string optional", "state": "string optional", "country": "string optional", "zip": "string optional" }, "address_verified": "boolean optional", "disabled": "boolean optional" } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/profile/fetch

Fetch User profile

Fetch User own profile details.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

attributes (optional)

attributes : array

Returns

Returns the user info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
attributesarray<object>—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/profile/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/profile/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"attributes": ["firstname"]}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
POST/users/user/unlock

Unlock locked user.

Unlock locked user. A user maybe locked due to OTP mistakes or because he was locked by an administrator.

This endpoint must be accessed by Help Desk admin and Community administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

Returns

204 No Content This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
usernamestring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/unlock
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/unlock' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"username": "xxxxx"}'
RESPONSE
204
401
404
500
No Content
// no response body
POST/users/user/update_phone_numbers

Update user mobiles and landlines

Update user properties.

This endpoint must be accessed by all users to update there mobiles and landlines.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

user (required)

user : object

updatePhones (optional, object of new mobiles and landlines)

updatePhones : { mobiles: [], landlines: [] }

removePhones (optional, object of remove mobiles and landlines )

removePhones : { mobiles: [], landlines: [] }

Returns

Returns the user properties.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
otpstring—
userobject—
updatePhonesobject—
removePhonesobject—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/update_phone_numbers
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/update_phone_numbers' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "otp": "001001", "user": {"username": "string", "uid": "string", "authModuleId": "string"}, "updatePhones": {"mobiles": ["4075156743"], "landlines": ["4075156743"]}, "removePhones": {"mobiles": ["4075156743"], "landlines": ["4075156743"]}}'
RESPONSE
200
400
401
500
Success
{
  "tenantId": "string",
  "communityId": "string",
  "user": {
    "username": "string",
    "uid": "string",
    "authModuleId": "string"
  },
  "mobiles": [
    "4075156743"
  ],
  "landlines": [
    "4075156743",
    "5075156712"
  ]
}
POST/users/user/wallet/create

Create account owned managed wallet for user

Creates web account owned managed wallet for user with given PIN. PIN must have 8 characters either numbers or letter.

This endpoint can be accessed by logged in user

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

pin (required)

pin : string

Returns

Returns jwt_token = string (token-hash)

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
pinstring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet/create
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pin": "12345678"}'
RESPONSE
201
400
401
500
Success data is ECDSA encrypted following object: ``` { jwt_token: "token_hash" } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/wallet/fetch

Fetch account owned managed wallet for user

Fetches web account owned managed wallet for user with given PIN. PIN must have 8 characters either numbers or letter.

This endpoint can be accessed by logged in user

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

pin (required)

pin : string

Returns

Returns jwt_token = string (token-hash)

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
pinstring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pin": "12345678"}'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following object: ``` { jwt_token: "token_hash" } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/wallet/has_wallet/fetch

Check if user has web account managed wallet

Checks if user has web account managed wallet and returns object with field has_wallet = <boolean>.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns info if user has wallet. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet/has_wallet/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet/has_wallet/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following object: ``` { has_wallet: true/false } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/users/user/wallet_recovery/method/fetch

Fetch wallet recovery method

Fetch wallet recovery method.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

Returns

Returns the wallet recovery method. By default, "liveid_selfie" will be returned.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/method/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/method/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "wallet_recovery_method": "xxxxxxxx"
}
POST/users/user/wallet_recovery/session/{sessionId}/poll

Poll UWL2.0 session for wallet recovery method verification

Returns updated user JWT object.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Params

sessionId (required)

uuid of session

Returns

Returns updated JWT token. This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
sessionIdrequiredstringsessionId for polling
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/session/{sessionId}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/session/<sessionId>/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success data is ECDSA encrypted following array: ``` { "jwt_token": "string", } ``` publicKey is public key of adminapi
{
  "jwt_token": "xxxxxxxxxxxx"
}
PUT/users/create

/users/create

Create User.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

moduleId (required)

moduleId : string

username (required)

username : string

status (required)

status : string

disabled (optional)

disabled : boolean

role (required)

role : string

firstname (required)

firstname : string

middlename (optional)

middlename : string

lastname (required)

lastname : string

email1 (required)

email1 : string

email1_verified (optional)

email1_verified : boolean

email2 (optional)

email1 : string

email2_verified (optional)

email2_verified : boolean

phone1 (optional)

phone1 : string

phone1_verified (optional)

phone1_verified : boolean

Returns

Returns the counts of requested, created, failed, and the number of errors.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
moduleIdstring—
usernamestring—
statusstring—
rolestring—
firstnamestring—
middlenamestring—
lastnamestring—
email1string—
email1_verifiedboolean—
email2string—
email2_verifiedboolean—
phone1string—
phone1_verifiedboolean—
disabledboolean—
idpIdstring—
PUThttps://pilot-root.1kosmos.net/adminapi/users/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"moduleId": "xxxxxxxxxx", "username": "xxxxxxxxxx", "status": "xxxxxx", "firstname": "xxxxxxxx", "middlename": "xxxxxxxx", "lastname": "xxxxxxxx", "email1": "xxxxx@xxxxxxxx.xxx", "email1_verified": true, "email2": "xxxxx@xxxxxxxx.xxx", "email2_verified": true, "phone1": "xxxxxxxxxx", "phone1_verified": true, "role": "xxxxx", "disabled": false, "idpId": "xxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "requested": "1,",
  "created": "1,",
  "failed": "0,",
  "errors": []
}
PUT/users/invite

Invite User

Send invitation to the user.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

authModuleId (required)

authModuleId : string

userId (required)

userId : string

emailTo (optional) // Required when 'smsTo' attribute not provided otherwise optional

emailTo : string

smsTo (optional) // Required when 'emailTo' attribute not provided otherwise optional

smsTo : string

firstname (required)

firstname : string

lastname (required)

lastname : string

uid (required)

uid : string

templateKeyPath (required)

templateKeyPath : string

createdby (optional)

createdby : string

createdbyemail (optional)

createdbyemail : string

captchaToken (required unless a valid license is provided)

captchaToken : string

license (optional - if provided and valid, CAPTCHA is bypassed)

license : string

Returns

Returns the invited users object.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
authModuleIdstring—
userIdstring—
emailTostring—
smsTostring—
firstnamestring—
lastnamestring—
uidstring—
templateKeyPathstring—
createdbystring—
createdbyemailstring—
captchaTokenstring—
licensestring—
PUThttps://pilot-root.1kosmos.net/adminapi/users/invite
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/invite' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "authModuleId": "string", "userId": "string", "emailTo": "string", "smsTo": "string", "firstname": "string", "lastname": "string", "uid": "string", "templateKeyPath": "string", "createdby": "string", "createdbyemail": "string", "captchaToken": "string", "license": "string"}'
RESPONSE
200
400
401
500
Success
{
  "emailResult": {
    "status": true,
    "statusCode": 200,
    "message": "https://1k-dev.1kosmos.net/acr,",
    "error": "string",
    "gatewatId": "string",
    "resultId": "string",
    "messageId": "string",
    "ts": "string"
  },
  "link": "string",
  "code": "string"
}
PUT/users/user/alternate_mfa/session/create

Create UWL2.0 session for alternate MFA option

Returns session data.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns session data. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains encrypted data object:

{
    "authModuleId": "authModuleId optional",
    "username" : "username optional"
}

property is optional

FieldTypeDescription
authModuleIdstring—
usernamestring—
PUThttps://pilot-root.1kosmos.net/adminapi/users/user/alternate_mfa/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/user/alternate_mfa/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"authModuleId": "xxxxxxxxxxx", "username": "xxxxxxxxxxx"}'
RESPONSE
200
401
500
Success data is ECDSA encrypted following array: ``` { "acrUrl": "xxxxxx", } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/users/user/phoneverify/session/create

Create UWL2.0 session for phone verification

Returns session data.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns session data. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/users/user/phoneverify/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/user/phoneverify/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success data is ECDSA encrypted following array: ``` { "sessionId": "sessionId", "sessionEnv": "sessionEnv", "smsServiceNumber": "smsServiceNumber", "smsTemplateB64": "smsTemplateB64", } ``` publicKey is public key of adminapi
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/users/user/user_pin/update

Update user pin

Update user pin only for own user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the status of updated user pin .

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
newPinstring—
PUThttps://pilot-root.1kosmos.net/adminapi/users/user/user_pin/update
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/user/user_pin/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"newPin": "string"}'
RESPONSE
200
400
401
500
Success
{
  "data": {
    "status": true
  }
}
PUT/users/user/wallet_recovery/session/create

Create UWL2.0 session for wallet recovery method

Returns session data.

This endpoint can be accessed by logged in user

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

purpose (required)

purpose : string

Returns

Returns session data. This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains encrypted data object:

{
    "purpose": "enroll | authenticate",
    "biometricConsentAccepted": true
}

purpose is required

FieldTypeDescription
purposestring—
biometricConsentAcceptedboolean—
PUThttps://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/users/user/wallet_recovery/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"purpose": "xxxxxxxxxxx", "biometricConsentAccepted": true}'
RESPONSE
200
401
500
Success data is ECDSA encrypted following object: ``` { "sessionId": "sessionId", "sessionEnv": "sessionEnv", "sessionUrl": "sessionUrl", "authenticateWalletUrl": "authenticateWalletUrl", } ``` publicKey is public key of adminapi
{
  "sessionId": "xxxxxxxxxxxx",
  "sessionEnv": "xxxxxxxxxxx",
  "sessionUrl": "xxxxxxxxxxxx",
  "authenticateWalletUrl": "xxxxxxxxxxx"
}
PATCH/users/unlinkuser

Unlink user device

Unlink user device by user did.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Return a success message for unlink device.

This API throw an error if something goes wrong.

Permissions

Administrators can unlink any device from any user within their own community. Basic users can only unlink their own device.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
userrequiredobject—
communityrequiredobject—
didrequiredstring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/users/unlinkuser
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/users/unlinkuser' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user": {"uid": "string", "username": "string", "authModuleId": "string"}, "community": {"id": "string", "name": "string", "publicKey": "string"}, "did": "string"}'
RESPONSE
200
401
404
500
Success
{
  "message": "xxxxxxxx"
}
PATCH/users/user/role/update

Update user role

Update User roles.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

+ Admin can remove middlename, email2 and phone1 fields, so for remove this fields admin should pass empty string { middlename: ""}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

username (required)

username : string

uid (required)

uid : string

disabled (optional)

disabled : boolean

oldRole (required)

oldRole : string

newRole (required)

newRole : string

Returns

Returns the updated user profile

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
usernamestring—
uidstring—
oldRolestring—
newRolestring—
disabledboolean—
PATCHhttps://pilot-root.1kosmos.net/adminapi/users/user/role/update
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/users/user/role/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "moduleId": "xxxxxxxxxx", "username": "xxxxxxxxxx", "uid": "xxxxxxxxxx", "oldRole": "xxxxx", "newRole": "xxxxx", "disabled": false}'
RESPONSE
200
400
401
500
Success
{
  "status": true
}
PATCH/users/user/update

Update user details

Update User details.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

+ Admin can remove middlename, email2 and phone1 fields, so for remove this fields admin should pass empty string { middlename: ""}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

username (required)

username : string

uid (required)

uid : string

status (optional)

status : string - active or locked or disabled

disabled (optional)

disabled : boolean

role (optional)

role : string

firstname (optional)

firstname : string

middlename (optional)

middlename : string

lastname (optional)

lastname : string

email1 (optional)

email1 : string

email1_verified (optional)

email1_verified : boolean

email2 (optional)

email1 : string

email2_verified (optional)

email2_verified : boolean

phone1 (optional)

phone1 : string

phone1_verified (optional)

phone1_verified : boolean

Returns

Returns the updated user profile

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
usernamestring—
uidstring—
statusstring—
oldRolestring—
newRolestring—
firstnamestring—
middlenamestring—
lastnamestring—
email1string—
email1_verifiedboolean—
email2string—
email2_verifiedboolean—
phone1string—
phone1_verifiedboolean—
disabledboolean—
PATCHhttps://pilot-root.1kosmos.net/adminapi/users/user/update
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/users/user/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "moduleId": "xxxxxxxxxx", "username": "xxxxxxxxxx", "uid": "xxxxxxxxxx", "status": "xxxxxx", "firstname": "xxxxxxxx", "middlename": "xxxxxxxx", "lastname": "xxxxxxxx", "email1": "xxxxx@xxxxxxxx.xxx", "email1_verified": true, "email2": "xxxxx@xxxxxxxx.xxx", "email2_verified": true, "phone1": "xxxxxxxxxx", "phone1_verified": true, "oldRole": "xxxxx", "newRole": "xxxxxx", "disabled": false}'
RESPONSE
200
400
401
500
Success
{
  "uid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenantId": "xxxxxxxxxx",
  "communityId": "xxxxxxxxxxxxxxxxxxxxxxxx",
  "username": "xxxxxx",
  "type": "xxxxx",
  "roleValue": "xxxxx",
  "status": "xxxxxx",
  "firstname": "xxxxxxxx",
  "middlename": "xxxxxxxx",
  "lastname": "xxxxxxxx",
  "email1": "xxxxx@xxxxxxxx.xxx",
  "email1_verified": true,
  "email2": "xxxxx@xxxxxxxx.xxx",
  "email2_verified": true,
  "phone1": "xxxxxxxxxx",
  "phone1_verified": true,
  "address": {},
  "address_verified": false,
  "disabled": false
}
DELETE/users/accesscode/{code}

Delete an access code

Delete an access code.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

204 No Content This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
coderequiredstringName of service provider item
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/users/accesscode/{code}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/users/accesscode/<code>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
401
404
500
No Content
// no response body
Admin API

Login Settings

Configure how communities authenticate.

GET/config/authentication/fido_settings

Fetch Fido settings for community

Fetch Fido settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/fido_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/fido_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "fido_disabled": "false",
  "fido_platform_authenticator_disabled": "false",
  "fido_security_key_disabled": "false"
}
GET/config/authentication/first_time_enrollment_settings

Fetch first time enrollment settings

Fetch first time enrollment settings.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/first_time_enrollment_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/first_time_enrollment_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "first_time_login_enrollment": false,
  "allowed_factors": []
}
GET/config/authentication/liveid_selfie_settings

Get LiveID Selfie login settings for community

Get LiveID Selfie login settings for community.

This endpoint must be accessed by an administrator.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/liveid_selfie_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/liveid_selfie_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "liveid_selfie_enabled": false
}
GET/config/authentication/mfa_settings

Get Multi-Factor Authentication settings for community

Get Multi-Factor Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/mfa_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/mfa_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "show_otp_email": "boolean,",
  "show_otp_phone": "boolean,",
  "show_otp_voice": "boolean,",
  "show_otp_hardware": "boolean,",
  "otp_prompt_text": "string,",
  "accountLockEnabled": "boolean,",
  "otpMaxAttempts": "number,",
  "lockDurationMinutes": "number,",
  "onespan_domain": "string,",
  "onespan_url": "string",
  "self_enroll_phone_allowed": "boolean"
}
GET/config/authentication/orion_settings

Fetch Orion settings for community

Fetch Orion settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/orion_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/orion_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "orion_authenticator_enabled": true,
  "orion_authenticator_wait_time_ms": 1500
}
GET/config/authentication/password_reset

Get password reset Authentication settings for community

Get password reset Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/password_reset
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/password_reset' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "default_input_method": "string",
  "adminx_via_email_enabled": true,
  "adminx_require_otp": true,
  "mobile_enabled": true,
  "sspr": {
    "enabled": true,
    "via_idproofing": {
      "enabled": true
    },
    "dvcId": "string",
    "user_profile_api": {
      "enabled": true,
      "provider": "string",
      "api": {
        "url": "string",
        "type": "string",
        "auth": "string",
        "credential": {
          "username": "string",
          "password": "string",
          "token": "string"
        }
      },
      "transformationB64": "string"
    }
  }
}
GET/config/authentication/pwdless_settings/{dns}/{communityName}

Fetch pwdless setting auth info

Fetch pwdless setting auth info.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Path parameters
NameTypeDescription
dnsrequiredstringDNS Name (string)
communityNamerequiredstringcommunityName (string)
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/pwdless_settings/{dns}/{communityName}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/pwdless_settings/xxxxxxxxxx/xxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "primaryMethod": "Fingerprint",
  "secondaryMethod": "Pin",
  "selfOnBoard": true,
  "selfOnBoardFromUserProfile": true,
  "accountsPerPerson": 5,
  "personsPerAccount": 1,
  "personLimitRule": "cleanup",
  "passwordless_disabled": true,
  "qr_disabled": true,
  "push_disabled": "true",
  "push_number_challenge_enabled": true,
  "defaultMethods": "Fingerprint"
}
GET/config/authentication/windows_mfa_settings

Get Multi-Factor Windows Authentication settings for community

Get Multi-Factor Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing Windows MFA settings config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/authentication/windows_mfa_settings
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/authentication/windows_mfa_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "allowed_enrollments": {
    "behavior_auth": true,
    "user_pin": true
  },
  "enableFallbackAuth": true,
  "maxAuthAttemptsBeforeFallback": 4
}
POST/config/authentication/sspr/execute_transformation_script

Test the transformation

Test the provided transformation script with given config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
      username: "string required"
}
FieldTypeDescription
usernamestringoptional
POSThttps://pilot-root.1kosmos.net/adminapi/config/authentication/sspr/execute_transformation_script
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/authentication/sspr/execute_transformation_script' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"username": "string"}'
RESPONSE
200
400
401
500
Success
{
  "firstname": "xxxxx",
  "lastname": "xxxxxxxxxxxx",
  "dob": "xxxx"
}
PUT/config/authentication/fido_settings

Set Fido settings for community

Set Fido settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  fido_disabled: "boolean required",
  fido_platform_authenticator_disabled: "boolean required"
  fido_security_key_disabled: "boolean required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
fido_disabledboolean—
fido_platform_authenticator_disabledboolean—
fido_security_key_disabledboolean—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/fido_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/fido_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxx", "fido_disabled": "false", "fido_platform_authenticator_disabled": "false", "fido_security_key_disabled": "false"}'
RESPONSE
200
400
401
500
Success
{
  "fido_disabled": "false",
  "fido_platform_authenticator_disabled": "false",
  "fido_security_key_disabled": "false"
}
PUT/config/authentication/first_time_enrollment_settings

Set first time enrollment settings for community

Set first time enrollment settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  first_time_login_enrollment: "boolean"
  allowed_factors: []
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
first_time_login_enrollmentboolean—
allowed_factorsarray<object>—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/first_time_enrollment_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/first_time_enrollment_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "first_time_login_enrollment": true, "allowed_factors": ["mobile", "landline", "smartphone"]}'
RESPONSE
200
400
401
500
Success
{
  "first_time_login_enrollment": true,
  "allowed_factors": [
    "mobile",
    "landline",
    "smartphone"
  ]
}
PUT/config/authentication/liveid_selfie_settings

Set LiveID Selfie login settings for community

Set LiveID Selfie login settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  liveid_selfie_enabled: "boolean required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
liveid_selfie_enabledboolean—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/liveid_selfie_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/liveid_selfie_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxx", "liveid_selfie_enabled": false}'
RESPONSE
200
400
401
500
Success
{
  "liveid_selfie_enabled": false
}
PUT/config/authentication/mfa_settings

Set Multi-Factor Authentication settings for community

Set Multi-Factor Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  show_otp_email: "boolean required",
  show_otp_phone: "boolean required"
  show_otp_voice: "boolean required"
  show_otp_hardware: "boolean required"
  otp_prompt_text: "string required"
  accountLockEnabled: true,
  otpMaxAttempts: 2,
  lockDurationMinutes: 60
  onespan_domain: "string required"
  onespan_url: "string required",
  self_enroll_phone_allowed: "boolean required"
  sync_window_for_first_usage: "number required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
show_otp_emailboolean—
show_otp_phoneboolean—
show_otp_voiceboolean—
show_otp_hardwareboolean—
otp_prompt_textstring—
accountLockEnabledboolean—
otpMaxAttemptsnumber—
lockDurationMinutesnumber—
onespan_domainstring—
onespan_urlstring—
self_enroll_phone_allowedstring—
sync_window_for_first_usagenumber—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/mfa_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/mfa_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "show_otp_email": true, "show_otp_phone": true, "show_otp_voice": true, "show_otp_hardware": true, "otp_prompt_text": "string", "accountLockEnabled": true, "otpMaxAttempts": 2, "lockDurationMinutes": 60, "onespan_domain": "string", "onespan_url": "string", "self_enroll_phone_allowed": false, "sync_window_for_first_usage": 60000}'
RESPONSE
200
400
401
500
Success
{
  "show_otp_email": true,
  "show_otp_phone": true
}
PUT/config/authentication/orion_settings

Set Orion settings for community

Set Orion settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  orion_authenticator_enabled: "boolean required",
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
orion_authenticator_enabledboolean—
orion_authenticator_wait_time_msnumber—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/orion_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/orion_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "5f3d8d0cd866fa61019cf968", "communityId": "5f3d8d0cd866fa61019cf969", "orion_authenticator_enabled": true, "orion_authenticator_wait_time_ms": 1500}'
RESPONSE
200
400
401
500
Success
{
  "orion_authenticator_enabled": true,
  "orion_authenticator_wait_time_ms": 1500
}
PUT/config/authentication/password_reset

Set Password reset settings for community

Set Password reset Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

{
  default_input_method: "string required"
  tenantId: "string required",
  communityId: "string required",
  adminx_via_email_enabled: boolean,
  adminx_require_otp: boolean,
  mobile_enabled: boolean,
  sspr: object optional
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
default_input_methodstring—
adminx_via_email_enabledboolean—
adminx_require_otpboolean—
mobile_enabledboolean—
ssprobject—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/password_reset
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/password_reset' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "default_input_method": "string", "adminx_via_email_enabled": true, "adminx_require_otp": true, "mobile_enabled": true, "sspr": {"enabled": true, "via_idproofing": {}, "otp": "string optional", "dvcId": "string", "user_profile_api": {"enabled": true, "provider": "string", "api": {"url": "string", "type": "string", "auth": "string", "credential": {"username": "string", "password": "string", "token": "string"}}, "transformationB64": "string"}}}'
RESPONSE
200
400
401
500
Success
{
  "tenantId": "string",
  "communityId": "string",
  "default_input_method": "string",
  "adminx_via_email_enabled": true,
  "adminx_require_otp": true,
  "mobile_enabled": true,
  "sspr": {
    "enabled": true,
    "via_idproofing": {},
    "dvcId": "string",
    "user_profile_api": {
      "enabled": true,
      "provider": "string",
      "api": {
        "url": "string",
        "type": "string",
        "auth": "string"
      },
      "transformationB64": "string"
    }
  }
}
PUT/config/authentication/pwdless_settings

Set pwdless settings for community

Set pwdless settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  primaryMethod: "string required, default Fingerprint",
  secondaryMethod: "string",
  selfOnBoard: "boolean required"
  selfOnBoardFromUserProfile: "boolean required"
  accountsPerPerson : "number required",
  personsPerAccount : "number required",
  personLimitRule : "string required",
  passwordless_disabled : "boolean required",
  qr_disabled : "boolean required",
  push_disabled : "boolean required",
  push_number_challenge_enabled : "boolean optional",
  dns : "string required",
  communityName : "string required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
primaryMethodstring—
secondaryMethodstring—
selfOnBoardboolean—
selfOnBoardFromUserProfileboolean—
accountsPerPersonnumber—
personsPerAccountnumber—
personLimitRulestring—
passwordless_disabledboolean—
qr_disabledboolean—
push_disabledboolean—
dnsstring—
communityNamestring—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/pwdless_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/pwdless_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "primaryMethod": "Fingerprint", "secondaryMethod": "Pin", "selfOnBoard": true, "selfOnBoardFromUserProfile": true, "accountsPerPerson": 5, "personsPerAccount": 1, "personLimitRule": "cleanup", "passwordless_disabled": true, "qr_disabled": true, "push_disabled": true, "dns": "string", "communityName": "string"}'
RESPONSE
200
400
401
500
Success
{
  "primaryMethod": "Fingerprint",
  "secondaryMethod": "Pin",
  "accountsPerPerson": 5,
  "personsPerAccount": 1,
  "personLimitRule": "cleanup",
  "passwordless_disabled": true,
  "qr_disabled": true,
  "push_disabled": true,
  "fido_disabled": true,
  "fido_security_key_disabled": true,
  "fido_platform_authenticator_disabled": true
}
PUT/config/authentication/windows_mfa_settings

Set Multi-Factor Windows Authentication settings for community

Set Multi-Factor Windows Authentication settings for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing Windows MFA settings config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data, and you will get unencrypted data as well, it is only a preview available in Swagger

{
  allowed_enrollments: {
     behavior_auth: boolean required,
     user_pin: boolean required
   },
  enableFallbackAuth: boolean optional,
  maxAuthAttemptsBeforeFallback: number optional
}
FieldTypeDescription
allowed_enrollmentsobject—
enableFallbackAuthboolean—
maxAuthAttemptsBeforeFallbacknumber—
PUThttps://pilot-root.1kosmos.net/adminapi/config/authentication/windows_mfa_settings
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/authentication/windows_mfa_settings' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"allowed_enrollments": {"behavior_auth": true, "user_pin": true}, "enableFallbackAuth": true, "maxAuthAttemptsBeforeFallback": 4}'
RESPONSE
200
400
401
500
Success
{
  "allowed_enrollments": {
    "behavior_auth": true,
    "user_pin": true
  },
  "enableFallbackAuth": true,
  "maxAuthAttemptsBeforeFallback": 4
}
Admin API

Authenticate

Server-side authentication operations.

GET/logout

Logout current user

Logout currently logged in user user and remove session

This endpoint can be called only by logged in user.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Status NO_CONTENT

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/logout
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/logout' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
400
401
500
Successfully logged out<br /><br />
// no response body
GET/tenant/{tenantId}/community/{communityId}/request_access_with_kerberos

Authenticate with kerberos

authenticate user with kerberos.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

Negotiate {ktoken}

x-jwt-token (optional, for reauthentication)

Bearer {ktoken}

Returns

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
tenantIdrequiredstringTenant Id
communityIdrequiredstringCommunity Id
Query parameters
NameTypeDescription
reauthenticationstringboolean indicating whether this is a reauthentication attempt (should also include x-jwt-token header if true)
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/tenant/{tenantId}/community/{communityId}/request_access_with_kerberos
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/tenant/<tenantId>/community/<communityId>/request_access_with_kerberos?reauthentication=<reauthentication>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT'
RESPONSE
400
401
500
Invalid request
// no response body
POST/authenticate

/authenticate

Authenticate user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

user_token (required), encrypted user object

user_token : string

passcode (required)

passcode : string

aliasUsed (optinal)

aliasUsed: string

Returns

Returns the authentication information.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
user_tokenstring—
passcodestring—
aliasUsedstring—
POSThttps://pilot-root.1kosmos.net/adminapi/authenticate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/authenticate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "user_token": "string", "passcode": "string", "aliasUsed": "string"}'
RESPONSE
200
400
401
500
Success
{
  "user": "object",
  "pon_data": "object",
  "jwt_token": "string"
}
POST/authenticate_via_push

Send push notification

authenticate user via push notification.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

username (optional)

username : string

user_token (optional)

user_token : string

sessionUrl (required)

sessionUrl : string

Returns

Returns the push notification info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
usernamestring—
user_tokenstring—
sessionUrlstring—
POSThttps://pilot-root.1kosmos.net/adminapi/authenticate_via_push
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/authenticate_via_push' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "username": "string optional", "user_token": "string optional", "sessionUrl": "string"}'
RESPONSE
200
400
401
429
500
Success
{
  "code": "200",
  "message": "SUCCESS",
  "data": "",
  "sessionStatus": null
}
POST/oidc/sso

/oidc/sso

Oidc SSO.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

OIDCRequest (required)

OIDCRequest

Returns

Returns information to perform OIDC SSO.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
OIDCRequeststring—
acrstring—
POSThttps://pilot-root.1kosmos.net/adminapi/oidc/sso
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/oidc/sso' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"OIDCRequest": "string", "acr": "string optional"}'
RESPONSE
200
400
401
420
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/saml/idp-init/{serviceProviderId}

/saml/idp-init/{serviceProviderId}

IDP-Initiated SAML SSO.

Generates a SAML assertion without a prior SAMLRequest (unsolicited response).

The service provider must be of type saml with saml_config.idpInitiated: true.

<b>:: Note for website ::</b>

+ No request body required, service provider ID is passed as a path parameter.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encrypted object with SAMLResponse, relayState, and SP info for IDP-initiated SSO.

This API throws an error if something goes wrong.

Path parameters
NameTypeDescription
serviceProviderIdrequiredstringThe ID of the SAML service provider (must have saml_config.idpInitiated = true)
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/saml/idp-init/{serviceProviderId}
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/saml/idp-init/<serviceProviderId>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
403
404
500
Success Returns ECDSA encrypted object: ``` { "SAMLResponse": "base64 string", "relayState": "string (optional)", "sp": { "assertionConsumerServiceURL": "string - url", "assertionMethod": "string - post or get" } } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/saml/sso

/saml/sso

Saml SSO.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

SAMLRequest (required)

SAMLRequest

Returns

Returns information to perform SAML SSO.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
SAMLRequeststring—
Signaturestring—
SigAlgstring—
RelayStatestring—
POSThttps://pilot-root.1kosmos.net/adminapi/saml/sso
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/saml/sso' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"SAMLRequest": "string", "Signature": "string optional", "SigAlg": "string optional", "RelayState": "string optional"}'
RESPONSE
200
400
401
420
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/verifyuser

/verifyuser

Verify user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

username (required)

username : string

password (optional)

password : string

otp (optional)

otp : string

Returns

Returns the user info, user_token and next. (password)

Or the user info, pon_data and jwt token. (otp)

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key
authorizationstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
usernamestring—
passwordstring—
otpstring—
POSThttps://pilot-root.1kosmos.net/adminapi/verifyuser
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/verifyuser' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "username": "string", "password": "string optional", "otp": "string optional"}'
RESPONSE
200
400
401
500
Success
{
  "user": "object",
  "pon_data": "object",
  "user_token": "string",
  "jwt_token": "string",
  "next": "otp"
}
POST/wsfed/sso

/wsfed/sso

wsfed SSO.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

wtrealm (required)

wtrealm : string

wreply (optional)

wreply : string

wctx (optional)

wctx : string

Returns

Returns information to perform WSFED SSO.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
wtrealmstring—
wastring—
wreplystring—
wctxstring—
POSThttps://pilot-root.1kosmos.net/adminapi/wsfed/sso
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/wsfed/sso' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"wtrealm": "string required", "wa": "string required", "wreply": "string optional", "wctx": "string optional"}'
RESPONSE
200
400
401
420
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/authenticate/otp

/authenticate/otp

Create OTP for user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

communityId (required)

communityId : string

tenantId (required)

tenantId : string

user_token (required)

user_token : string

deliveryMethod (required)

deliveryMethod : string

Returns

Returns the Adminconsole response (reencrypted).

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
communityIdstring—
tenantIdstring—
user_tokenstring—
jwt_tokenstring—
deliveryMethodstring—
isResetPasswordboolean—
destinationstring—
PUThttps://pilot-root.1kosmos.net/adminapi/authenticate/otp
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/authenticate/otp' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"communityId": "string", "tenantId": "string", "user_token": "string", "jwt_token": "string", "deliveryMethod": "string", "isResetPassword": "true/false - optional", "destination": "string"}'
RESPONSE
200
400
401
429
500
Success.<br /><br /> Returns reencrypted response from Adminconsole.
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/generate/otp

/generate/otp

Create OTP for user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

communityId (required)

communityId : string

tenantId (required)

tenantId : string

user_token (required)

user_token : string

deliveryMethod (required)

deliveryMethod : string

Returns

Returns the Adminconsole response (reencrypted).

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
communityIdstring—
tenantIdstring—
user_tokenstring—
jwt_tokenstring—
deliveryMethodstring—
isResetPasswordboolean—
destinationstring—
PUThttps://pilot-root.1kosmos.net/adminapi/generate/otp
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/generate/otp' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"communityId": "string", "tenantId": "string", "user_token": "string", "jwt_token": "string", "deliveryMethod": "string", "isResetPassword": "true/false - optional", "destination": "string"}'
RESPONSE
200
400
401
429
500
Success.<br /><br /> Returns reencrypted response from Adminconsole.
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Hardware tokens

Hardware tokens endpoints.

POST/hardwaretokens/fetch

Fetch all the Hardware tokens.

To list all the hardware tokens

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### pSize (optional) pSize : number

### pIndex (optional) pIndex : number

### query (optional) query : object

### returnAssignedUserCount (optional) returnAssignedUserCount : boolean

### returnActivityStatus (optional) returnActivityStatus : boolean

Returns

  • returns list of tokens in paginated structure
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
pSizenumber—
pIndexnumber—
queryobject—
returnAssignedUserCountboolean—
returnActivityStatusboolean—
POSThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pIndex": 0, "pSize": 25, "query": {"serialNumbers": ["sr001", "/sr002/"]}, "returnAssignedUserCount": true, "returnActivityStatus": true}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
POST/hardwaretokens/import_csv

Upload hardware tokens CSV file

To upload a list of Hardware Tokens via a CSV file.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string), and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns a success message or an error response

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/import_csv
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/import_csv' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "data": {},
  "publicKey": "string"
}
POST/hardwaretokens/resync

Re-sync Hardware token.

To re-sync a token by using 3 sequential OTP values with Serial Number

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ The default request body is: {data: ecdsa_string}

Headers

requestid (required)

A JSON string encrypted with ECDSA, containing:

  • "appid" (string)
  • "uuid" (string)
  • "ts" (number): epoch timestamp in seconds

The timestamp must be within the range defined by 'environment.allowed_time_span'.

publickey (required)

Public key

authorization (required)

JWT token

Request Body

code1 (required)

code1: string

code2 (required)

code2: string

code3 (required)

code3: string

serialNumber (required)

serialNumber: string

Returns

  • Returns success of failure response
  • Throws an error if the request fails.
Headers
NameTypeDescription
requestidrequiredstringA JSON string encrypted with ECDSA containing "appid", "uuid", and "ts" (epoch timestamp in seconds). The timestamp must be within 'environment.allowed_time_span'. / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
code1string—
code2string—
code3string—
serialNumberstring—
POSThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/resync
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/resync' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"code1": "string", "code2": "string", "code3": "string", "serialNumber": "string"}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
POST/hardwaretokens/usertokens/fetch

Fetch all the Users or Tokens assigned

To List all users or tokens assigned to hardware tokens or users.

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### pSize (optional) pSize : number

### pIndex (optional) pIndex : number

### query (optional) query : object

Returns

  • returns success of failure response
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
pSizenumber—
pIndexnumber—
queryobject—
POSThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pIndex": 0, "pSize": 25, "query": {"username": "string", "serialNumber": "string"}}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
POST/hardwaretokens/usertokens/import_csv

Upload CSV file to assign users to tokens

Upload a list of user-token assignments using a CSV file.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string), and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Returns a success message or an error response

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/import_csv
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/import_csv' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "data": {},
  "publicKey": "string"
}
PUT/hardwaretokens/tokens

Create Hardware tokens from CSV text.

To create a list of hardware tokens from CSV text

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### csv_text (required) csv_text : string

Returns

  • returns success of failure response
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
csv_textobject—
PUThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"csv_text": "string"}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
PUT/hardwaretokens/usertokens

Assign users to tokens

Assign a list of users to tokens.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ The default request body is: {data: ecdsa_string}

Headers

requestid (required)

A JSON string encrypted with ECDSA, containing:

  • "appid" (string)
  • "uuid" (string)
  • "ts" (number): epoch timestamp in seconds

The timestamp must be within the range defined by 'environment.allowed_time_span'.

publickey (required)

Public key

authorization (required)

JWT token

Request Body

list (required)

An array of user-token mappings.

Returns

  • Returns success of failure response
  • Throws an error if the request fails.
Headers
NameTypeDescription
requestidrequiredstringA JSON string encrypted with ECDSA containing "appid", "uuid", and "ts" (epoch timestamp in seconds). The timestamp must be within 'environment.allowed_time_span'. / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
listarray<object>—
PUThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"list": [{"username": "string", "serialNumber": "string"}]}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
PUT/hardwaretokens/usertokens/csv_text

Assign users to tokens from CSV text.

Assign users to tokens from a valid CSV text

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### csv_text (required) csv_text : string

Returns

  • returns success of failure response
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
csv_textstring—
PUThttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/csv_text
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens/csv_text' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"csv_text": "serialNumber,username\nsn00001,elamaran"}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
PATCH/hardwaretokens/tokens/{id}

Edit Hardware tokens.

To edit hardware token's seed and counter

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

### id (required) id

Request Body

### seed (optional) seed : string

### counter (optional) counter : number

Returns

  • returns success of failure response
  • returns bad request if none of the attributes provided
  • Throws an error if something goes wrong.
Path parameters
NameTypeDescription
idrequiredstringThe Id of hardware token
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
seedstring—
counternumber—
PATCHhttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens/<id>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"seed": "string", "counter": 0}'
RESPONSE
200
400
401
500
Success
{
  "data": "object",
  "publicKey": "string"
}
DELETE/hardwaretokens/tokens

Delete Hardware tokens.

To delete a list of hardware tokens by serial number

This endpoint must be accessed by an administrator

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### serialNumbers (required) serialNumbers : array

Returns

  • returns success of failure response
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
serialNumbersarray<object>—
DELETEhttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/tokens' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"serialNumbers": ["sr001", "sr002"]}'
RESPONSE
200
400
401
500
Success
{
  "deletedCount": 1
}
DELETE/hardwaretokens/usertokens

Unassign users from the tokens

Unassign a list of users from tokens.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ The default request body is: {data: ecdsa_string}

Headers

requestid (required)

A JSON string encrypted with ECDSA, containing:

  • "appid" (string)
  • "uuid" (string)
  • "ts" (number): epoch timestamp in seconds

The timestamp must be within the range defined by 'environment.allowed_time_span'.

publickey (required)

Public key

authorization (required)

JWT token

Request Body

list (required)

An array of user-token mappings.

Returns

  • Returns success of failure response.
  • Throws an error if the request fails.
Headers
NameTypeDescription
requestidrequiredstringA JSON string encrypted with ECDSA containing "appid", "uuid", and "ts" (epoch timestamp in seconds). The timestamp must be within 'environment.allowed_time_span'. / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
listarray<object>—
DELETEhttps://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/hardwaretokens/usertokens' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"list": [{"username": "string", "serialNumber": "string"}]}'
RESPONSE
204
400
401
500
No contnent
// no response body
Admin API

Community SAML

Community SAML endpoints.

GET/community/{communityName}/idp/{idpIdentifier}/metadata

/community/{communityName}/idp/{idpIdentifier}/metadata

Fetch IDP metadata.

Query

download (optional)

download : boolean

Returns

Returns 200 OK and xml metadata

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
idpIdentifierrequiredstringUnique identifier of idp
Query parameters
NameTypeDescription
downloadbooleanFlag - if set to true, api will produce content disposition header
GEThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/idp/{idpIdentifier}/metadata
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/idp/<idpIdentifier>/metadata?download=<download>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
400
401
404
500
Success
// no response body
GET/community/{communityName}/saml/acs

/community/{communityName}/saml/acs

Redirect to Admin UI SSO page.

Query

SAMLResponse (required)

SAMLRequest : string

RelayState (optional)

RelayState : string

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Query parameters
NameTypeDescription
SAMLResponsestringSAMLResponse
RelayStatestringRelayState
GEThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/saml/acs
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/saml/acs?SAMLResponse=<SAMLResponse>&RelayState=<RelayState>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
GET/community/{communityName}/slo

/community/{communityName}/slo

Redirect to Admin UI SLO page.

Returns

Returns 302 Found and Location header.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
GEThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/slo
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/slo' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
302
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
GET/community/{communityName}/sso

/community/{communityName}/sso

Redirect to Admin UI SSO page.

Query

SAMLRequest (required)

SAMLRequest : string

RelayState (optional)

RelayState : string

ForceAuthn (optional)

ForceAuthn : boolean

SigAlg (optional)

SigAlg : string

Signature (optional)

Signature : string

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Query parameters
NameTypeDescription
SAMLRequeststringSAMLRequest
RelayStatestringRelayState
ForceAuthnstringForceAuthn
SigAlgstringSigAlg
SignaturestringSignature
GEThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/sso
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/sso?SAMLRequest=<SAMLRequest>&RelayState=<RelayState>&ForceAuthn=<ForceAuthn>&SigAlg=<SigAlg>&Signature=<Signature>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
GET/community/{communityName}/wsfed

/community/{communityName}/wsfed

Redirect to Admin UI WSFED SSO page.

Query

wtrealm (required)

wtrealm : string

wa (required)

wa : string

whr (optional)

whr : string

wfresh (optional)

wfresh : string

wctx (optional)

wctx : string

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Query parameters
NameTypeDescription
wtrealmrequiredstringwtrealm
warequiredstringwa
whrstringwa
wfreshstringwfresh
wctxstringwfresh
GEThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/wsfed
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/wsfed?wtrealm=<wtrealm>&wa=<wa>&whr=<whr>&wfresh=<wfresh>&wctx=<wctx>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
POST/community/{communityName}/idp/{idpIdentifier}/metadata

/community/{communityName}/idp/{idpIdentifier}/metadata

Fetch IDP metadata.

Query

download (optional)

download : boolean

Returns

Returns 200 OK and xml metadata

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
idpIdentifierrequiredstringUnique identifier of idp
Query parameters
NameTypeDescription
downloadbooleanFlag - if set to true, api will produce content disposition header
POSThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/idp/{idpIdentifier}/metadata
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/idp/<idpIdentifier>/metadata?download=<download>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
400
401
404
500
Success
// no response body
POST/community/{communityName}/saml/acs

/community/{communityName}/saml/acs

Redirect to RelayState or AdminUI login page (if no RelayState present).

Request Body

SAMLResponse (required)

SAMLResponse : string

RelayState (optional)

RelayState : string

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Request body
FieldTypeDescription
SAMLResponsestring—
RelayStatestring—
POSThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/saml/acs
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/saml/acs' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"SAMLResponse": "SAMLResponse", "RelayState": "RelayState"}'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
POST/community/{communityName}/slo

/community/{communityName}/slo

Redirect to Admin UI SLO page.

Returns

Returns 302 Foud and Location header.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
POSThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/slo
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/slo' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{}'
RESPONSE
302
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
POST/community/{communityName}/sso

/community/{communityName}/sso

Redirect to Admin UI SSO page.

Request Body

SAMLRequest (required)

SAMLRequest : string

RelayState (optional)

RelayState : string

ForceAuthn (optional)

ForceAuthn : boolean

Query

RelayState (optional)

RelayState : string

ForceAuthn (optional)

ForceAuthn : boolean

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Query parameters
NameTypeDescription
RelayStatestringRelayState
ForceAuthnstringForceAuthn
Request body
FieldTypeDescription
SAMLRequeststring—
RelayStatestring—
ForceAuthnboolean—
POSThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/sso
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/sso?RelayState=<RelayState>&ForceAuthn=<ForceAuthn>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"SAMLRequest": "SAMLRequest", "RelayState": "RelayState", "ForceAuthn": false}'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
POST/community/{communityName}/wsfed

/community/{communityName}/wsfed

Redirect to Admin UI WSFED SSO page.

Request Body

wtrealm (required)

wtrealm : string

wa (required)

wa : string

whr (optional)

whr : string

wfresh (optional)

wfresh : string

wctx (optional)

wctx : string

Returns

Returns 302 Found and Location header.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
communityNamerequiredstringCommunity Name
Request body
FieldTypeDescription
wtrealmstring—
wastring—
whrstring—
wfreshnumber—
wctxstring—
POSThttps://pilot-root.1kosmos.net/adminapi/community/{communityName}/wsfed
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community/<communityName>/wsfed' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"wtrealm": "urn:wsfed-app", "wa": "wsignin1.0", "whr": "whr", "wfresh": 0, "wctx": "some context"}'
RESPONSE
302
400
500
Success, but UI cannot display it properly (you will get 404 Not Found or CORS problems). You need to inspect Network in developer tools.
// no response body
Admin API

Reports

Pull usage, audit and activity reports.

POST/reports/audit_log

Fetch Audit log Report

This endpont should return events where eventCategory = 'AUDIT_LOG'

It is access by an tenant/community administrator.

AUDIT_LOG events

<b> E_BROKER_DISCONNECTED, E_DIRECTORY_ADDED, E_DIRECTORY_MODIFIED, E_DIRECTORY_REMOVED, E_DIRECTORY_BROKER_ENABLED, E_DIRECTORY_BROKER_DISABLED, E_DIRECTORY_BROKER_DELETED, E_DIRECTORY_BROKER_MODIFIED, E_DIRECTORY_ATTRIBUTE_ADDED, E_DIRECTORY_ATTRIBUTE_MODIFIED, E_DIRECTORY_ATTRIBUTE_DELETED, E_DIRECTORY_ADVANCED_CONFIGURATION_MODIFIED, E_IDP_CONFIGURATION_MODIFIED, E_ROLE_CHANGED, E_SP_CREATED, E_SP_MODIFIED, E_SP_DELETED, E_PREFERREDSTORES_MODIFIED, E_BRANDING_MODIFIED, E_ADAPTIVEAUTH_MODIFIED,

</b>

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of events where eventCategory = 'AUDIT_LOG'

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "pSize": "integer, default is 10",
  "pIndex": "integer, default is 0",
  "from": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, should be from now to (now - 90 days), default is now - 30 days",
  "to": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, default is now",
  "user_id": "string",
  "download": {
     "notificationList": ["array of emails"]
  }
}

"download" parameter is optional, if provided notificationList also should be provided

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
pSizenumber—
pIndexnumber—
fromstring—
tostring—
user_idstring—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/audit_log
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/audit_log' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "pSize": 10, "pIndex": 0, "from": "2021-09-01 00:00:00.000", "to": "2021-09-28 00:00:00.000", "user_id": "username"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 100 }, "data": [ "auditLogEvents": [ { audit_log_event_1 }, { audit_log_event_1 }, ... { audit_log_event_100 } ] ] } ``` If you send "download" parameter, then only jobId will be returned: ``` { "jobId": "123-456-789-0000" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/reports/download/jobs

Fetch download jobs

Fetch download jobs.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of download jobs

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below are optional:

{
   "sort": [
       {
           "field": "field",
           "order": "desc/asc"
       }
   ],
   "pSize": 10,
   "pIndex": 0
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
sortarray<object>—
pSizenumber—
pIndexnumber—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/download/jobs
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/download/jobs' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"sort": [{"field": "status", "order": "desc"}], "pSize": 10, "pIndex": 0}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 100, "sort": [ { "field": "field", "order": "desc/asc" } ], }, "data": [ { "jobId": "18518ebc-9820-4b3d-b5f7-e99eae7ba108", "createdAt": 1677528772342, "completedAt": 1677528772342/undefined, "status": "Pending", "requestedBy": "email", "sendNotificationTo": ["email@email.com"], "size": 1234 "downloadLink": "https://<dns>/downloads/reports/tenant/<tid1>/community/<cid1>/job/<jid>/report.csv" } ] } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/reports/events

Fetch Events

Get Reports Raw Events.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of events and pagination info

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "pSize": "integer, default is 10",
  "pIndex": "integer, default is 0",
  "from": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, should be from now to (now - 90 days), default is now - 30 days",
  "to": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, default is now",
  "user_id": "string",
  "eventName": "string",
  "outcome": "string"
  "broker_id": "string",
  "download": {
     "notificationList": ["array", "of", "emails"]
  }
}

"download" parameter is optional, if provided notificationList also should be provided

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
pSizenumber—
pIndexnumber—
fromstring—
tostring—
user_idstring—
eventNamestring—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/events
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/events' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "pSize": 10, "pIndex": 0, "from": "2021-09-01 00:00:00.000", "to": "2021-09-28 00:00:00.000", "user_id": "username", "eventName": "E_LOGIN_SUCCEEDED"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 3 }, "data": [ { ...allFieldsFromElasticEvent }, { ...allFieldsFromElasticEvent }, { ...allFieldsFromElasticEvent } ] } ``` If you send "download" parameter, then only jobId will be returned: ``` { "jobId": "123-456-789-0000" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/reports/hardwaretokens_export

Export token data

Exports token data based on the provided query and requested report type.

The type can be either "hardware_tokens" or "user_hardwaretokens".

This endpoint must be accessed by a user with the appropriate permissions to export data.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT access token

Request body

### reports_type (required) reports_type : string

### query (optional) query : object

### download (required) download : object

Returns

Returns a Job ID created for the export request.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA. Should contain "appid" (string), "uuid" (string), and "ts" (number). The timestamp must be within 'environment.allowed_time_span' seconds from the current time. / Try Authorize 🔐
publickeyrequiredstringPublic Key / Try Authorize 🔐
authorizationrequiredstringJWT Access Token / Try Authorize 🔐
Request body

JSON object containing the report type, query, and download notification list.

FieldTypeDescription
reports_typestring—
queryobject—
downloadobject—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/hardwaretokens_export
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/hardwaretokens_export' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"reports_type": "hardware_tokens | user_hardwaretokens", "query": {"serialNumbers": ["sr001", "/sr002/"]}, "download": {"notificationList": ["email1@1kosmos.com"]}}'
RESPONSE
200
400
401
500
Success. The `publicKey` of the WebServer API is used for decryption.<br /><br /> The response contains an encrypted `data` field: ``` { "jobId": "123-456-789-0000" } ``` ⚠️ Note: You can send unencrypted data and receive unencrypted data as well. This is only for preview in Swagger.
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/reports/login_activity

Fetch Login Activity Report

Fetch list of E_SP_REDIRECT_SUCCEEDED events and their respective 1 E_LOGIN_SUCCEEDED event for each unique session_id from SP redirects.

If this endpoint is called by basic user, only that user's events will be returned. If it is called by an administrator, then he tenantId, communityId and user_id filters are applied. This endpoint must be accessed by logged in user

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of E_SP_REDIRECT_SUCCEEDED and E_LOGIN_SUCCEEDED events

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "pSize": "integer, default is 10",
  "pIndex": "integer, default is 0",
  "from": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, should be from now to (now - 90 days), default is now - 30 days",
  "to": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, default is now",
  "user_id": "string",
  "auth_method": "otp | qr etc.",
  "application": "gsuite"
  "download": {
     "notificationList": ["array", "of", "emails"]
  }
}

"download" parameter is optional, if provided notificationList also should be provided

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
pSizenumber—
pIndexnumber—
fromstring—
tostring—
user_idstring—
auth_methodstring—
applicationstring—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/login_activity
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/login_activity' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "pSize": 10, "pIndex": 0, "from": "2021-09-01 00:00:00.000", "to": "2021-09-28 00:00:00.000", "user_id": "username", "auth_method": "otp", "application": "gsuite"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 100 }, "data": [ "activityEvents": [ sp_redirect_event_1, sp_redirect_event_2, ...sp_redirect_event_100 ], "loginEvents": { session_id_1: { e_login_succeeded_event_1 }, session_id_2: { e_login_succeeded_event_2 }, ... session_id_100: { e_login_succeeded_event_100 } } ] } ``` If you send "download" parameter, then only jobId will be returned: ``` { "jobId": "123-456-789-0000" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/reports/metrics

Fetch metrics

Get metrics.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give count or list of metrics for each day/hour from date range

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "from": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, should be from now to (now - 90 days), default is now - 30 days",
  "to": "string with date in format YYYY-MM-DD HH:mm:ss.SSS, default is now, can be equal to from, then you will get hourly metrics",
  "metricsName": "string, one of: M_C_ACTIVE_USER, M_C_LOGIN_FAILED, M_C_LOGINS, M_C_NEW_DEVICES, M_G_APPLICATION_USAGE, M_G_LOGIN_FAILED, M_GT_SUCCESSFUL_AUTHENTICATIONS or M_T_NEW_DEVICES",
  "responseTimezone": "UTC - string optional" ,
  "download":{
       "requestBy": "string, email (required)",
       "notificationList": [ "string, email (required, 1-5 emails)" ],
       "eventData": {
           "tenant_dns": "string (required)",
           "user_id": "string (required)"
       }
   }
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
fromstring—
tostring—
metricsNamestring—
responseTimezonestring—
downloadobject—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/metrics
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/metrics' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "from": "2021-09-01 00:00:00.000", "to": "2021-09-28 00:00:00.000", "metricsName": "M_C_ACTIVE_USER", "responseTimezone": "UTC - string optional", "download": {"requestBy": "test@email.com", "notificationList": ["https://1k-dev.1kosmos.net"], "eventData": {"tenant_dns": "https://1k-dev.1kosmos.net", "user_id": "test_user"}}}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` // for metricsName starting with M_C_, response is object with count: { "count": "number" } // for metricsName not starting with M_C_, response is object with count: [ { ...data }, ...moreObjects ] // for requests with download object present, response will contain a job id: { "jobId": "2345612" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
POST/reports/role_assignment

Request role_assignment download job

Request role_assignment download job.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of events and pagination info

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "roleIds": ["234", "46576", "34565"],
  "download": {
     "notificationList": ["array", "of", "emails"]
  }
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
roleIdsarray<object>—
downloadobject—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/role_assignment
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/role_assignment' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "roleIds": ["34545", "232", "3545"], "download": {"notificationList": ["email1@1kosmos.com"]}}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 3 }, "data": [ { ...allFieldsFromElasticEvent }, { ...allFieldsFromElasticEvent }, { ...allFieldsFromElasticEvent } ] } ``` If you send "download" parameter, then only jobId will be returned: ``` { "jobId": "123-456-789-0000" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "jobId": "2343-5657-8787-4543"
}
POST/reports/userenrollment

Last login report

Get Last Login Report.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of events and pagination info

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "string",
  "communityId": "string",
  "pSize": "integer, default is 10",
  "pIndex": "integer, default is 0",
  "moduleId": "string",
  "query": {}
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
pSizenumber—
pIndexnumber—
queryobject—
POSThttps://pilot-root.1kosmos.net/adminapi/reports/userenrollment
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/reports/userenrollment' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "moduleId": "xxxxxxxxxx", "pSize": 10, "pIndex": 0, "query": {}}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "page": { "pSize": 10, "pIndex": 0, "total": 3 }, "data": [ { "username": "abc", "status": "active", "email": "abc@email.com", "lastLoginTime": "2023-06-12 14:03:59.450", }, { "username": "test", "status": "disabled", "email": "test@email.com", "lastLoginTime": "2023-06-12 14:03:59.450", }, ] } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
PUT/reports/event

Store Event

Store one event to Reports.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

Returns

Response gives status OK if everything is ok

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

Success

The publicKey of WebServer API used in decrypting

Request body contains *data* field with encrypted object below:

ALL fields below except tenantId and communityId are optional:

{
  "tenantId": "strin - required",
  "communityId": "string - required",
  "eventData": {
       "type": "string - required",
       "eventName": "E_LOGIN_VISITED",
       "event_id": "string - required",
       "caller_user_agent": "string - required",
       "version": "string - required",
       "event_ts": "number - optional",
       "redirect_from": "string - optional",
   },
  "serverEventData": {
       "caller_ip": "boolean - optional", // if true, will use IP detected by server and will overwrite caller_ip from eventData if provided
       "event_ts": "boolean - optional" // if true, will generate event_ts in miliseconds and will overwrite event_ts from eventData if provided
   }
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
eventDataobject—
serverEventDataobject—
PUThttps://pilot-root.1kosmos.net/adminapi/reports/event
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/reports/event' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxx", "communityId": "xxxxxxx", "eventData": {"type": "event", "eventName": "E_LOGIN_VISITED", "event_id": "xxxxxxxx", "browser_agent": "xxxxxxxx", "was_redirected": false, "version": "xxxxxxxx"}, "serverEventData": {"remote_address": true, "event_ts": true}}'
RESPONSE
200
400
401
500
Success
// no response body
PATCH/reports/download/jobs/{jobId}

Cancel download job

Cancel download job.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

204 No Content

Path parameters
NameTypeDescription
jobIdrequiredstringid of job to cancel
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PATCHhttps://pilot-root.1kosmos.net/adminapi/reports/download/jobs/{jobId}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/reports/download/jobs/xxxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
401
404
500
No Content
// no response body
Admin API

Service Providers

Service Providers endpoints.

GET/serviceprovider/idp-initiated

Fetch IDP-Initiated Apps

Fetch all SAML service providers that have IDP-initiated login enabled (saml_config.idpInitiated: true).

This endpoint is accessible to all authenticated users (no admin-only authorization check).

Used by the "My Apps" tab in the user profile to display apps available for IDP-initiated SSO.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encrypted array of IDP-initiated service providers

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/serviceprovider/idp-initiated
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/idp-initiated' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success Returns ECDSA encrypted array of IDP-initiated apps: ``` [ { "_id": "6070951e8dfc7f29228126c9", "name": "App Name", "logo": "string or null", "type": "saml", "idpInitiated": true } ] ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
GET/serviceprovider/{id}

Get Service Provider by ID

Get Service Provider by ID.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Parameters

id (required)

Id of MongoDB object

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encoded service provider object

Path parameters
NameTypeDescription
idrequiredstringId of service provider
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/serviceprovider/{id}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/xxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
403
404
Success publicKey is publicKey of Adminapi API, useful for decryption response data is ECDSA encrypted object represents service provider: ``` { "_id": "6070951e8dfc7f29228126c9", "name": "Service provider's name", "environment": "Environment name", "logo": "string" // only if type = oidc "type": "saml/oidc", "saml_config": {{ // only if type = saml "_id": "6070951e8dfc7f29228126ca", "accessUrl": "http://google.com", "entityId": "http://google.com", "assertionMethod": "post", "assertionConsumerServiceURL": "http://google.com", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "signingCert optional", "signingAlgo": "http://www.w3.org/2000/09/xmldsig#rsa-sha256", "encryptAssertion": true, "encryptionCert": "encryptionCert optional", "encryptionAlgorithm": "http://www.w3.org/2001/04/xmlenc#aes128-gcm", "keyTransportAlgorithm": "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", "idpInitiated": false, "relayState": "", "nameid": { "_id": "6070951e8dfc7f29228126cb", "format": "emailAddress", "value": "one of session_scope", "attribute_type": "session/ledger/identity" }, "attributes": [ { "_id": "6070951e8dfc7f29228126cc", "uuid": "string", "claim_name": "string", "attribute_name": "string", "attribute_type": "session", "value_type": "static", "value": "value" } ], "metadata": "<note>\\n<to>T</to>\\n<from>F</from>\\n<heading>R</heading>\\n<body>DF</body>\\n</note>" }, "oidc_config": { ...oidc_config } //object only if type = oidc "communityId": "community", "logo": "logo", "__v": 0 } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/serviceprovider/fetch

Fetch Service Providers

Fetch service providers.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encrypted array of service providers

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/serviceprovider/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/serviceprovider/publicinfo/fetch

Get Service Provider public info by SAML request or OIDC request

Get Service Provider public info by SAML request or OIDC request.

This endpoint is open.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (optional)

JWT

Returns

Returns ECDSA encoded service provider object

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    "tenantId": "string required",
    "communityId": "string required",
    // For searching by SAML request, put this field only:
    "SAMLRequest": "SAMLRequest"
    // For searching by OIDC request, put this field only:
    "OIDCRequest": "OIDCRequest"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well,it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
SAMLRequeststring—
OIDCRequeststring—
POSThttps://pilot-root.1kosmos.net/adminapi/serviceprovider/publicinfo/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/publicinfo/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "SAMLRequest": "string", "OIDCRequest": "string"}'
RESPONSE
200
400
401
403
404
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents service provider: ``` { "_id": "Service provider id", "name": "Service provider's name", "logo": "logo", "attributes": [ // ONLY FOR SAML { "_id": "6070951e8dfc7f29228126cc", "uuid": "string", "claim_name": "string", "attribute_name": "string", "attribute_type": "session", "value_type": "static", "value": "value" } ], "entityId": "xxxxx (only for SAML)", "scope": [ // ONLY FOR OIDC "profile", "email", "openid" ], "requestedAuthnContext": { "class": "IAL1" } } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/serviceprovider

Create Service Provider

Create Service Provider.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing service provider config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    name: "string required",
    environment: "string optional (default: empty string)",
    logo: "string optional - allowed for type = oidc or saml, can be empty string"
    type: "string required",
    saml_config: "object - required only if type = saml":
    {
        idpInitiated: "boolean optional (default: false) - enables IDP-initiated SSO for this SP",
        accessUrl: "string required",
        entityId: "string required",
        assertionMethod: "string required",
        assertionConsumerServiceURL: "string required",
        logoutRequestSignRequired: "boolean required",
        logoutResponseSignRequired: "boolean required",
        authRequestSignRequired: "boolean required",
        assertionSignRequired: "boolean required",
        signingCert: "string optional",
        signingAlgo: "string optional (default: RSA_SHA256). Valid: RSA_SHA1, RSA_SHA256",
        encryptAssertion: "boolean optional",
        encryptionCert: "string optional",
        encryptionAlgorithm: "string optional",
        keyTransportAlgorithm: "string optional",
        nameid: "object required":
        {
            format: "string required",
            value: "string required",
            attribute_type: "string required - session, ledger or identity"
        },
        relayState: "string optional (default: empty string) - URL where user is redirected after IDP-initiated login",
        attributes: [
            {
                claim_name: "string required",
                attribute_name: "string required",
                attribute_type: "string required - session, ledger or identity",
                value_type: "string optional - static or null or default",
                value: "can be anything: object, string, bool, array, number, etc - optional if value_type === null"
            }
        ],
        metadata: "string optional" // XML string by 'escape('XML string')' javascript function
    },
    oidc_config: "object - required only if type = oidc":
    {
        grant_types: "array of strings required",
        redirect_uris: "array of URIs required",
        scope: "array of strings required",
        id_token_signed_response_alg: "string required"
    },
    forceReauthentication:"true/false"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
namestring—
environmentstring—
typestring—
saml_configobject—
forceReauthenticationboolean—
hideBannerbooleanHide the banner on the OIDC login page
hideMobileLinksbooleanHide mobile app download links on the OIDC login page
mobileAppLabelstringCustom mobile app name label (max 15 characters, OIDC only)
PUThttps://pilot-root.1kosmos.net/adminapi/serviceprovider
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/serviceprovider' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "string", "environment": "string", "type": "saml", "saml_config": {"accessUrl": "string", "entityId": "string", "assertionMethod": "string", "assertionConsumerServiceURL": "string", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "string", "signingAlgo": "string", "metadata": "string", "nameid": {"format": "unspecified", "value": "string", "attribute_type": "string"}, "attributes": [{"claim_name": "string", "attribute_name": "string", "attribute_type": "string", "value_type": "string", "value": "string"}]}, "forceReauthentication": true, "hideBanner": false, "hideMobileLinks": false, "mobileAppLabel": "MyApp"}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi API, useful for decryption response data is ECDSA encrypted object represents created service provider: ``` { "_id": "6070951e8dfc7f29228126c9", "name": "Service provider's name", "environment": "Environment name", "logo": "string - only if type = oidc" "type": "saml", "saml_config": { "_id": "6070951e8dfc7f29228126ca", "accessUrl": "http://google.com", "entityId": "http://google.com", "assertionMethod": "post", "assertionConsumerServiceURL": "http://google.com", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "signingCert optional", "signingAlgo": "http://www.w3.org/2000/09/xmldsig#rsa-sha256" "encryptAssertion": true, "encryptionCert": "encryptionCert optional", "encryptionAlgorithm": "http://www.w3.org/2001/04/xmlenc#aes128-gcm", "keyTransportAlgorithm": "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", "idpInitiated": false, "relayState": "", "nameid": { "_id": "6070951e8dfc7f29228126cb", "format": "emailAddress", "value": "one of session_scope", "attribute_type": "session/ledger/identity" }, "attributes": [ { "_id": "6070951e8dfc7f29228126cc" "uuid": "string", "claim_name": "string", "attribute_name": "string", "attribute_type": "session", "value_type": "static", "value": "value" } ], "metadata": "<note>\\n<to>T</to>\\n<from>F</from>\\n<heading>R<heading>\\n<body>DF</body>\\n</note>" }, "oidc_config": "object - only if type = oidc": "communityId": "community", "logo": "logo", "__v": 0 } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/serviceprovider/{type}

Create Service Provider for featured applications

Create Service Provider for featured applications.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Parameters

type (required)

Supported types: auth0, okta, salesforce, forgerock, gsuite, zendesk

Returns

Returns object with public key and encrypted data containing service provider config

Path parameters
NameTypeDescription
typerequiredstringSupported types - auth0, okta, salesforce, forgerock, gsuite, zendesk
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with one of encrypted objects below:

For Auth0:
{
    "name": "string",
    "domain": "string",
    "ssoUrl": "string",
    "clientId": "onlyForAuthO",
    "clientSecret": "onlyForAuth0"
}

For Okta:
{
    "name": "string",
    "domain": "string",
    "ssoUrl": "string",
    "apiToken": "onlyForOkta"
}

For Forgerock:
{
    "name": "string",
    "domain": "string",
    "ssoUrl": "string",
    "username": "onlyForForgerockSalesforce",
    "password": "olnyForForgerockSalesforce",
    "useExistingCOT": "boolean - true/false - onlyForForgerock",
    "COT": "onlyForForgerock - optional if useExistingCOT === false",
    "hostedSP": "onlyForForgerock - optional if useExistingCOT === true"
}

For Salesforce:
{
    "name": "string",
    "domain": "string",
    "ssoUrl": "string",
    "username": "onlyForForgerockSalesforce",
    "password": "olnyForForgerockSalesforce",
    "securityToken": "onlyForSalesforce"
}

For GSuite:
{
    "name": "string",
    "domain": "string",
    "ssoUrl": "string",
    "sloUrl": "string",
    "serviceAccountEmail": "onlyForGSuite",
    "adminEmail": "onlyForGSuite",
    "serviceAccountPrivateKey": "onlyForGSuite"
}

For Zendesk:
{
    "name": "string",
    "domain": "string",
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
namestring—
domainstring—
ssoUrlstring—
sloUrlstring—
clientIdstring—
clientSecretstring—
apiTokenstring—
usernamestring—
passwordstring—
useExistingCOTstring—
COTstring—
hostedSPstring—
securityTokenstring—
serviceAccountEmailstring—
adminEmailstring—
serviceAccountPrivateKeystring—
PUThttps://pilot-root.1kosmos.net/adminapi/serviceprovider/{type}
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/<type>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "string", "domain": "string", "ssoUrl": "string", "sloUrl": "string", "clientId": "onlyForAuthO", "clientSecret": "onlyForAuth0", "apiToken": "onlyForOkta", "username": "onlyForForgerockSalesforce", "password": "olnyForForgerockSalesforce", "useExistingCOT": "boolean - true/false - onlyForForgerock", "COT": "onlyForForgerock", "hostedSP": "onlyForForgerock", "securityToken": "onlyForSalesforce", "serviceAccountEmail": "onlyForGSuite", "adminEmail": "onlyFormGSuite", "serviceAccountPrivateKey": "onlyForGSuite"}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi API, useful for decryption response data is ECDSA encrypted object represents created service provider: ``` { "_id": "6070951e8dfc7f29228126c9", "name": "Service provider's name", "environment": "Environment name", "logo": "string - only if type = oidc" "type": "saml", "saml_config": { "_id": "6070951e8dfc7f29228126ca", "accessUrl": "http://google.com", "entityId": "http://google.com", "assertionMethod": "post", "assertionConsumerServiceURL": "http://google.com", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "signingCert optional", "signingAlgo": "http://www.w3.org/2000/09/xmldsig#rsa-sha256", "encryptAssertion": false, "encryptionCert": "encryptionCert optional", "encryptionAlgorithm": "http://www.w3.org/2001/04/xmlenc#aes128-gcm", "keyTransportAlgorithm": "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", "nameid": { "_id": "6070951e8dfc7f29228126cb", "format": "emailAddress", "value": "one of session_scope", "attribute_type": "session/ledger/identity" }, "attributes": [ { "_id": "6070951e8dfc7f29228126cc" "uuid": "string", "claim_name": "string", "attribute_name": "string", "attribute_type": "session", "value_type": "static", "value": "value" } ], "metadata": "<note>\\n<to>T</to>\\n<from>F</from>\\n<heading>R<heading>\\n<body>DF</body>\\n</note>" }, "communityId": "community", "logo": "logo", "__v": 0 } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PATCH/serviceprovider/{id}

Update Service Provider

Update Service Provider.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing service provider config

Path parameters
NameTypeDescription
idrequiredstring—
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    name: "string required",
    environment: "string optional (default: empty string)",
    logo: "string optional - allowed for type = oidc or saml, can be empty string",
    type: "string required",
    saml_config: "object not required - required only if type = saml":
    {
        idpInitiated: "boolean optional (default: false) - enables IDP-initiated SSO for this SP",
        accessUrl: "string required",
        entityId: "string required",
        assertionMethod: "string required",
        assertionConsumerServiceURL: "string required",
        logoutRequestSignRequired: "boolean required",
        logoutResponseSignRequired: "boolean required",
        authRequestSignRequired: "boolean required",
        assertionSignRequired: "boolean required",
        signingCert: "string optional",
        signingAlgo: "string optional (default: RSA_SHA256). Valid: RSA_SHA1, RSA_SHA256",
        encryptAssertion: "boolean optional",
        encryptionCert: "string optional",
        encryptionAlgorithm: "string optional",
        keyTransportAlgorithm: "string optional",
        nameid: "object required":
        {
            format: "string required",
            value: "string required",
            attribute_type: "string required - session, ledger or identity"
        },
        relayState: "string optional (default: empty string) - URL where user is redirected after IDP-initiated login",
        attributes: [
            {
                _id: "string",
                uuid: "string",
                claim_name: "string required",
                attribute_name: "string required",
                attribute_type: "string required - session, ledger or identity",
                value_type: "string optional - static or null or default",
                value: "can be anything: object, string, bool, array, number, etc - optional if value_type === null"
            }
        ],
        metadata: "string optional"
    }
    oidc_config: "object - required only if type = oidc":
    {
        grant_types: "array of strings required",
        redirect_uris: "array of URIs required",
        scope: "array of strings required",
        id_token_signed_response_alg: "string required (HS256 or RS256)"
    }
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well,it is only a preview available in Swagger

FieldTypeDescription
namestring—
environmentstring—
typestring—
saml_configobject—
forceReauthenticationboolean—
hideBannerbooleanHide the banner on the OIDC login page
hideMobileLinksbooleanHide mobile app download links on the OIDC login page
mobileAppLabelstringCustom mobile app name label (max 15 characters, OIDC only)
PATCHhttps://pilot-root.1kosmos.net/adminapi/serviceprovider/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/<id>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "string", "environment": "string", "type": "saml", "saml_config": {"accessUrl": "string", "entityId": "string", "assertionMethod": "string", "assertionConsumerServiceURL": "string", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "string", "signingAlgo": "string", "metadata": "string", "nameid": {"format": "unspecified", "value": "string", "attribute_type": "string"}, "attributes": [{"claim_name": "string", "attribute_name": "string", "attribute_type": "string", "value_type": "string", "value": "string"}]}, "forceReauthentication": true, "hideBanner": false, "hideMobileLinks": false, "mobileAppLabel": "MyApp"}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi API, useful for decryption response data is ECDSA encrypted object represents created service provider: ``` { "_id": "6070951e8dfc7f29228126c9", "name": "Service provider's name", "environment": "Environment name", "type": "saml", "saml_config": { "_id": "6070951e8dfc7f29228126ca", "accessUrl": "http://google.com", "entityId": "http://google.com", "assertionMethod": "post", "assertionConsumerServiceURL": "http://google.com", "logoutRequestSignRequired": true, "logoutResponseSignRequired": true, "authRequestSignRequired": true, "assertionSignRequired": true, "signingCert": "signingCert optional", "signingAlgo": "http://www.w3.org/2000/09/xmldsig#rsa-sha256", "encryptAssertion": true, "encryptionCert": "encryptionCert optional", "encryptionAlgorithm": "http://www.w3.org/2001/04/xmlenc#aes128-gcm", "keyTransportAlgorithm": "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p", "idpInitiated": false, "relayState": "", "nameid": { "_id": "6070951e8dfc7f29228126cb", "format": "emailAddress", "value": "one of session_scope", "attribute_type": "session/ledger/identity" }, "attributes": [ { "_id": "6070951e8dfc7f29228126cc", "uuid": "string", "claim_name": "string", "attribute_name": "string", "attribute_type": "session", "value_type": "static", "value": "value" } ], "metadata": "<note>\\n<to>T</to>\\n<from>F</from>\\n<heading>R<heading>\\n<body>DF</body>\\n</note>" }, "oidc_config": { ...oidc_config } //object only if type = oidc "communityId": "community", "logo": "logo", "__v": 0 } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
DELETE/serviceprovider/{id}

Delete Service Provider

Delete Service Providers.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Doesn't return anything

Path parameters
NameTypeDescription
idrequiredstringObjectId of existing service provider
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/serviceprovider/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/serviceprovider/xxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
400
401
403
Success Service provider has beed deleted successfully
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Identity Enroll

Identity Enroll endpoints.

POST/identity_enroll/affidavit

Enroll affidavit document

Enroll DL.

This endpoint can be accessed by any logged user with loaded wallet.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encoded document object

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "doc":{
      "document_type": "required, one of [dl_affidavit, ppt_affidavit, ssn_affidavit]",
      "expiry": "required, date string in format YYYYMMDD",
      "document_number": "required, alphanumeric string",
      "username":"required, username we are adding affidavit for"}
      "moduleId": "required, moduleId of user"
     },

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
docobject—
POSThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/affidavit
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/affidavit' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"doc": {"document_type": "string", "expiry": "string", "document_number": "string", "username": "string", "moduleId": "string"}}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents enrolled dl object: ``` { "doc": {}, // full document object "ial": "ial" // new ial level after dl enrollment } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/identity_enroll/dl_validate

Validate dl with AAMVA connector

Validate dl with AAMVA connector.

This endpoint can be accessed by any logged user with loaded wallet.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encoded AAMVA response with verification status

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "dl": {} // full dl_object
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
dlobject—
POSThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/dl_validate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/dl_validate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"dl": {}}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents verified status and aamva response: ``` { "verified": "boolean", "aamva_response": { "docId": "DLDVSTRUCTUREDTEST12", "docType": "dl", "certifications": [ { "docType": "dl", "docId": "DLDVSTRUCTUREDTEST12", "type": "aamva", "authority": "aamva", "ts": 1651752506, "verified": true, "result": { "dl_number_matched": "boolean", "dob_match": "boolean", "last_name_exact_match": "boolean", "last_name_fuzzy_match": "boolean", "first_name_exact_match": "boolean", "first_name_fuzzy_match": "boolean", "middle_name_exact_match": "boolean", "middle_name_fuzzy_match": "boolean", "person_suffix_match": "boolean", "doc_category_match": "boolean", "doi_match": "boolean", "doe_match": "boolean", "person_sex_match": "boolean", "person_height_match": "boolean", "person_eye_color_match": "boolean", "city_match": "boolean", "state_match": "boolean", "zip_match": "boolean" }, "metadata": { "s:Envelope": { "xmlns:a": "http://www.w3.org/2005/08/addressing", "xmlns:s": "http://www.w3.org/2003/05/soap-envelope", "s:Body": { "xmlns:xsd": "http://www.w3.org/2001/XMLSchema", "xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance", "VerifyDriverLicenseDataResponse": { "xmlns": "http://aamva.org/dldv/wsdl/2.1", "VerifyDriverLicenseDataResult": { "PersonNameSuffixMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "ControlData": { "xmlns": "http://aamva.org/niem/extensions/1.0", "MessageAddress": { "MessageOriginatorId": "P6", "TransactionLocatorId": 347547659039083300, "MessageDestinationId": "KOS" } }, "DriverLicenseExpirationDateMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonFirstNameExactMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "AddressCityMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonHeightMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonLastNameExactMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "DriverLicenseNumberMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonFirstNameFuzzyAlternateMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "DocumentCategoryMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "AddressStateCodeMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "AddressLine1MatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "AddressZIP5MatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "DriverLicenseIssueDateMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonSexCodeMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonLastNameFuzzyPrimaryMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonLastNameFuzzyAlternateMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonBirthDateMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonEyeColorMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" }, "PersonFirstNameFuzzyPrimaryMatchIndicator": { "xmlns": "http://aamva.org/niem/extensions/1.0", "content": "boolean" } } } }, "s:Header": { "a:Action": { "s:mustUnderstand": 1, "content": "http://aamva.org/dldv/wsdl/2.1/IDLDVService21/VerifyDriverLicenseDataResponse" }, "a:MessageID": "uuid:2205051208270001 1UNISG" } } }, "token": "token", "fault": null, "reason": null, "error": null } ] }, "proofs": ["proof1", "proof2", "etc"], "invalidState": "boolean/undefined" } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/identity_enroll/id_doc_enroll

Enroll identity document

Enroll DL.

This endpoint can be accessed by any logged user with loaded wallet.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encoded document object

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "doc": "full document object",
  "selfie": "full selfie/liveid object",
  "proofs": "array of strings (optional)"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
docstring—
selfiestring—
proofsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/id_doc_enroll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/id_doc_enroll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"doc": {"id": "id", "firstName": "firstName", "lastName": "lastName", "type": "dl", "face": "face", "dob": "yyyyMMdd", "doe": "yyyyMMdd"}, "selfie": {"face": "face"}, "proofs": ["proof1", "proof2", "etc"]}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents enrolled dl object: ``` { "doc": {}, // full document object "ial": "ial" // new ial level after dl enrollment } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/identity_enroll/session/{sessionId}/poll

Enroll Driver License and LiveId from docuverify-authenticID session

Enroll Driver License and LiveId from docuverify-authenticID session.

This endpoint can be accessed by any logged user with loaded wallet.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Path Parameters

sessionId (required)

SessionId from authenticID

Returns

Returns ECDSA encoded liveid_object and dl_object

Path parameters
NameTypeDescription
sessionIdrequiredstringauthenticID sessionId
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/session/{sessionId}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/session/<sessionId>/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents liveid object and dl object: ``` { "dl": { // full dl object }, "liveid": { // full liveid object }, "ial": "ial" // new ial level after liveid enrollment } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/identity_enroll/ssn_enroll

Enroll SSN

Enroll SSN.

This endpoint can be accessed by any logged user with loaded wallet.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns ECDSA encoded ssn_object

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
ssnobject—
POSThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/ssn_enroll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/ssn_enroll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"ssn": "string"}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi, useful for decryption response data is ECDSA encrypted object represents enrolled ssn object: ``` { "ssn_object": { "id": "id", "type": "ssn", "documentId": "id", "documentType": "SSN", "image": "dummy b64", "category": "identity_document", "ssn": "ssn_number", "proofedBy": "blockid", "firstName": "firstName", "middleName": "middleName", "lastName": "lastName", "dob": "yyyyMMdd", "doe": "yyyyMMdd", "face": "faceB64", "address": "", "street": "", "city": "", "state": "", "zipCode": "", "country": "", "phoneNumber": "phoneNumber", "email": "email", "doi": "yyyyMMdd", "verifiedScan": true, "certificate_token": "certificate_token" }, "ial": "ial" // new ial level after ssn enrollment } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/identity_enroll/session/create

Create new session for identity enrollment

Create new session for identity enrollment.

This endpoint must be accessed by logged in user with wallet

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response gives necessary session info for retrieving session response

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "smsTo": "required string",
  "smsISDCode": "required string",
  "documentType": "dl_object"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
smsTonumber—
smsISDCodenumber—
documentTypestring—
PUThttps://pilot-root.1kosmos.net/adminapi/identity_enroll/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"smsTo": 0, "smsISDCode": 0, "documentType": "dl_object"}'
RESPONSE
201
400
401
500
Success
{
  "sessionId": "xxxxxxxx",
  "sessionUrl": "xxxxxxxx"
}
DELETE/identity_enroll/remove_doc

Un enroll document from identity wallet

Remove enrolled document from wallet.

This endpoint must be accessed by logged in user with wallet

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response gives necessary session info for retrieving session response

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "docId": "required string",
  "docType": "required string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
docIdstring—
docTypestring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/identity_enroll/remove_doc
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/identity_enroll/remove_doc' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"docId": "xxxxxxxxxxxxxxxxxxxx", "docType": "ppt | dl | ssn | xxx"}'
RESPONSE
204
400
401
500
No Content
// no response body
Admin API

Web Authn

Web Authn endpoints.

POST/webauthn/assertion/options

Get Assertion Options

Get Assertion Options for login with security keys.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now

publickey (required)

Public key

Request Body

username (required)

username : string

communityId (required)

communityId : string

tenantId (required)

tenantId : string

Returns

Returns the assertion options for login with security keys.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
usernamestring—
communityIdstring—
tenantIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/webauthn/assertion/options
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/webauthn/assertion/options' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"username": "xxxxxx", "communityId": "xxxxxx", "tenantId": "xxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "challenge": "xxxxxx",
  "rpId": "xxxxxx",
  "timeout": "xxxxxx",
  "UserVerification": "xxxxxx",
  "allowCredentials": [
    {
      "type": "public-key",
      "id": "xxxxxxxx"
    }
  ],
  "status": "xxxx",
  "errorMessage": ""
}
POST/webauthn/attestation/options

Get Attestation Options

Get Attestation Options.

This endpoint must be accessed by a logged in user.

Username provided must match username stored in JWT.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object containing properties for registering security key

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

For Fido Key:

{
  "attestation": "direct",
  "authenticatorSelection": {
     "requireResidentKey": true
  }
}

For Platform:

{
  "attestation": "direct",
  "authenticatorSelection": {
     "authenticatorAttachment": "platform"
  }
}

For Macbook:

{
  "attestation": "none"
}
FieldTypeDescription
attestationstring—
authenticatorSelectionobject—
POSThttps://pilot-root.1kosmos.net/adminapi/webauthn/attestation/options
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/webauthn/attestation/options' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"attestation": "attestation", "authenticatorSelection": {"requireResidentKey": true, "authenticatorAttachment": "authenticatorAttachment"}}'
RESPONSE
200
400
401
500
Success publicKey is publicKey of User Management API, useful for decryption response data is ECDSA encrypted object represents created auth module: ``` { "rp": "object", "user": "object", "attestation": "direct", "pubKeyCredParams": "array object", "timeout": 60000, "authenticatorSelection": { "requireResidentKey": true } "challenge": "string", "excludeCredentials": "array object" "status": "ok", "errorMessage": "" } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/webauthn/authenticate_with_security_key

authenticate with security keys

authenticate with security keys.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now

publickey (required)

Public key

Returns

Returns the authentication information.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

For Fido Key:

{
 "username":"string required",
 "tenant":{
    "id":"string required",
    "name":"string required",
    "tag":"string required",
    "type":"string required"
 },
 "community":{
    "id":"string required",
    "name":"string required",
    "publicKey":"string required"
 },
 "rawId": "string required",
 "authenticatorData": "string required",
 "signature":"string required",
 "userHandle": "string | null optional (can be empty or null)",
 "clientDataJSON": "string required",  // base64 string
 "getClientExtensionResults":{},
 "id":"string required",
 "type":"public-key"
}
FieldTypeDescription
tenantobject—
communityobject—
usernamestring—
rawIdstring—
authenticatorDatanumber—
signaturestring—
userHandlestring—
clientDataJSONnumber—
getClientExtensionResultsobject—
idstring—
typestring—
POSThttps://pilot-root.1kosmos.net/adminapi/webauthn/authenticate_with_security_key
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/webauthn/authenticate_with_security_key' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenant": {"id": "xxxxxx", "name": "xxxxxx", "tag": "xxxxxx", "type": "xxxxxx"}, "community": {"id": "xxxxxx", "name": "xxxxxx", "publicKey": "xxxxxx"}, "username": "xxxxxx", "rawId": "xxxxxx", "authenticatorData": "xxxxxx", "signature": "xxxxxx", "userHandle": "xxxx", "clientDataJSON": "xxxxxx", "getClientExtensionResults": {}, "id": "xxxx", "type": "public-key"}'
RESPONSE
200
400
401
500
Success
{
  "user": "object",
  "pon_data": "object",
  "jwt_token": "string"
}
POST/webauthn/security_key

Register security key or platform authenticator

Register security key or platform authenticator

This endpoint must be accessed by a logged in user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns message if device has been linked successfully

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

Request body should accept data from navigator.credentials.create() and tenantId and communityId

FieldTypeDescription
navigator_credentials_create_datastring—
deviceNamestring—
keyTypestring—
POSThttps://pilot-root.1kosmos.net/adminapi/webauthn/security_key
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/webauthn/security_key' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"navigator_credentials_create_data": "Don't send string. Send properties using spread operator like '...data'", "deviceName": "xxxxxxxx", "keyType": "xxxxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "device": {
    "name": "Somebody's FIDO key",
    "type": "FIDO"
  },
  "deviceId": "xxxxxxxxx",
  "type": "xxxxxx"
}
POST/webauthn/vendormetadata/{communityId}/fetch

fetch the security keys

fetch the security keys.

Path parameters
NameTypeDescription
communityIdrequiredstringCommunity Id
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
 "aaguids": [
      "string"
    ]
}
FieldTypeDescription
aaguidarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/{communityId}/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/Do not enter anything, use 'Authorize' fields/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"aaguid": ["string"]}'
RESPONSE
200
400
401
500
Success
[
  {
    "aaguid": "xxxxxx",
    "metadata": "xxxxxx",
    "name": "xxxxxx",
    "disabled": false,
    "updatedBy": "xxxx"
  }
]
PUT/webauthn/vendormetadata/{communityId}

add the security keys

add the security keys.

Path parameters
NameTypeDescription
communityIdrequiredstringCommunity Id
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
 "aaguid": "string required",
 "metadata": "string required",
 "name":"string required",
 "disabled": "boolean required",
 "updatedBy": "string required"
}
FieldTypeDescription
aaguidstring—
metadatastring—
namestring—
disabledboolean—
updatedBystring—
PUThttps://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/{communityId}
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/Do not enter anything, use 'Authorize' fields' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"aaguid": "xxxxxx", "metadata": "xxxxxx", "name": "xxxxxx", "disabled": false, "updatedBy": "xxxx"}'
RESPONSE
200
400
401
500
Success
{
  "aaguid": "xxxxxx",
  "id": "xxxxxx"
}
PATCH/webauthn/vendormetadata/{communityId}/aaguid/{aaguid}

update the security keys

add the security keys.

Path parameters
NameTypeDescription
communityIdrequiredstringCommunity Id
aaguidrequiredstringaagu Id
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
 "metadata": "string required",
 "name":"string required",
 "disabled": "boolean required",
 "updatedBy": "string required"
}
FieldTypeDescription
metadatastring—
namestring—
disabledboolean—
updatedBystring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/{communityId}/aaguid/{aaguid}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/webauthn/vendormetadata/Do not enter anything, use 'Authorize' fields/aaguid/Do not enter anything, use 'Authorize' fields' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"metadata": "xxxxxx", "name": "xxxxxx", "disabled": false, "updatedBy": "xxxx"}'
RESPONSE
200
400
401
500
Success
{
  "status": "ok"
}
Admin API

Auth Modules

Auth Modules endpoints.

GET/auth_modules/{moduleId}

Get auth module by moduleId.

Get auth module by moduleId.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Parameters

No Parameters

Returns

Returns the auth module, encrypted with ECDSA and public key.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
moduleIdrequiredstring—
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/auth_modules/{moduleId}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/auth_modules/xxxxxxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
Success data is ECDSA encrypted object represents auth module: ``` { "_id": "ObjectID", "communityId": "ObjectID", "type": "db", "subtype": "datastore", "method": "authn", "name": "Auth Module Name", "enabled": true, "mode": "broker/direct", "config": {}, // see below config response samples "kerberos_config": { // optional "enabled": "boolean optional", "keytab_file": "string optional" } } ``` config object for type **ad** or **ldap**: ``` { "serverprotocol": "ldap", "server": "string", "serverport": "string", "binddn": "string", "bindpassword": "string", "basedn": "string", "securityauthentication": "Simple", "filter": "string", "serviceacctreadonly": true, "scepenabled": "boolean optional (only broker)", "scepurl": "string optional (only broker)", "challengeurl": "string optional (only broker)", "scepagent": "string optional (only broker)", "cert_enabled": "boolean optional", "cert_template": "string optional", // Alphabets, numerals, spaces, special characters allowed "dc_dns": "string optional", // DNS names can contain only alphabetic characters (A-Z, a-z), numeric characters (0-9), the minus sign (-), and the period (.) "dc_ca": "string optional", // up to 64 characters, ANSI character set "logfilesizemb": "number (only broker)", "logfilecount": "number (only broker)", "ldapqueryfilter": "string optional", "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } }, "caList": [{ "cert_template": "string required", "dc_dns": "string required", "dc_ca": "string required", "lastSuccessAt": "date optional", "lastNotifiedAt": "date optional" }], "caTimeoutSeconds": "number optional - default = 10s", "caRetryAfterMinutes": "number optional - default = 30m", "caStatusChangeNotificationsTo": "array optional", "caStatusChangeNotificationsEnabled": "boolean optional", } ``` config object for type **azuread**: ``` { "appName": "string", "tenantId": "string", "tenantName": "string", "clientId": "string", "clientSecret": "string", "loginBasePath": "string", "graphApiBasePath": "string", "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ``` config object for type **db**: ``` { "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ```
{
  "data": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="
}
POST/auth_modules/fetch

Fetch Auth Modules.

Fetch Auth Modules.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the auth modules.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/auth_modules/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/auth_modules/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "modules": [
    {
      "_id": "string",
      "communityId": "string",
      "type": "string",
      "subtype": "string",
      "method": "string",
      "name": "string",
      "enabled": true,
      "mode": "broker",
      "config": {
        "passwordPolicy": {
          "allowed": "boolean required",
          "authtype": "Fingerprint|Face",
          "description": "string required",
          "rules": {
            "min": "number required",
            "min_enabled": "boolean required",
            "min_special": "number required",
            "min_special_enabled": "boolean required",
            "min_numbers": "number required",
            "min_numbers_enabled": "boolean required",
            "special_chars_allowed": "string required",
            "special_chars_allowed_enabled": "boolean required",
            "min_alpha_caps": "number required",
            "min_alpha_caps_enabled": "boolean required",
            "noUsername": "boolean required",
            "noUsername_enabled": "boolean required",
            "noSpaces": "boolean required",
            "noSpaces_enabled": "boolean required",
            "allowInRow": "number required",
            "allowInRow_enabled": "boolean required"
          }
        }
      }
    },
    {
      "_id": "string",
      "communityId": "string",
      "type": "string",
      "subtype": "string",
      "method": "string",
      "name": "string",
      "enabled": true,
      "mode": "direct",
      "config": {
        "passwordPolicy": {
          "allowed": "boolean required",
          "authtype": "Fingerprint|Face",
          "description": "string required",
          "rules": {
            "min": "number required",
            "min_enabled": "boolean required",
            "min_special": "number required",
            "min_special_enabled": "boolean required",
            "min_numbers": "number required",
            "min_numbers_enabled": "boolean required",
            "special_chars_allowed": "string required",
            "special_chars_allowed_enabled": "boolean required",
            "min_alpha_caps": "number required",
            "min_alpha_caps_enabled": "boolean required",
            "noUsername": "boolean required",
            "noUsername_enabled": "boolean required",
            "noSpaces": "boolean required",
            "noSpaces_enabled": "boolean required",
            "allowInRow": "number required",
            "allowInRow_enabled": "boolean required"
          }
        }
      },
      "kerberos_config": {
        "enabled": "boolean optional",
        "keytab_file": "string optional"
      }
    },
    {
      "_id": "string",
      "communityId": "string",
      "type": "string",
      "subtype": "string",
      "method": "string",
      "name": "string",
      "enabled": true,
      "mode": "direct",
      "config": {
        "cert_enabled": "boolean",
        "cert_template": "string",
        "dc_dns": "string",
        "dc_ca": "string",
        "logfilesizemb": "number",
        "logfilecount": "number",
        "ldapqueryfilter": "someLdapQueryFilter",
        "passwordPolicy": {
          "allowed": "boolean required",
          "authtype": "Fingerprint|Face",
          "description": "string required",
          "rules": {
            "min": "number required",
            "min_enabled": "boolean required",
            "min_special": "number required",
            "min_special_enabled": "boolean required",
            "min_numbers": "number required",
            "min_numbers_enabled": "boolean required",
            "special_chars_allowed": "string required",
            "special_chars_allowed_enabled": "boolean required",
            "min_alpha_caps": "number required",
            "min_alpha_caps_enabled": "boolean required",
            "noUsername": "boolean required",
            "noUsername_enabled": "boolean required",
            "noSpaces": "boolean required",
            "noSpaces_enabled": "boolean required",
            "allowInRow": "number required",
            "allowInRow_enabled": "boolean required"
          }
        }
      }
    }
  ]
}
PUT/auth_modules/create

Create Auth Modules.

Create Auth Modules.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

data (required)

Auth module data encrypted with ECDSA.

Returns

Returns the created auth module.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger.

for type db:

{
    "type": "db",
    "subtype": "datastore",
    "method": "authn",
    "name": "string required",
    "enabled": true,
    "mode": "direct",
    "config": {
         "passwordPolicy": { // object optional
             "authtype": "Fingerprint|Face",
             "description": "string required",
             "rules": {
                 "min": "number required",
                 "min_enabled": "boolean required",
                 "min_special": "number required",
                 "min_special_enabled": "boolean required",
                 "min_numbers": "number required",
                 "min_numbers_enabled": "boolean required",
                 "special_chars_allowed": "string required",
                 "special_chars_allowed_enabled": "boolean required",
                 "min_alpha_caps": "number required",
                 "min_alpha_caps_enabled": "boolean required",
                 "noUsername": "boolean required",
                 "noUsername_enabled": "boolean required",
                 "noSpaces": "boolean required",
                 "noSpaces_enabled": "boolean required",
                 "allowInRow": "number required",
                 "allowInRow_enabled": "boolean required"
             }
         }
    }
}

for type ad:

{
    "type": "ad",
    "subtype": "directory",
    "method": "authn",
    "name": "string required",
    "enabled": true,
    "mode": "direct/broker",
    "config": {
        "serverprotocol": "string required/optional - ldap or ldaps",
        "server": "string required/optional",
        "serverport": "string required/optional",
        "binddn": "string required/optional",
        "bindpassword": "string optional/optional",
        "basedn": "string required/optional",
        "securityauthentication": "string required/optional - Simple or Secure or Sealing or Encryption or SecureSocketLayer or ServerBind",
        "filter": "string required/optional",
        "serviceacctreadonly": "boolean optional - default false",
        "scepenabled": "boolean optional (only broker)",
        "scepurl": "string optional (only broker)",
        "challengeurl": "string optional (only broker)",
        "scepagent": "string optional (only broker)",
        "ldapqueryfilter": "string optional",
        "cert_enabled": "boolean optional",
        "cert_template": "string optional", // Alphabets, numerals, spaces, special characters allowed
        "dc_dns": "string optional",  // DNS names can contain only alphabetic characters (A-Z, a-z), numeric characters (0-9), the minus sign (-), and the period (.)
        "dc_ca": "string optional", // up to 64 characters, ANSI character set
        "logfilesizemb": number optional, // it's only for BROKER, default is 10
        "logfilecount": number optional,  // it's only for BROKER, default is 10
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        },
        "caList": [{
            "cert_template": "string required",
            "dc_dns": "string required",
            "dc_ca": "string required",
            "lastSuccessAt": "date optional",
            "lastNotifiedAt": "date optional",
        }],
        "caTimeoutSeconds": "number optional - default = 10s",
        "caRetryAfterMinutes": "number optional - default = 30m",
        "caStatusChangeNotificationsTo": "array optional",
        "caStatusChangeNotificationsEnabled": "boolean optional",
    },
    "kerberos_config": { // optional
        "enabled": "boolean optional",
        "keytab_file": "string optional"
    },
    "enhanced_security_on": true/false
}

for direct azuread:

{
    "type": "azuread",
    "subtype": "directory",
    "method": "authn",
    "name": "string required",
    "enabled": true,
    "mode": "direct",
    "config": {
        "appName": "string required",
        "tenantId": "string required",
        "tenantName": "string required",
        "clientId": "string required",
        "clientSecret": "string required",
        "loginBasePath": "string required",
        "graphApiBasePath": "string required",
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        }
    }
}

for type ldap:

{
    "type": "ldap",
    "subtype": "directory",
    "method": "authn",
    "name": "string required",
    "enabled": true,
    "mode": "direct/broker",
    "config": {
        "serverprotocol": "string required/optional - ldap or ldaps",
        "server": "string required/optional",
        "serverport": "string required/optional",
        "binddn": "string required/optional",
        "bindpassword": "string optional/optional",
        "basedn": "string required/optional",
        "securityauthentication": "string required/optional - Simple or Secure or Sealing or Encryption or SecureSocketLayer or ServerBind",
        "filter": "string required/optional",
        "serviceacctreadonly": "boolean optional - default false",
        "scepenabled": "boolean optional (only broker)",
        "scepurl": "string optional (only broker)",
        "challengeurl": "string optional (only broker)",
        "scepagent": "string optional (only broker)",
        "ldapqueryfilter": "string optional",
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        },
        "caList": [{
            "cert_template": "string required",
            "dc_dns": "string required",
            "dc_ca": "string required",
            "lastSuccessAt": "date optional",
            "lastNotifiedAt": "date optional"
        }],
        "caTimeoutSeconds": "number optional - default = 10s",
        "caRetryAfterMinutes": "number optional - default = 30m",
        "caStatusChangeNotificationsTo": "array optional",
        "caStatusChangeNotificationsEnabled": "boolean optional",
    },
    "kerberos_config": { // optional
        "enabled": "boolean optional",
        "keytab_file": "string optional"
    }
}
FieldTypeDescription
datastring—
PUThttps://pilot-root.1kosmos.net/adminapi/auth_modules/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/auth_modules/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="}'
RESPONSE
200
400
401
Success publicKey is publicKey of User Management API, useful for decryption response data is ECDSA encrypted object represents created auth module: ``` { "_id": "ObjectID", "communityId": "ObjectID", "type": "db", // ad | ldap | db "subtype": "datastore", // for ad | ldap: "directory", for db: "datastore" "method": "authn", // for ad | ldap | db : "authn" "name": "Auth Module Name", "enabled": true, "mode": "broker/direct", "config": {}, // see below config response samples "kerberos_config": { // optional "enabled": "boolean optional", "keytab_file": "string optional" } } ``` config object for type **ad** or **ldap**: ``` { "serverprotocol": "ldap", "server": "string" "serverport": "string" "binddn": "string" "bindpassword": "string", "basedn": "string", "securityauthentication": "Simple", "filter": "string", "serviceacctreadonly": true, "scepenabled": "boolean optional", "scepurl": "string optional", "challengeurl": "string optional", "scepagent": "string optional", "ldapqueryfilter": "string optional", "cert_enabled": "boolean", "cert_template": "string", "dc_dns": "string", "dc_ca": "string", "logfilesizemb": "number", // it's only for AD BROKER "logfilecount": "number", // it's only for AD BROKER "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } }, "caList": [{ "cert_template": "string required", "dc_dns": "string required", "dc_ca": "string required", "lastSuccessAt": "date optional", "lastNotifiedAt": "date optional" }], "caTimeoutSeconds": "number optional - default = 10s", "caRetryAfterMinutes": "number optional - default = 30m", "caStatusChangeNotificationsTo": "array optional", "caStatusChangeNotificationsEnabled": "boolean optional", } ``` config object for type **azuread** : ``` { "appName": "string", "tenantId": "string", "tenantName": "string", "clientId": "string", "clientSecret": "string", "loginBasePath": "string", "graphApiBasePath": "string", "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ``` config for type **db**: ``` { "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ```
// no response body
PATCH/auth_modules/updateJs/{moduleId}

Update JS script Auth Modules.

Update JS script Auth Modules..

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

data (required)

Auth module data encrypted with ECDSA.

Returns

Returns the created auth module.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
moduleIdrequiredstring—
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger.

FieldTypeDescription
datastring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/auth_modules/updateJs/{moduleId}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/auth_modules/updateJs/xxxxxxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="}'
RESPONSE
200
400
401
Success publicKey is publicKey of User Management API, useful for decryption response data is ECDSA encrypted object represents created auth module:
// no response body
PATCH/auth_modules/{moduleId}

Update Auth Module.

Update Auth Modules.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

data (required)

Auth module data encrypted with ECDSA.

Returns

Returns updated auth module.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
moduleIdrequiredstringThe id of auth module to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger.

NOTE - for each type you can send "mode" parameter, but it will be skipped.

for type db:

{
    "name": "string optional",
    "enabled": "boolean optional",
    "type": "db - only for dynamic validation",
    "mode": "direct - only for dynamic validation"
    "config": {
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        }
    }
}

for type ad:

{
    "name": "string optional",
    "enabled": "boolean optional",
    "type": "ad - only for dynamic validation",
    "mode": "direct/broker - only for dynamic validation"
    "config": {
        "serverprotocol": "string required/optional - ldap or ldaps",
        "server": "string required/optional",
        "serverport": "string required"/optional,
        "binddn": "string required/optional",
        "bindpassword": "string required/optional",
        "basedn": "string required"/optional,
        "securityauthentication": "string required/optional - Simple or Secure or Sealing or Encryption or SecureSocketLayer or ServerBind",
        "filter": "string required/optional",
        "serviceacctreadonly": "boolean optional - default false",
        "scepenabled": "boolean optional (only broker)",
        "scepurl": "string optional (only broker)",
        "challengeurl": "string optional (only broker)",
        "scepagent": "string optional (only broker)",
        "logfilesizemb": number optional, // it's only for BROKER
        "logfilecount": number optional,  // it's only for BROKER
        "cert_enabled": "boolean optional",
        "cert_template": "string optional", // Alphabets, numerals, spaces, special characters allowed
        "dc_dns": "string optional",  // DNS names can contain only alphabetic characters (A-Z, a-z), numeric characters (0-9), the minus sign (-), and the period (.)
        "dc_ca": "string optional", // up to 64 characters, ANSI character set
        "ldapqueryfilter": "string optional",
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        },
        "caList": [{
            "cert_template": "string required",
            "dc_dns": "string required",
            "dc_ca": "string required",
            "lastSuccessAt": "date optional",
            "lastNotifiedAt": "date optional"
        }],
        "caTimeoutSeconds": "number optional - default = 10s",
        "caRetryAfterMinutes": "number optional - default = 30m",
        "caStatusChangeNotificationsTo": "array optional",
        "caStatusChangeNotificationsEnabled": "boolean optional",
    },
    "kerberos_config": { // optional
        "enabled": "boolean optional",
        "keytab_file": "string optional"
    },
    "enhanced_security_on": true/false
}

for type ldap:

{
    "name": "string optional",
    "enabled": "boolean optional",
    "type": "ldap - only for dynamic validation",
    "mode": "direct/broker - only for dynamic validation"
    "config": {
        "serverprotocol": "string required/optional - ldap or ldaps",
        "server": "string required/optional",
        "serverport": "string required/optional",
        "binddn": "string required/optional",
        "bindpassword": "string required/optional",
        "basedn": "string required/optional",
        "securityauthentication": "string required/optional - Simple or Secure or Sealing or Encryption or SecureSocketLayer or ServerBind",
        "filter": "string required/optional",
        "serviceacctreadonly": "boolean optional - default false",
        "scepenabled": "boolean optional (only broker)",
        "scepurl": "string optional (only broker)",
        "challengeurl": "string optional (only broker)",
        "scepagent": "string optional (only broker)",
        "ldapqueryfilter": "string optional",
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        },
        "caList": [{
            "cert_template": "string required",
            "dc_dns": "string required",
            "dc_ca": "string required",
            "lastSuccessAt": "date optional",
            "lastNotifiedAt": "date optional"
        }],
        "caTimeoutSeconds": "number optional - default = 10s",
        "caRetryAfterMinutes": "number optional - default = 30m",
        "caStatusChangeNotificationsTo": "array optional",
        "caStatusChangeNotificationsEnabled": "boolean optional",
    },
    "kerberos_config": { // optional
        "enabled": "boolean optional",
        "keytab_file": "string optional"
    }
}

for type azuread:

{
    "name": "string optional",
    "enabled": true,
    "config": {
        "appName": "string",
        "tenantId": "string",
        "tenantName": "string",
        "clientId": "string",
        "clientSecret": "string",
        "loginBasePath": "string",
        "graphApiBasePath": "string",
        "passwordPolicy": { // object optional
            "authtype": "Fingerprint|Face",
            "description": "string required",
            "rules": {
                "min": "number required",
                "min_enabled": "boolean required",
                "min_special": "number required",
                "min_special_enabled": "boolean required",
                "min_numbers": "number required",
                "min_numbers_enabled": "boolean required",
                "special_chars_allowed": "string required",
                "special_chars_allowed_enabled": "boolean required",
                "min_alpha_caps": "number required",
                "min_alpha_caps_enabled": "boolean required",
                "noUsername": "boolean required",
                "noUsername_enabled": "boolean required",
                "noSpaces": "boolean required",
                "noSpaces_enabled": "boolean required",
                "allowInRow": "number required",
                "allowInRow_enabled": "boolean required"
            }
        }
    }
}
FieldTypeDescription
namestring—
enabledboolean—
typestring—
modestring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/auth_modules/{moduleId}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/auth_modules/xxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "string", "enabled": true, "type": "string", "mode": "string"}'
RESPONSE
200
400
401
Success publicKey is publicKey of User Management API, useful for decryption response data is ECDSA encrypted object represents updated auth module: ``` { "_id": "ObjectID", "communityId": "ObjectID", "type": "db", // ad | ldap | db "subtype": "datastore", // for ad | ldap: "directory", for db: "datastore" "method": "authn", // for ad | ldap | db : "authn" "name": "Auth Module Name", "enabled": true, "mode": "broker/direct" "config": {}, // see below config response samples "kerberos_config": { // optional "enabled": "boolean optional", "keytab_file": "string optional" } } ``` config object for type **ad** or **ldap**: ``` { "serverprotocol": "ldap", "server": "string" "serverport": "string" "binddn": "string" "bindpassword": "string", "basedn": "string", "securityauthentication": "Simple", "filter": "string", "serviceacctreadonly": true, "scepenabled": "boolean optional", "scepurl": "string optional", "challengeurl": "string optional", "scepagent": "string optional", "ldapqueryfilter": "string optional", "cert_enabled": "boolean", "cert_template": "string", "dc_dns": "string", "dc_ca": "string", "logfilesizemb": "number", // it's only for AD BROKER "logfilecount": "number", // it's only for AD BROKER "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } }, "caList": [{ "cert_template": "string required", "dc_dns": "string required", "dc_ca": "string required", "lastSuccessAt": "date optional", "lastNotifiedAt": "date optional" }], "caTimeoutSeconds": "number optional - default = 10s", "caRetryAfterMinutes": "number optional - default = 30m", "caStatusChangeNotificationsTo": "array optional", "caStatusChangeNotificationsEnabled": "boolean optional", } ``` config object for type **azuread**: ``` { "appName": "string", "tenantId": "string", "tenantName": "string", "clientId": "string", "clientSecret": "string", "loginBasePath": "string", "graphApiBasePath": "string", "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ``` config for type **db**: ``` { "passwordPolicy": { "allowed": "boolean required", "authtype": "Fingerprint|Face", "description": "string required", "rules": { "min": "number required", "min_enabled": "boolean required", "min_special": "number required", "min_special_enabled": "boolean required", "min_numbers": "number required", "min_numbers_enabled": "boolean required", "special_chars_allowed": "string required", "special_chars_allowed_enabled": "boolean required", "min_alpha_caps": "number required", "min_alpha_caps_enabled": "boolean required", "noUsername": "boolean required", "noUsername_enabled": "boolean required", "noSpaces": "boolean required", "noSpaces_enabled": "boolean required", "allowInRow": "number required", "allowInRow_enabled": "boolean required" } } } ```
{
  "data": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="
}
DELETE/auth_modules/{moduleId}

Delete auth module by moduleId.

Delete auth module by moduleId.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Parameters

No Parameters

Returns

No content.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
moduleIdrequiredstring—
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/auth_modules/{moduleId}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/auth_modules/xxxxxxxxxxxxxxxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
400
401
404
Success Empty response
// no response body
Admin API

MSG Gateway

MSG Gateway endpoints.

POST/msg_gateway/create

Create message gateway configs

Create message gateway configs.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give created message gateway id and status

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

for type email:

{
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["email"],
  "protocol": "smtp",
  "auth": "true",
  "name": "Default Email Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderEmail": "required string",
  "port": "465",
  "awsRegion" : "required string for aws gateway"
}

for type sms:

{
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["sms"],
  "auth": "true",
  "name": "Default SMS Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderPhone": "required string",
  "smstemplateid": "required string",
  "entityId": "required string",
  "authTokenRequestUrl": "required string for Coalesce gateway",
  "authClientId": "required string for Coalesce gateway",
  "authClientSecret":"required string for Coalesce gateway",
  "authGrantType":"required string for Coalesce gateway",
  "authScope":"required string for Coalesce gateway",
  "principalEntityId": "required string for Gupshup gateway",
  "dltTemplateId": "required string for Gupshup gateway",
  "awsRegion" : "required string for aws gateway",
  "appCategory" : "required string for sandesh gateway",
  "gstFlag" : "required string for sandesh gateway",
  "msgType" : "required string for sandesh gateway"
}

for type voice:

{
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["voice"],
  "auth": "true",
  "name": "Default Voice Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderPhone": "required string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
typestring—
channelsarray<string>—
protocolstring—
authstring—
namestring—
usernamestring—
passwordstring—
serviceUrlstring—
senderEmailstring—
portstring—
smstemplateidstring—
entityIdstring—
authTokenRequestUrlstring—
authClientIdstring—
authClientSecretstring—
authGrantTypestring—
authScopestring—
principalEntityIdstring—
dltTemplateIdstring—
awsRegionstring—
appCategorystring—
gstFlagstring—
msgTypestring—
POSThttps://pilot-root.1kosmos.net/adminapi/msg_gateway/create
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/msg_gateway/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "type": "xxxxxxxxxx", "channels": ["email"], "protocol": "xxxxxxxxxx", "auth": "xxxxxxxxxx", "name": "xxxxxxxxxx", "username": "xxxxxxxxxx", "password": "xxxxxxxxxx", "serviceUrl": "xxxxxxxxxx", "senderEmail": "xxxxxxxxxx", "port": "xxxxxxxxxx", "smstemplateid": "xxxxxxxxxx", "entityId": "xxxxxxxxxx", "authTokenRequestUrl": "xxxxxxxxxx", "authClientId": "xxxxxxxxxx", "authClientSecret": "xxxxxxxxxx", "authGrantType": "xxxxxxxxxx", "authScope": "xxxxxxxxxx", "principalEntityId": "xxxxxxxxxx", "dltTemplateId": "xxxxxxxxxx", "awsRegion": "xxxxxxxxxx", "appCategory": "xxxxxxxxxx", "gstFlag": "xxxxxxxxxx", "msgType": "xxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "id": "xxxxxxxx",
  "status": "xxxxxxxx"
}
POST/msg_gateway/fetch

Get message gateway configs

Get message gateway configs.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of message gateways info

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "string",
  "communityId": "string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/msg_gateway/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/msg_gateway/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
[
  {
    "id": "xxxxxxxx",
    "tenantId": "xxxxxxxxxx",
    "communityId": "xxxxxxxxxx",
    "type": null,
    "channels": [
      "email"
    ],
    "protocol": "xxxxxxxxxx",
    "auth": "true",
    "name": "xxxxxxxxxx",
    "username": "xxxxxxxxxx",
    "password": "xxxxxxxxxx",
    "serviceUrl": "xxxxxxxxxx",
    "senderEmail": "xxxxxxxxxx",
    "active": "xxxxxxxxxx",
    "port": "xxxxxxxxxx",
    "principalEntityId": "xxxxxxxxxx",
    "dltTemplateId": "xxxxxxxxxx",
    "awsRegion": "xxxxxxxxxx",
    "appCategory": "xxxxxxxxxx",
    "gstFlag": "xxxxxxxxxx",
    "msgType": "xxxxxxxxxx"
  }
]
POST/msg_gateway/fetch/{id}

Get message gateway configs by id

Get message gateway configs.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give list of message gateways info

Path parameters
NameTypeDescription
idrequiredstringid of gateway;
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "string",
  "communityId": "string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/msg_gateway/fetch/{id}
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/msg_gateway/fetch/Do not enter anything, use 'id' fields' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
[
  {
    "id": "xxxxxxxx",
    "tenantId": "xxxxxxxxxx",
    "communityId": "xxxxxxxxxx",
    "type": null,
    "channels": [
      "email"
    ],
    "protocol": "xxxxxxxxxx",
    "auth": "true",
    "name": "xxxxxxxxxx",
    "username": "xxxxxxxxxx",
    "password": "xxxxxxxxxx",
    "serviceUrl": "xxxxxxxxxx",
    "senderEmail": "xxxxxxxxxx",
    "active": "xxxxxxxxxx",
    "port": "xxxxxxxxxx",
    "principalEntityId": "xxxxxxxxxx",
    "dltTemplateId": "xxxxxxxxxx",
    "awsRegion": "xxxxxxxxxx",
    "appCategory": "xxxxxxxxxx",
    "gstFlag": "xxxxxxxxxx",
    "msgType": "xxxxxxxxxx"
  }
]
POST/msg_gateway/update

Update message gateway configs

Update message gateway configs.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Response give created message gateway id and status

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

for type email:

{
  "id": "required string",
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["email"],
  "protocol": "smtp",
  "auth": "true",
  "name": "Default Email Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderEmail": "required string",
  "port": "465",
  "awsRegion" : "required string for aws gateway"
}

for type sms:

{
  "id": "required string",
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["sms"],
  "name": "Default SMS Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderPhone": "required string",
  "otpDelimiter": "optional string",
  "timeoutValue": "optional number",
  "smstemplateid": "required string"
  "entityId": "required string",
  "authTokenRequestUrl": "required string for Coalesce gateway",
  "authClientId": "required string for Coalesce gateway",
  "authClientSecret":"required string for Coalesce gateway",
  "authGrantType":"required string for Coalesce gateway",
  "authScope":"required string for Coalesce gateway",
  "smstemplateid": "required string",
  "principalEntityId": "required string for Gupshup gateway",
  "dltTemplateId": "required string for Gupshup gateway",
  "awsRegion" : "required string for aws gateway",
  "appCategory" : "required string for sandesh gateway",
  "gstFlag" : "required string for sandesh gateway",
  "msgType" : "required string for sandesh gateway"
}

for type voice:

{
  "id": "required string",
  "tenantId": "required string",
  "communityId": "required string",
  "type": "required string",
  "channels": ["voice"],
  "auth": "true",
  "name": "Default Voice Gateway",
  "username": "required string",
  "password": "required string",
  "serviceUrl": "required string",
  "senderPhone": "required string",
  "otpDelimiter": "optional string",
  "timeoutValue": "optional number"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
idstring—
tenantIdstring—
communityIdstring—
typestring—
channelsarray<string>—
protocolstring—
authstring—
namestring—
usernamestring—
passwordstring—
serviceUrlstring—
senderEmailstring—
portstring—
otpDelimiterstring—
timeoutValuenumber—
smstemplateidstring—
entityIdstring—
authTokenRequestUrlstring—
authClientIdstring—
authClientSecretstring—
authGrantTypestring—
authScopestring—
principalEntityIdstring—
dltTemplateIdstring—
awsRegionstring—
appCategorystring—
gstFlagstring—
msgTypestring—
POSThttps://pilot-root.1kosmos.net/adminapi/msg_gateway/update
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/msg_gateway/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"id": "xxxxxxxxxx", "tenantId": "xxxxxxxxxx", "communityId": "xxxxxxxxxx", "type": "xxxxxxxxxx", "channels": ["email"], "protocol": "xxxxxxxxxx", "auth": "xxxxxxxxxx", "name": "xxxxxxxxxx", "username": "xxxxxxxxxx", "password": "xxxxxxxxxx", "serviceUrl": "xxxxxxxxxx", "senderEmail": "xxxxxxxxxx", "port": "xxxxxxxxxx", "otpDelimiter": "xxxxxxxxxx", "timeoutValue": "xxxxx", "smstemplateid": "xxxxxxxxxx", "entityId": "xxxxxxxxxx", "authTokenRequestUrl": "xxxxxxxxxx", "authClientId": "xxxxxxxxxx", "authClientSecret": "xxxxxxxxxx", "authGrantType": "xxxxxxxxxx", "authScope": "xxxxxxxxxx", "principalEntityId": "xxxxxxxxxx", "dltTemplateId": "xxxxxxxxxx", "awsRegion": "xxxxxxxxxx", "appCategory": "xxxxxxxxxx", "gstFlag": "xxxxxxxxxx", "msgType": "xxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "id": "xxxxxxxx",
  "status": "xxxxxxxx"
}
DELETE/msg_gateway

Delete message gateway configs

Delete message gateway configs.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

204 No Content

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "required string",
  "communityId": "required string",
  "gatewayId": "required string"
}

IMPORTANT - you can send unencrypted data, it is only available in Swagger

FieldTypeDescription
communityIdstring—
tenantIdstring—
gatewayIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/msg_gateway
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/msg_gateway' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"communityId": "xxxxxxxx", "tenantId": "xxxxxxxx", "gatewayId": "xxxxxxxx"}'
RESPONSE
204
400
401
500
Success
// no response body
Admin API

Self Registration

Self Registration endpoints.

POST/register/phoneverify/session/{sessionId}/poll

/register/phoneverify/session/{sessionId}/poll

Poll for phone verification session during registration.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

phoneToken (required)

phoneToken : string

Returns

Returns new phone token needed for completing registration

Path parameters
NameTypeDescription
sessionIdrequiredstringsessionId of created session
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
phoneTokenstring—
POSThttps://pilot-root.1kosmos.net/adminapi/register/phoneverify/session/{sessionId}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/register/phoneverify/session/xxxxxxx/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"phoneToken": "xxxxxxxxxxxx"}'
RESPONSE
200
400
401
404
500
Success
{
  "newPhoneToken": "xxxxxxxxxxxx"
}
POST/register/verifyemail

/register/verifyemail

Verify email by uuid code.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

code (required)

code : string

Returns

User email.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
codestring—
POSThttps://pilot-root.1kosmos.net/adminapi/register/verifyemail
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/register/verifyemail' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "code": "string"}'
RESPONSE
200
400
401
404
410
429
500
Success
{
  "email": "string"
}
PUT/register/phoneverify/session/create

/register/phoneverify/session/create

Create phone verification session during registration.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

tenantTag (required)

tenantTag : string

communityName (required)

communityName : string

communityPublicKey (required)

communityPublicKey : string

phoneNumber (required)

phoneNumber : string

Returns

Returns object with sessionId, sessionUrl, serviceEnv, smsServiceNumber, smsTemplateB64 and phoneToken needed for registering phone number

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
tenantTagstring—
communityNamestring—
communityPublicKeystring—
phoneNumberstring—
PUThttps://pilot-root.1kosmos.net/adminapi/register/phoneverify/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/register/phoneverify/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxx", "communityId": "xxxxxxxxxxxx", "tenantTag": "xxxxxxxxxxxx", "communityName": "xxxxxxxxxxxx", "communityPublicKey": "xxxxxxxxxxxx", "phoneNumber": "xxxxxxxxxxxx"}'
RESPONSE
201
400
401
500
Successfully created
{
  "sessionId": "xxxxxxxxxxxx",
  "sessionUrl": "xxxxxxxxxxxx",
  "serviceEnv": "xxxxxxxxxxxx",
  "smsServiceNumber": "xxxxxxxxxxxx",
  "smsTemplateB64": "xxxxxxxxxxxx",
  "phoneToken": "xxxxxxxxxxxx"
}
PUT/register/sendverify

/register/sendverify

Send account creation verification magic link.

<b>:: Notes for website ::</b>

+ Default request body is {data: ecdsa_string}

+ This API can accept any query params which will be passed to template

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

email (required)

email : string

tenantId (required)

tenantId : string

communityId (required)

communityId : string

captchaToken (required)

captchaToken : string

Returns

Send account creation verification magic link via email.

This API throw an error if something goes wrong.

Query parameters
NameTypeDescription
SAMLRequeststringSAML SAMLRequest
RelayStatestringSAML RelayState
SigAlgstringSAML SigAlg
SignaturestringSAML Signature
ForceAuthnstringSAML ForceAuthn
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
emailstring—
tenantIdstring—
communityIdstring—
captchaTokenstring—
PUThttps://pilot-root.1kosmos.net/adminapi/register/sendverify
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/register/sendverify?SAMLRequest=<SAMLRequest>&RelayState=<RelayState>&SigAlg=<SigAlg>&Signature=<Signature>&ForceAuthn=<ForceAuthn>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"email": "string", "tenantId": "string", "communityId": "string", "captchaToken": "string"}'
RESPONSE
200
400
401
409
500
Success
{
  "code": 200,
  "message": "Ok"
}
PUT/register/user

/register/user

Register user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

firstname (required)

firstname : string

lastname (required)

lastname : string

email (required)

email : string

password (required)

password : string

code (required)

code : string

captchaToken (required)

captchaToken : string

phoneNumber (required)

phoneNumber : string

phoneToken (required)

phoneToken : string

Returns

User object and pon data and jwt.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
firstnamestring—
lastnamestring—
emailstring—
phoneNumberstring—
phoneTokenstring—
passwordstring—
codestring—
captchaTokenstring—
PUThttps://pilot-root.1kosmos.net/adminapi/register/user
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/register/user' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "moduleId": "string", "firstname": "string", "lastname": "string", "email": "string", "phoneNumber": "string", "phoneToken": "string", "password": "string", "code": "string", "captchaToken": "string"}'
RESPONSE
200
400
401
404
410
429
500
Success
{
  "user": "object",
  "pon_data": "object",
  "jwt_token": "string"
}
Admin API

Authentication Journey

Authentication Journey endpoints.

POST/authenticationJourney/fetch

Fetch AuthenticationJourney

Fetch AuthenticationJourney

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Must contain all fields to create a valid AuthenticationJourney IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
idsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/authenticationJourney/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/authenticationJourney/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "ids": ["xxxxxxxx"]}'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
{
  "id": "uuid",
  "tenantId": "tenantId",
  "communityId": "communityId",
  "journeyName": "journeyName",
  "enabled": true,
  "groups": {
    "value": [
      "groups"
    ],
    "operator": "overlap"
  },
  "deviceId": {
    "value": [
      "deviceId"
    ],
    "operator": "overlap"
  },
  "application": {
    "value": [
      "Salesforce"
    ],
    "operator": "in"
  },
  "username": {
    "value": [
      "username"
    ],
    "operator": "in"
  },
  "ip": {
    "value": [
      "10.10.10.10"
    ],
    "operator": "in_range"
  },
  "domain": "1k-dev.com",
  "decision": {
    "action": "mfa_required",
    "authenticationMethods": [
      "password_and_otp"
    ]
  }
}
PUT/authenticationJourney

Create AuthenticationJourney

Create AuthenticationJourney

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/authenticationJourney
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/authenticationJourney' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
PATCH/authenticationJourney/{id}

Update AuthenticationJourney

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of authenticationJourney to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PATCHhttps://pilot-root.1kosmos.net/adminapi/authenticationJourney/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/authenticationJourney/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
DELETE/authenticationJourney/{id}

Delete AuthenticationJourney

Delete AuthenticationJourney.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Nothing to return

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of identity provider to delete
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    tenantId: xxxxxx,
    communityId: xxxxxx
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/authenticationJourney/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/authenticationJourney/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx"}'
RESPONSE
204
400
401
SUCCESS No Content
// no response body
Admin API

Authentication Journey V 2

Authentication Journey V 2 endpoints.

POST/v2/authenticationJourney/fetch

Fetch AuthenticationJourney

Fetch AuthenticationJourney

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Must contain all fields to create a valid AuthenticationJourney IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
idsarray<string>—
requestingAppIdstring—
categorystringOptional filter to fetch journeys by category
POSThttps://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "ids": ["xxxxxxxx"], "requestingAppId": "linux_cp", "category": "adaptive_auth_fallback_policy_v2"}'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
[
  {
    "name": "auth-journey-1",
    "enabled": true,
    "category": "adaptive_auth_fallback_policy_v2",
    "groups": {
      "value": [
        "group a",
        "group b"
      ],
      "operator": "overlap"
    },
    "requestingAppId": {
      "value": "linux_cp",
      "operator": "eq"
    },
    "usernames": {
      "value": [
        "username_1",
        "username_2"
      ],
      "operator": "in"
    },
    "decision": {
      "action": "mfa_required",
      "authenticationMethods": [
        "password_and_otp",
        "helpdesk_otp"
      ]
    }
  }
]
PUT/v2/authenticationJourney

Create V2 Authentication Journey

Create V2 Authentication Journey

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
PATCH/v2/authenticationJourney/{id}

Update V2 Authentication Journey

Update V2 Authentication Journey

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of linux authenticationJourney to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PATCHhttps://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
DELETE/v2/authenticationJourney/{id}

Delete AuthenticationJourney

Delete AuthenticationJourney.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Nothing to return

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of identity provider to delete
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    tenantId: xxxxxx,
    communityId: xxxxxx
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/v2/authenticationJourney/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx"}'
RESPONSE
204
400
401
SUCCESS No Content
// no response body
Admin API

Behavior Auth

Behavior authentication (typing biometrics) management

POST/behavior_auth/random_phrase/fetch

Fetch random phrase

Fetch a random phrase for behavior auth enrollment.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns a random phrase and a user_token for enrollment.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/behavior_auth/random_phrase/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/behavior_auth/random_phrase/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'
RESPONSE
200
401
404
500
Success
{
  "data": {
    "phrase": "string",
    "user_token": "string"
  }
}
POST/behavior_auth/register

Register behavior auth pattern

Register a typing pattern for behavior auth.

Multiple registration attempts are required (configurable, default 5).

Each call returns a next_step indicating whether more attempts are needed.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns next_step, user_token, and typing_data.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
phrasestring—
patternstring—
user_tokenstring—
POSThttps://pilot-root.1kosmos.net/adminapi/behavior_auth/register
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/behavior_auth/register' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"phrase": "string", "pattern": "string", "user_token": "string"}'
RESPONSE
200
401
405
500
Success
{
  "data": {
    "next_step": "string",
    "user_token": "string",
    "typing_data": {}
  }
}
POST/behavior_auth/validate

Validate behavior auth pattern

Validate a typing pattern for behavior auth login.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns user details and a proof_of_authentication_jwt with methods: ["behavior_auth"].

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
patternstring—
POSThttps://pilot-root.1kosmos.net/adminapi/behavior_auth/validate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/behavior_auth/validate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pattern": "string"}'
RESPONSE
200
401
423
500
Success
{
  "data": {
    "username": "string",
    "proof_of_authentication_jwt": "string",
    "typing_data": {}
  }
}
DELETE/behavior_auth/deregister

Deregister behavior auth pattern

Deregister the typing pattern for behavior auth.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns a confirmation message on successful deregistration.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
datastring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/behavior_auth/deregister
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/behavior_auth/deregister' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "string"}'
RESPONSE
200
401
404
500
Success
{
  "data": {
    "message": "string"
  }
}
Admin API

Broker

Broker endpoints.

POST/broker/fetch

Fetch broker connections

Fetch broker connections.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Returns

Returns broker connections.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/broker/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/broker/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "moduleId": "moduleId"}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PATCH/broker/changestatus

Change status of broker connection

Change status of broker connection.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Returns

Returns updated broker connection.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
uidstring—
enabledstring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/broker/changestatus
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/broker/changestatus' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "moduleId": "moduleId", "uid": "xxx", "enabled": "true/false"}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PATCH/broker/update

Update broker connection (only name is allowed to be updated by this api)

Update broker connection.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Returns

Returns updated broker connection.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
uidstring—
namestring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/broker/update
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/broker/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "moduleId": "moduleId", "uid": "xxx", "name": "xxx"}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
DELETE/broker/{uid}

Delete broker connection

Delete broker connection.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Path parameters
NameTypeDescription
uidrequiredstringBroker connection uid
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/broker/{uid}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/broker/<uid>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "moduleId": "moduleId"}'
RESPONSE
204
400
401
404
500
Success
// no response body
Admin API

External Idp

External Idp endpoints.

POST/external_idp/fetch

fetch ExternalIdp

fetch ExternalIdp

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Must contain all fields to create a valid ExternalIdp IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
idsarray<object>—
POSThttps://pilot-root.1kosmos.net/adminapi/external_idp/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/external_idp/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx", "ids": ["xxxxxxx"]}'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
PUT/external_idp

Create ExternalIdp

Create ExternalIdp

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/external_idp
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/external_idp' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
PATCH/external_idp/{id}

Update ExternalIdp

Update ExternalIdp

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of external idp to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PATCHhttps://pilot-root.1kosmos.net/adminapi/external_idp/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/external_idp/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
DELETE/external_idp/{id}

Delete External idp

Delete External idp.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Nothing to return

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of External idp to delete
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    tenantId: xxxxxx,
    communityId: xxxxxx
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/external_idp/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/external_idp/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx"}'
RESPONSE
204
400
401
SUCCESS No Content
// no response body
Admin API

Identity Providers

Identity Providers endpoints.

POST/idp/fetch

Fetch Identity Providers

Fetch Identity Providers.

This endpoint must be accessed by an administrator.

If identity provider for this tenant/community doesn't exist, then default one is created and returned here. <b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity providers' array

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    tenantId: xxxxxx,
    communityId: xxxxxx,
    id: xxxxxx,
    type: xxxxxx,
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
idstring—
typestring—
POSThttps://pilot-root.1kosmos.net/adminapi/idp/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/idp/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx", "id": "mongoId", "type": "oidc"}'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
[
  "string"
]
PUT/idp

Create Identity Provider

Create Identity Provider.

This endpoint must be accessed by an administrator.

Only one type of config can be created for one community. You can't create two configs with type="oidc" for one community. <b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing identity provider

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/idp
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/idp' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
PATCH/idp/{id}

Update Identity Provider

Update Identity Provider.

This endpoint must be accessed by an administrator.

Only one type of config can exist for one community. You can't have two configs with type="oidc" for one community. <b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing updated identity provider

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of identity provider to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PATCHhttps://pilot-root.1kosmos.net/adminapi/idp/{id}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/idp/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '"string"'
RESPONSE
200
400
401
SUCCESS IMPORTANT - Unencrypted response is only available in Swagger In real application, you will get data as follow: ``` { "data": "<ecdsa_encrypted_response>", "publicKey": "<adminapi_public_key>" } ```
"string"
DELETE/idp/{id}

Delete Identity Provider

Delete Identity Provider.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Nothing to return

Path parameters
NameTypeDescription
idrequiredstringMongo objectId of identity provider to delete
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    tenantId: xxxxxx,
    communityId: xxxxxx
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/idp/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/idp/xxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx"}'
RESPONSE
204
400
401
SUCCESS No Content
// no response body
Admin API

User Attributes

User Attributes endpoints.

GET/attributes

Fetch User Attributes

Fetch User Attributes.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Query

moduleId (required)

ObjectID - id of module to fetch attributes from

Returns

Returns encrypted array of user attributes objects

Query parameters
NameTypeDescription
moduleIdrequiredstringObjectID - id of module to fetch attributes from
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/attributes
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/attributes?moduleId=<moduleId>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
Success publicKey is publicKey of Users Mgmt API, useful for decryption response data is ECDSA encrypted object represents array of user attributes: ``` [ { "_id": "ObjectId", "name": "name", "attribute": "attribute", "moduleId": "ObjectId" } ] ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/attributes

Create User Attributes

Create User Attributes.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns encrypted object represents creation result

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    "moduleId": "xxx",
    "attributes": [
       {
            "name": "xxx",
            "attribute": "xxx"
        }
    ]
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
moduleIdstring—
attributesarray<object>—
PUThttps://pilot-root.1kosmos.net/adminapi/attributes
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/attributes' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"moduleId": "xxx", "attributes": [{"name": "xxx", "attribute": "xxx"}]}'
RESPONSE
200
400
401
Success publicKey is publicKey of Users Mgmt API, useful for decryption response data is ECDSA encrypted object represents creation result: ``` { "created": [ { "_id": "ObjectId", "name": "name", "attribute": "attribute", "moduleId": "ObjectId" } ], "errors": [] } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PATCH/attributes/{attributeId}

Update User Attribute

Update User Attribute.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Params

attributeId (required)

ObjectID - id of user attribute to update

Returns

Returns encrypted object represents updated user attribute

Path parameters
NameTypeDescription
attributeIdrequiredstringObjectID - id of user attribute to update
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    "name": "xxx",
    "attribute": "xxx"
    "moduleId": "xxxxxxxxxxxxxxxxxxxxx"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
namestring—
attributestring—
moduleIdstring—
PATCHhttps://pilot-root.1kosmos.net/adminapi/attributes/{attributeId}
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/attributes/<attributeId>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "xxx", "attribute": "xxx", "moduleId": "xxxxxxxxxxxxxx"}'
RESPONSE
200
400
401
404
Success publicKey is publicKey of Users Mgmt API, useful for decryption response data is ECDSA encrypted object represents updated user atrribute: ``` { "_id": "ObjectId", "name": "name", "attribute": "attribute", "moduleId": "ObjectId" } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
DELETE/attributes/{attributeId}

Delete User Attribute

Update User Attribute.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Params

attributeId (required)

ObjectID - id of user attribute to delete

Returns

204 No Content

Path parameters
NameTypeDescription
attributeIdrequiredstringObjectID - id of user attribute to delete
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    "moduleId": "xxxxxxxxxxxxxxxxxxxxx"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
moduleIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/attributes/{attributeId}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/attributes/<attributeId>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"moduleId": "xxxxxxxxxxxxxx"}'
RESPONSE
204
400
401
404
Success
// no response body
Admin API

Auth Proxy

Auth Proxy endpoints.

POST/authproxy/fetch

Fetch AuthProxy config

Fetch AuthProxy endpoint fetch the authproxy config form the instance caas by tenant and community id.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

ids (optional)

ids : array

Returns

Returns authProxy configurations.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
idsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/authproxy/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/authproxy/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxx", "communityId": "xxxxxx", "ids": ["xxxxx"]}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/authproxy/config/{id}

Set AuthProxy Config

Set AuthProxy endpoint set the authproxy config on instance caas

This endpoint must be accessed without login.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### name (required) name : string

### authScheme (required) authScheme : array

### pushKeyword (required) pushKeyword : string

### ivrKeyword (optional) ivrKeyword : string

### isDefaultAuthMethodEnable (optional) isDefaultAuthMethodEnable : boolean (default: false)

### defaultAuthMethod (optional) defaultAuthMethod : string (push or ivr) - only saved when isDefaultAuthMethodEnable is true

Returns

Returns object with configured authProxy

Path parameters
NameTypeDescription
idrequiredstringuid for creating configuration;
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/authproxy/config/{id}
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/authproxy/config/xxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "name": "string", "authScheme": "array", "pushKeyword": "string", "ivrKeyword": "string", "isDefaultAuthMethodEnable": "boolean", "defaultAuthMethod": "string" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{}
DELETE/authproxy/config/{id}

Delete authproxy config

Delete authproxy config from the instance caas.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

Returns

Returns 204 status code on success.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
idrequiredstringuid for creating configuration;
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/authproxy/config/{id}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/authproxy/config/xxxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Authz

Authz endpoints.

GET/authz/role/fetch

Fetch All Roles

Get all available roles for community.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/authz/role/fetch
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/authz/role/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
[
  "role1",
  "role2",
  "role3"
]
GET/authz/role/fetch/{roleName}

Fetch One Role

Get a role object with given roleId.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Path parameters
NameTypeDescription
roleNamerequiredstringRole Name (string)
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/authz/role/fetch/{roleName}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/authz/role/fetch/xxxxxxxxxx' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
{
  "id": "xxxxxxxxxxx",
  "name": "xxxxxxxxxxxxxxxx",
  "description": "xxxxx",
  "createdBy": "xxxxxxxxx",
  "permissions": [],
  "tenantId": "xxxxxxxxxxx",
  "communityId": "xxxxxxxxxxx"
}
POST/authz/authorization/fetch

Authorizations by userId

Get authorizations for user. Only for admins

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request Authorizations for given userId:

{
  "objectType": "string, required", // "user"
  "objectId": "string, required", // userUid
  "subjectType": "string, required", // "community"
  "subjectId": "objectId, required" // communityId
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
objectTypestring—
objectIdstring—
subjectTypestring—
subjectIdobjectId—
POSThttps://pilot-root.1kosmos.net/adminapi/authz/authorization/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/authz/authorization/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"objectType": "user", "objectId": "xxxxxxxxxxxxxxxx", "subjectType": "community", "subjectId": "xxxxxxxxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
[
  {
    "id": "id",
    "subjectType": "community",
    "subjectId": "communityId",
    "objectType": "objectType",
    "objectId": "objectId",
    "role": {
      "name": "name",
      "createdBy": "createdBy",
      "description": "description",
      "permissions": [
        "p1",
        "p2"
      ]
    }
  }
]
GET/config/consents/ipfs/{ipfsHash}

Get historical consent by IPFS hash

Retrieve a historical consent document by its IPFS hash.

This endpoint must be accessed by an administrator (tenant_admin or community_admin).

AdminAPI proxies this request to CaaS, which fetches the document from IPFS.

<b>:: Note for website ::</b>

+ Response is ECDSA encrypted in production

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing the historical consent document stored in IPFS

Path parameters
NameTypeDescription
ipfsHashrequiredstringThe IPFS content hash (CID) of the consent document
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/consents/ipfs/{ipfsHash}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/consents/ipfs/<ipfsHash>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
403
404
500
Success publicKey is publicKey of AdminAPI, useful for decryption response data is ECDSA encrypted object containing the historical consent document
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
GET/config/consents/{type}

Get consent configuration by type

Get the current consent configuration for the specified type.

This endpoint must be accessed by an administrator (tenant_admin or community_admin).

AdminAPI proxies this request to CaaS, which owns the consent data.

Supported types: biometric (more types can be added to CONSENT_TYPES).

<b>:: Note for website ::</b>

+ Response is ECDSA encrypted in production

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing the consent configuration for the given type

Path parameters
NameTypeDescription
typerequiredstringThe consent type
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/config/consents/{type}
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/config/consents/<type>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
403
500
Success publicKey is publicKey of AdminAPI, useful for decryption response data is ECDSA encrypted object containing the consent configuration: ``` { "type": "string (e.g. biometric)", "isEnabled": "boolean", "title": "string", "subtitle": "string", "body": "string (base64 encoded)", "acknowledgeText": "string", "ipfsHash": "string (current IPFS hash)", "history": [ { "ipfsHash": "string", "updatedAt": "string" } ] } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/config/consents

Create or update consent configuration

Create or update consent configuration for the community.

This endpoint must be accessed by an administrator (tenant_admin or community_admin).

AdminAPI validates the request and proxies to CaaS, which handles IPFS storage and hash computation.

The type field determines which consent is being updated.

When isEnabled is true, title, body, and acknowledgeText are required.

When isEnabled is false, content fields are optional (can be empty strings).

The body field must be base64 encoded when isEnabled is true.

Audit events are fired by CaaS conditionally based on type (currently only biometric fires E_BIOMETRIC_CONSENT_UPDATED events). The event includes admin user's IP address and user-agent (from eventData), consent document ID (ipfsHash), and a list of actions describing what changed (e.g. enabled, disabled, changed_title, changed_subtitle, changed_body, changed_acknowledge_text).

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing the updated consent configuration

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unencrypted data as well, it is only a preview available in Swagger

{
    type: "string required - consent type (e.g. 'biometric')",
    isEnabled: "boolean required (strict) - enable or disable the consent",
    title: "string required when isEnabled=true, optional otherwise",
    body: "string required when isEnabled=true (must be base64 encoded), optional otherwise",
    subtitle: "string optional",
    acknowledgeText: "string required when isEnabled=true, optional otherwise"
}
FieldTypeDescription
datarequiredstringECDSA encrypted JSON string containing the consent data (see UpdateConsentPayload for decrypted shape). In Swagger preview mode, send the unencrypted object directly.
PUThttps://pilot-root.1kosmos.net/adminapi/config/consents
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/consents' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "ecdsa_encrypted_string"}'
RESPONSE
200
400
401
403
500
Success publicKey is publicKey of AdminAPI, useful for decryption response data is ECDSA encrypted object containing the updated consent configuration
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Radius

Radius endpoints.

POST/radius/fetch

Fetch radius configurations

Fetch radius configurations.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

Returns

Returns radius configurations.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
idsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/radius/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/radius/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenantId", "communityId": "communityId", "ids": ["ids"]}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/radius/config/{uid}

Set radius configuration

Set radius configuration.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

name (required)

name : string

authScheme (required)

authScheme : array

pushKeyword (required)

pushKeyword : string

Returns

Returns Set radius configuration.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
uidrequiredstringuid for creating configuration;
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
namestring—
authSchemearray<string>—
pushKeywordstring—
ivrKeywordstring—
ivrLinestring—
PUThttps://pilot-root.1kosmos.net/adminapi/radius/config/{uid}
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/radius/config/Do not enter anything, use 'Authorize' fields' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name": "name", "authScheme": ["push"], "pushKeyword": "pushKeyword", "ivrKeyword": "phone", "ivrLine": "phone"}'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
DELETE/radius/config/{uid}

Delete radius configuration

Delete radius configuration.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

Returns

Returns Set radius configuration.

This API throw an error if something goes wrong.

Path parameters
NameTypeDescription
uidrequiredstringuid for creating configuration;
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/radius/config/{uid}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/radius/config/Do not enter anything, use 'Authorize' fields' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
404
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Reset Password

Reset Password endpoints.

POST/password_reset

/password_reset

Self reset user's own password based on code and otp and id proofing.

code and otp are sent to user via email and phone respectively.

ID proofing URL sent to user via email and phone respectively.

<b>:: Notes for website ::</b>

+ Default request body is {data: ecdsa_string}

+ This API can accept any query params which will be passed to template

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

code (optional) // if SSPR is enabled, this is not required

code : string

otp (optional)

otp : string

newPassword (required)

newPassword : string

user_token (required)

user_token : string

Returns

Send reset password link via email or SMS.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
codestring—
otpstring—
newPasswordstring—
user_tokenstring—
POSThttps://pilot-root.1kosmos.net/adminapi/password_reset
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/password_reset' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxx", "code": "xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx", "otp": "NNNN", "newPassword": "xxXX@#$XXxx", "user_token": "ecdsa_encryted_string"}'
RESPONSE
200
400
401
500
Success
{
  "code": 200,
  "message": "Ok"
}
POST/password_reset/user/fetch

/password_reset/user/fetch

Fetch user object and user_token with acr code for self password reset.

<b>:: Notes for website ::</b>

+ Default request body is {data: ecdsa_string}

+ This API can accept any query params which will be passed to template

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

code (required)

code : string

Returns

Send account creation verification magic link via email.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
codestring—
POSThttps://pilot-root.1kosmos.net/adminapi/password_reset/user/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/password_reset/user/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxx", "code": "xxxx-xxxx-xxxxx-xxxxxxx"}'
RESPONSE
200
400
401
404
410
429
500
Success
{
  "user": {
    "username": "string",
    "uid": "string",
    "type": "basic",
    "disbaled": false,
    "firstname": "string",
    "email": "string",
    "phone": "string",
    "urn": "string"
  },
  "user_token": "ecdsa_encryted_string"
}
PUT/password_reset/sendverify

/password_reset/sendverify

Sends self reset password verification magic link email.

<b>:: Notes for website ::</b>

+ Default request body is {data: ecdsa_string}

+ This API can accept any query params which will be passed to template

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

destination (required)

destination : string

user_token (required)

user_token : string

tenantId (required)

tenantId : string

communityId (required)

communityId : string

captchaToken (required)

captchaToken : string

license (optional, if valid license was provided, bypass captcha checking)

license : string

Returns

Send account creation verification magic link via email.

This API throw an error if something goes wrong.

Query parameters
NameTypeDescription
SAMLRequeststringSAML SAMLRequest
RelayStatestringSAML RelayState
SigAlgstringSAML SigAlg
SignaturestringSAML Signature
ForceAuthnstringSAML ForceAuthn
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
destinationstring—
user_tokenstring—
tenantIdstring—
communityIdstring—
captchaTokenstring—
licensestring—
PUThttps://pilot-root.1kosmos.net/adminapi/password_reset/sendverify
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/password_reset/sendverify?SAMLRequest=<SAMLRequest>&RelayState=<RelayState>&SigAlg=<SigAlg>&Signature=<Signature>&ForceAuthn=<ForceAuthn>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"destination": "string", "user_token": "string", "tenantId": "string", "communityId": "string", "captchaToken": "string", "license": "string"}'
RESPONSE
200
400
401
500
Success
{
  "code": 200,
  "message": "Ok"
}
Admin API

Secret Store

Secret Store endpoints.

POST/secret-store/create

Create a new secret

Create a new secret with encrypted value storage.

This endpoint must be accessed by a community administrator.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

### publickey (required) Public key

### authorization (required) JWT

Returns

Response gives created secret metadata (no value)

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "required string",
  "communityId": "required string",
  "tag": "required string - must start with letter [a-zA-Z] and contain only [a-zA-Z0-9_]",
  "value": "required string - secret value to encrypt"
}

IMPORTANT - you can send unencrypted data and you will get unencrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdrequiredstringTenant identifier
communityIdrequiredstringCommunity identifier
tagrequiredstringSecret identifier. Must start with a letter [a-zA-Z] and contain only [a-zA-Z0-9_]
valuerequiredstringSecret value to be encrypted and stored
POSThttps://pilot-root.1kosmos.net/adminapi/secret-store/create
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/secret-store/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenant_123", "communityId": "community_456", "tag": "stripe_api_key", "value": "sk_test_4eC39HqLyjWDarjtT1zdp7dc"}'
RESPONSE
201
400
401
403
409
Secret created successfully
{
  "tag": "stripe_api_key",
  "createdBy": "admin@example.com",
  "createdTs": 1704067200,
  "tenantId": "tenant_123",
  "communityId": "community_456"
}
POST/secret-store/delete

Delete a secret

Delete a secret by tag.

This endpoint must be accessed by a community administrator.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

### publickey (required) Public key

### authorization (required) JWT

Returns

Response gives success message

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "required string",
  "communityId": "required string",
  "tag": "required string - secret identifier to delete"
}

IMPORTANT - you can send unencrypted data, it is only available in Swagger

FieldTypeDescription
tenantIdrequiredstringTenant identifier
communityIdrequiredstringCommunity identifier
tagrequiredstringSecret identifier to delete
POSThttps://pilot-root.1kosmos.net/adminapi/secret-store/delete
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/secret-store/delete' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenant_123", "communityId": "community_456", "tag": "stripe_api_key"}'
RESPONSE
200
400
401
403
404
Success
{
  "message": "Secret deleted successfully"
}
POST/secret-store/fetch

Get secret store list

Get list of secrets for a tenant-community. Returns metadata only (tag, createdBy, createdTs) without secret values.

This endpoint must be accessed by a community administrator.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

### publickey (required) Public key

### authorization (required) JWT

Returns

Response gives list of secrets metadata (no values)

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
{
  "tenantId": "string",
  "communityId": "string"
}

IMPORTANT - you can send unencrypted data and you will get unencrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdrequiredstringTenant identifier
communityIdrequiredstringCommunity identifier
POSThttps://pilot-root.1kosmos.net/adminapi/secret-store/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/secret-store/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenant_123", "communityId": "community_456"}'
RESPONSE
200
400
401
403
Success
[
  {
    "tag": "stripe_api_key",
    "createdBy": "admin@example.com",
    "createdTs": 1704067200,
    "tenantId": "tenant_123",
    "communityId": "community_456"
  }
]
Admin API

Template Config

Template Config endpoints.

POST/config/template/fetch

get templates

Get templates config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing templates config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    tenantId: "string required",
    communityId: "string required",
    purposes: ["string"] //array is optional
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
purposesarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/config/template/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/template/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "purposes": ["xxxxxxxx"]}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/config/template

create/update template

Create or update template config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing template config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
templateDataobject—
PUThttps://pilot-root.1kosmos.net/adminapi/config/template
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/template' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "templateData": {"self_onboarding": {"email": {"uuid": {"name": "xyz", "subject": "Abc", "data": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "isDefault": true}}, "sms": {"uuid": {"name": "xyz", "isDefault": true, "data": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}}}}}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
DELETE/config/template

delete template

Delete template config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

204 No Content

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    tenantId: "string required",
    communityId: "string required",
    key_paths: ["string required"]
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
key_pathsarray<string>—
DELETEhttps://pilot-root.1kosmos.net/adminapi/config/template
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/config/template' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "key_paths": ["xxxxxxxx"]}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Branding

Branding endpoints.

POST/branding/fetch

Get Branding Config

Get Branding Config.

This endpoint must be accessed without login.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

Returns

Returns object with branding colors and images

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/branding/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/branding/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "bg_color_left_panel": "hex color - string", "bg_color_right_panel": "hex color - string", "heading_text_color": "hex color - string", "primary_button_color": "hex color - string", "active_tab_text_color": "hex color - string", "links_color": "hex color - string", "community_logo_img": "base64 image string", "bg_img_left_panel": "base64 image string", "default_login_method": "qr | username", "username_label": "string", "disclaimer_message": "string (optional)", "heading_label": "string", "app_download_override": { "enabled": "boolean", "content": "string", "url": "string" }, "bg_img_fullscreen_enabled": "boolean", "username_hidden_on_desktop": "boolean", "copyright_message_disabled": "boolean" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
PUT/branding

Set Branding Config

Set Branding Config.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Returns object with branding colors and images

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request should contain *publicKey* field with caller's public key

Request body contains *data* field with encrypted object below:

{
  "bg_color_left_panel": "hex color - string (required)",
  "bg_color_right_panel": "hex color - string (required)",
  "heading_text_color": "hex color - string (required)",
  "primary_button_color": "hex color - string (required)",
  "active_tab_text_color": "hex color - string (required)",
  "links_color": "hex color - string (required)",
  "community_logo_img": "base64 image string (required)",
  "bg_img_left_panel": "base64 image string (required)",
  "qr_code_corner_squares_color": "hex color - string (optional),
  "qr_code_dots_color": "hex color - string (optional),
  "qr_code_logo": "image url string (optional)",
  "default_login_method": "qr | username (optional)",
  "username_label": "string (optional)",
  "helpDeskButtonEnabled": "boolean (optional)",
  "helpDeskButtonData" : "object (optional)",
  "disclaimer_message": "string (optional)",
  "heading_label": "string (optional)",
  "bg_img_fullscreen_enabled": "boolean (optional)",
  "app_download_override": {
    "enabled": "boolean (optional)",
    "content": "string (required when enabled is true)",
    "url": "string (required when enabled is true, must be valid URL)"
  },
  "username_hidden_on_desktop": "boolean (optional)",
  "copyright_message_disabled": "boolean (optional)"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
bg_color_left_panelstring—
bg_color_right_panelstring—
primary_button_colorstring—
heading_text_colorstring—
links_colorstring—
active_tab_text_colorstring—
bg_img_left_panelstring—
qr_code_logostring—
qr_code_corner_squares_colorstring—
qr_code_dots_colorstring—
community_logo_imgstring—
default_login_methodstring—
username_labelstring—
disclaimer_messagestring—
PUThttps://pilot-root.1kosmos.net/adminapi/branding
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/branding' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "ABC123", "communityId": "ABC123", "bg_color_left_panel": "ABC123", "bg_color_right_panel": "ABC123", "primary_button_color": "ABC123", "heading_text_color": "ABC123", "links_color": "ABC123", "active_tab_text_color": "ABC123", "bg_img_left_panel": "xxxxxxxxxxxxxxxxxxxx", "qr_code_logo": "https://1k-dev.1kosmos.net/image.png", "qr_code_corner_squares_color": "ABC123", "qr_code_dots_color": "ABC123", "community_logo_img": "xxxxxxxxxxxxxxxxxxxxxxxxx", "default_login_method": "username", "username_label": "Corporate Username", "disclaimer_message": "string"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "bg_color_left_panel": "hex color - string", "bg_color_right_panel": "hex color - string", "heading_text_color": "hex color - string", "primary_button_color": "hex color - string", "active_tab_text_color": "hex color - string", "links_color": "hex color - string", "community_logo_img": "base64 image string", "bg_img_left_panel": "base64 image string", "default_login_method": "qr | username", "username_label": "string", "helpDeskButtonEnabled": "boolean", "helpDeskButtonData" : "object", "heading_label": "string", "bg_img_fullscreen_enabled": "boolean", "app_download_override": { "enabled": "boolean", "content": "string", "url": "string" }, "username_hidden_on_desktop": "boolean", "copyright_message_disabled": "boolean" } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxx/xxxx"
}
Admin API

Downloadables

Downloadables endpoints.

POST/downloadables/artifact/fetch

Download artifacts

Download specified artifacts.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

Returns

Downloads broker.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
typestring—
osstring—
versionstring—
POSThttps://pilot-root.1kosmos.net/adminapi/downloadables/artifact/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/downloadables/artifact/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "tenant1", "communityId": "community1", "moduleId": "module1", "type": "broker", "os": "windows", "version": "latest"}'
RESPONSE
200
400
401
404
500
Success.
// no response body
POST/downloadables/versions/fetch

Get software download info

Download software (broker, radius).

This endpoint must be accessed by an administrator.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Software version info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    software: ["string required"],
    latest: "boolean optional, defaults to true",
    os: ["string required"]
}
FieldTypeDescription
softwarearray<string>—
latestboolean—
osarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/downloadables/versions/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/downloadables/versions/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"software": ["broker"], "latest": true, "os": ["windows"]}'
RESPONSE
200
401
404
500
Success
{
  "artifacts": [
    {
      "software": "radius",
      "os": "linux",
      "displayVersion": "pl_gr_1.07.02",
      "version": "pl_gr_1.07.02"
    }
  ]
}
Admin API

Environment

Environment endpoints.

GET/environment

/environment

Provide details regarding the environments.

Returns

Returns an environment object

GEThttps://pilot-root.1kosmos.net/adminapi/environment
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/environment' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
Success
// no response body
PATCH/environment

Update environment attributes

Set environment configuration at the platform internal level.

This endpoint must be accessed by a community administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

**Headers*

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

**Returns*

Returns object with public key and encrypted data containing platform environment config data

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  sessionMaxAgeMinutes: 60
}
FieldTypeDescription
sessionMaxAgeMinutenumber—
PATCHhttps://pilot-root.1kosmos.net/adminapi/environment
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/environment' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"sessionMaxAgeMinute": 60}'
RESPONSE
200
400
401
500
Success
{
  "sessionMaxAgeMinute": 60
}
Admin API

Healthz

Healthz endpoints.

GET/healthz

Get healthz.

Get healthz

Returns

Returns a healthz object

  • ``version = <git-tag>.<commit-id>.<dob>``
  • ``git-tag``: When code is compiled from a git-tag, this must carry the tag name. This should match one of the git tags.
  • ``commit-id``: This is the git-commit-id. eg: When code is built from this, the hex code, in the end, is the commit it.
  • ``dob``: Date Of Build. This is epoc-time-in-se conds that tell the time when the build was created.
  • ​if the code is not built from a git-tag, then the ``version =<commit-id>.<dob>``
GEThttps://pilot-root.1kosmos.net/adminapi/healthz
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/healthz' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
Success ``` { "status": "all services operational", "publicKey": "string" //same as <service>/publickeys endpoint, "code": "200", "version": "<version>" //as defined above } ```
{
  "status": "all services operational",
  "publicKey": "//same as <service>/publickeys endpoint",
  "code": "200",
  "version": "xxxx.xxxx.xxxx"
}
GET/platform_health

Get Platform Health.

Get healthz

Returns

Returns a healthz object

  • ``version = <git-tag>.<commit-id>.<dob>``
  • ``git-tag``: When code is compiled from a git-tag, this must carry the tag name. This should match one of the git tags.
  • ``commit-id``: This is the git-commit-id. eg: When code is built from this, the hex code, in the end, is the commit it.
  • ``dob``: Date Of Build. This is epoc-time-in-se conds that tell the time when the build was created.
  • ​if the code is not built from a git-tag, then the ``version =<commit-id>.<dob>``
GEThttps://pilot-root.1kosmos.net/adminapi/platform_health
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/platform_health' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
Success ``` { "status": "all services operational", "publicKey": "string" //same as <service>/publickeys endpoint, "code": "200", "version": "<version>" //as defined above } ```
{
  "status": "all services operational",
  "publicKey": "//same as <service>/publickeys endpoint",
  "code": "200",
  "version": "xxxx.xxxx.xxxx"
}
Admin API

IDP Config

IDP Config endpoints.

POST/config/idp_config/fetch

get IDP Config

Get Indentity Provider's config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing IDP config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    tenantId: "string required",
    communityId: "string required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/config/idp_config/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/idp_config/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/config/idp_config

Set IDP Config

Create or update Indentity Provider's config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing IDP config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    tenantId: "string required",
    communityId: "string required",
    signingCert: "string required",
    signingKey: "string required",
    encryptionCert: "string required",
    encryptionKey: "string required",
    entityId: "string required",
    authnRequestsSigned: "boolean required",
    sso_bindings: ['string required'],
    slo_bindings: ['string required'],
    identifier: "string optional"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
signingCertstring—
signingKeystring—
encryptionCertstring—
encryptionKeystring—
entityIdstring—
authnRequestsSignedboolean—
sso_bindingsarray<string>—
slo_bindingsarray<string>—
identifierstring—
PUThttps://pilot-root.1kosmos.net/adminapi/config/idp_config
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/idp_config' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "signingCert": "xxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "signingKey": "xxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "encryptionCert": "xxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "encryptionKey": "xxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "entityId": "xxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "authnRequestsSigned": true, "sso_bindings": ["string"], "slo_bindings": ["string"], "identifier": "string"}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Idproofing Session

Idproofing Session endpoints.

POST/idproofing/session/{sessionId}/poll

Poll ID Proofing Session

This endpoint will poll the idproofing session result and return the success/fail status.

This endpoint must be accessed by an all users

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

Returns

Returns object with user_token

Path parameters
NameTypeDescription
sessionIdrequiredstringID of the Id Proofing session
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

  {
      tenantId: xxxxxx,
      communityId: xxxxxx,
      user_token: "xxxxxxxxxx" // encrypted user token
  }

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
user_tokenstring—
POSThttps://pilot-root.1kosmos.net/adminapi/idproofing/session/{sessionId}/poll
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/idproofing/session/xxxxxxxxxxxxxxx-xxx-xxxxx/poll' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxx", "communityId": "xxxxxx", "user_token": "ecdsa_encrypted_string"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "username": "username", // username of the user "user_token": "xxxxxxxxxx", // encrypted user token } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "username": "username_string",
  "user_token": "ecdsa_encrypted_string"
}
PUT/idproofing/session/create

Create ID Proofing Session

Create an Id Proofing session to verify identity to reset password.

This endpoint must be accessed by an all users

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

Returns

Returns object with user_token

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

  {
      tenantId: xxxxxx, // required
      communityId: xxxxxx, // required
      destinationHash: "xxxxxxxxxx", // hash of email or phone number required
      destinationChannel: "email" // or "sms" required
      user_token: "xxxxxxxxxx", // encrypted user token required
      captchaToken: "xxxxxxxxxx", // captcha token optional
      license: "xxxxxxxx-xxxx" // license optional
  }

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
destinationHashstring—
destinationChannelstring—
user_tokenstring—
captchaTokenstring—
licensestring—
PUThttps://pilot-root.1kosmos.net/adminapi/idproofing/session/create
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/idproofing/session/create' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxx", "communityId": "xxxxxxxxx", "destinationHash": "sha512_encrypted_string", "destinationChannel": "email", "user_token": "ecdsa_encrypted_string", "captchaToken": "captcha_token_string", "license": "license_key_string"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "sessionId": "sessionId", // id of the session "user_token": "xxxxxxxxxx", // encrypted user token } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "sessionId": "session_id_string",
  "user_token": "ecdsa_encrypted_string"
}
Admin API

Instance Config

Instance Config endpoints.

GET/instance_config/self_registration_config

Get Instance Self Registration config

Fetch Instance Self Registration config.

This endpoint must be accessed by an super admin.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing Self Registration Config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/instance_config/self_registration_config
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/instance_config/self_registration_config' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
500
Success
{
  "allowed": true
}
PUT/instance_config/self_registration_config

Set Instance Self Registration config

Create or update Instance Self Registration config.

This endpoint must be accessed by an super admin.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing Self Registration Config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    allowed: "boolean required"
}
FieldTypeDescription
allowedboolean—
PUThttps://pilot-root.1kosmos.net/adminapi/instance_config/self_registration_config
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/instance_config/self_registration_config' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"allowed": true}'
RESPONSE
200
400
401
500
Success
{
  "allowed": true
}
Admin API

Login sessions

API for terminating sessions

DELETE/loginsessions/admin/user/all

Delete user's all active sessions.

Allows Administrator with necessary permissions to delete all existing sessions for the specified user.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

  • Nothing to return
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
usernamestring—
moduleIdstring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/loginsessions/admin/user/all
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/loginsessions/admin/user/all' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"username": "string", "moduleId": "string"}'
RESPONSE
204
400
401
404
500
No Content
// no response body
DELETE/loginsessions/user/other

Delete user’s other sessions (keeps current session active).

Allows user terminates all the other active sessions

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Request Body

### username (required) username : string

### moduleId (required) moduleId : string

Returns

  • Nothing to return
  • Throws an error if something goes wrong.
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/loginsessions/user/other
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/loginsessions/user/other' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
204
401
500
No Content
// no response body
Admin API

Self Registration Config

Self Registration Config endpoints.

POST/config/self_registration_config/fetch

Get self registration config for community

Get self registration config for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/config/self_registration_config/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/self_registration_config/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string"}'
RESPONSE
200
400
401
500
Success
{
  "allowed": true
}
PUT/config/self_registration_config

Set self registration config for community

Set self registration config for community.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  allowed: "boolean"
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
allowedboolean—
PUThttps://pilot-root.1kosmos.net/adminapi/config/self_registration_config
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/self_registration_config' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "allowed": true}'
RESPONSE
200
400
401
500
Success
{
  "allowed": true
}
Admin API

Service Key

Service Key endpoints.

GET/servicekeys

Get service keys

This endpoint returns available service keys. The license you are using must be of authLevel 'system'

Headers

licensekey (required)

License key encrypted with ECDSA

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Returns

Returns array with service keys

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/servicekeys
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/servicekeys' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
400
401
500
Success
[
  {
    "tag": "xxxxx",
    "keyId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
    "keySecret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
    "type": "xxxxx"
  }
]
DELETE/servicekey/{keyId}

Reset Service Key

This endpoint resets service key for given keyId. Deletes current one and recreates a new one. The license you are using must be of authLevel 'system'

Parameters

keyId (required)

The keyId of service key to reset

Headers

licensekey (required)

License key encrypted with ECDSA

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Returns

Returns re-created service key

Path parameters
NameTypeDescription
keyIdrequiredstringkeyId of service key to reset
Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
DELETEhttps://pilot-root.1kosmos.net/adminapi/servicekey/{keyId}
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/servicekey/<keyId>' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
400
401
500
Success
[
  {
    "tag": "xxxxx",
    "keyId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
    "keySecret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
    "type": "xxxxx"
  }
]
Admin API

Session

Session endpoints.

POST/session/response/fetch

Fetch session response

Get Authenticate info.

  • verify license (with license mgmt API)
  • sessionId must not be expired
  • caller's publicKey must match SessionAuth.publicKey
  • return associated SessionAuthResponse
  • note:
  • SessionAuthResponse object must get deleted after successfully fetch
  • If session has expired, return appropriate error/message and delete both AuthSession and SessionAuthResponse entries.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (optional)

Bearer JWT

Request Body

sessionId (required)

The sessionId key is type of string and required.

tenantId (required)

The tenantId key is type of string and required.

communityId (required)

The communityId key is type of string and required.

transient (optional)

The transient key is type of boolean and optional.

authenticateMethod (optional)

Is type of string ['qr', 'stepUp', 'push'] (optional).

aliasUsed (optional)

The aliasUsed key is type of boolean and optional.

Returns

Returns the Authenticate info.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationstringJWT
Request body

Auth session data

FieldTypeDescription
sessionIdstring—
communityIdstring—
tenantIdstring—
transientboolean—
authenticateMethodstring—
aliasUsedstring—
POSThttps://pilot-root.1kosmos.net/adminapi/session/response/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/session/response/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"sessionId": "xxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "XXXXXXXXXXXXXXXXX", "tenantId": "XXXXXXXXXXXXXXXXX", "transient": "true/false", "authenticateMethod": "xxxxxx", "aliasUsed": "xxxxxx"}'
RESPONSE
200
400
401
403
404
Success
{
  "user": "object",
  "pon_data": "object",
  "jwt_token": "string"
}
PUT/session/new

Create a new session

Creates a new AuthSession object.

  • verify the license (with license management API)
  • create a new sessionId = new uuid()
  • create entry into the DB
  • publicKey is in the request headers
  • return created sessionId

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

tag (required)

The tag key is type of string and required.

url (required)

The url key is type of string and required.

communityName (required)

The communityName key is type of string and required.

tenantId (required)

The tenantId key is type of string and required.

communityId (required)

The communityId key is type of string and required.

authPage (optional)

The authPage key is type of string and optional.

scopes (optional)

The scopes key is type of string and optional.

authtype (required)

The authtype key is type of string and required.

metadata (optional)

Metadata object which supports "saml", "oidc" and "authenticationType" properties

Returns

Returns created sessionId

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

New session data

FieldTypeDescription
tagrequiredstring—
urlrequiredstring—
communityNamerequiredstring—
tenantIdrequiredstring—
communityIdrequiredstring—
authPagestring—
scopesstring—
authtyperequiredstring—
metadataobject—
PUThttps://pilot-root.1kosmos.net/adminapi/session/new
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/session/new' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tag": "tagName", "url": "url", "communityName": "communityName", "tenantId": "tenant id", "communityId": "community id", "authPage": "string", "scopes": "string", "authtype": "string", "metadata": {"purpose": "authentication", "username": "username", "saml": "saml request - optional", "oidc": "oidc request - optional", "authenticationType": "liveid_selfie - optional"}}'
RESPONSE
200
400
401
403
404
Success
{
  "sessionId": "xxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "sessionEnv": "XXXXXXXXXXXXXXXXX",
  "sessionUrl": "XXXXXXXXXXXXXXXXX"
}
Admin API

Session Attributes Config

Session Attributes Config endpoints.

POST/config/session_attributes/fetch

get BlockID session attributes Config

Get BlockID session, ledger, identity attributes Config.

This endpoint can be accessed by everyone.

This endpoint returns every data when accessed by administrator.

This endpoint returns partial data when accessed by normal user (only identity attributes).

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing session, ledger, identity attributes config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger Getting community session attribute pass tenant id and community id in request

{
  tenantId: "string required",
  communityId: "string required",
  local_key_paths: ["blockid_session_attributes"] // always this value or empty array
  global_key_paths: ["blockid_session_attributes", "blockid_ledger_attributes", "identity_attributes"] // always one or more of these values or empty array
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
local_key_pathsarray<string>—
global_key_pathsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/config/session_attributes/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/session_attributes/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "local_key_paths": ["blockid_session_attributes"], "global_key_paths": ["blockid_session_attributes", "blockid_ledger_attributes", "identity_attributes"]}'
RESPONSE
200
400
401
500
Success Following ECDSA encrypted object is returned: ``` { custom: localCaas.blockid_session_attributes, // array of strings: ["a1", "a2"] baseline: globalCaas.blockid_session_attributes, // array of strings: ["a3", "a4"] ledger: globalCaas.blockid_ledger_attributes // array of strings ["a5", "a6"], identity: globalCaas.identity_attributes // array of objects [{ "attribute": "a7", "displayName: "A7" }], } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
PUT/config/session_attributes

Set BlockID session attributes Config

Create or update BlockID session attributes Config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing session attributes config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    tenantId: "string required",
    communityId: "string required",
    data: ["string", "string"],
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
dataarray<string>—
PUThttps://pilot-root.1kosmos.net/adminapi/config/session_attributes
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/config/session_attributes' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "data": ["first_name"]}'
RESPONSE
200
400
401
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
POST/user_consent/check

Check User Consent

Check User Consent.

This endpoint can be access by any logged in user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT with wallet

Returns

Returns object with public key and encrypted data containing information whether consent is granted

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

{
    spId: "string - required",
    scopeIds: "array of scope uuid fields - required (at least 1 element)",
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
spIdstring—
scopeIdsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/user_consent/check
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/user_consent/check' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"spId": "xxxxxx", "scopeIds": ["uuid of scope"]}'
RESPONSE
200
400
401
Success publicKey is publicKey of Adminapi API, useful for decryption response data is ECDSA encrypted object represents following: ``` { "nonGrantedScopes": [ { "uuid": "string", "name": "string", "claims": ["string", ...] } ], ... } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

User PIN

User PIN management

POST/user_pin/register

Register user PIN

Register a new PIN for the authenticated user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the status of registered user pin.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
pinstring—
POSThttps://pilot-root.1kosmos.net/adminapi/user_pin/register
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/user_pin/register' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"pin": "string"}'
RESPONSE
200
400
401
405
500
Success
{
  "data": {
    "status": true
  }
}
DELETE/user_pin

Delete user PIN

Delete the PIN for the authenticated user.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns a confirmation message on successful deletion.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
datastring—
DELETEhttps://pilot-root.1kosmos.net/adminapi/user_pin
cURL
Node.js
Python
curl -X DELETE 'https://pilot-root.1kosmos.net/adminapi/user_pin' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "string"}'
RESPONSE
200
401
404
500
Success
{
  "data": {
    "message": "string"
  }
}
Admin API

User Properties

User Properties endpoints.

POST/user_properties/check_unique/alias

Check if the alias provided is unique

Check if the alias provided is unique.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

alias (required)

user : object

Returns

Returns a boolean indicating if alias is unique.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
aliasstring—
POSThttps://pilot-root.1kosmos.net/adminapi/user_properties/check_unique/alias
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/user_properties/check_unique/alias' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"alias": "test-alias"}'
RESPONSE
200
400
401
500
Success
{
  "isUnique": false
}
POST/user_properties/update

Update user properties

Update user properties.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

user (required)

user : object

mobiles (optional, array of strings)

mobiles : array

landlines (optional, array of strings)

landlines : array

aliases (optional, object)

aliases : object

Returns

Returns the user properties.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
userobject—
aliasesobject—
mobilesarray<object>—
landlinesarray<object>—
POSThttps://pilot-root.1kosmos.net/adminapi/user_properties/update
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/user_properties/update' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "user": {"username": "string", "uid": "string", "authModuleId": "string"}, "aliases": {"alias1": "test-alias1", "alias2": "test-alias2", "alias3": "test-alias3", "alias4": "test-alias4", "alias5": "test-alias5", "alias6": "test-alias6", "alias7": "test-alias7", "alias8": "test-alias8"}, "mobiles": ["4075156743"], "landlines": ["4075156743", "4075156712"]}'
RESPONSE
200
400
401
500
Success
{
  "tenantId": "string",
  "communityId": "string",
  "user": {
    "username": "string",
    "uid": "string",
    "authModuleId": "string"
  },
  "aliases": {
    "alias1": "test-alias1",
    "alias2": "test-alias2",
    "alias3": "test-alias3",
    "alias4": "test-alias4",
    "alias5": "test-alias5",
    "alias6": "test-alias6",
    "alias7": "test-alias7",
    "alias8": "test-alias8"
  },
  "mobiles": [
    "4075156743"
  ],
  "landlines": [
    "4075156743",
    "4075156712"
  ]
}
Admin API

Account OTP

Account OTP endpoints.

PUT/generate/account_otp

Create Account OTP

Create Account OTP for user and return cycle time remaining seconds with OTP.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns the Account OTP with cycle time.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
PUThttps://pilot-root.1kosmos.net/adminapi/generate/account_otp
cURL
Node.js
Python
curl -X PUT 'https://pilot-root.1kosmos.net/adminapi/generate/account_otp' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
429
500
Success.<br /><br /> Returns reencrypted response from Adminconsole.
{
  "data": {
    "code": "000001",
    "secondsRemaining": 25
  },
  "publicKey": "xxxxxx"
}
Admin API

Auth Scheme

Auth Scheme endpoints.

PATCH/authscheme/default/modules

Set modules for default auth scheme

Set modules for default auth scheme.

This endpoint must be accessed by community or tenant admin.

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) Bearer JWT

Returns

Returns updated auth scheme

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
modulesarray<string>—
PATCHhttps://pilot-root.1kosmos.net/adminapi/authscheme/default/modules
cURL
Node.js
Python
curl -X PATCH 'https://pilot-root.1kosmos.net/adminapi/authscheme/default/modules' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "modules": ["string"]}'
RESPONSE
200
400
401
404
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "_id": "_id", "tag": "tag", "enabled": true, "isDefault": true, "dbModule": { "_id": "_id", "id": "id", "type": "db", "method": "authn", "name": "Internal User Store", "criteria": "criteria" } "modules": [ { "_id": "_id", "id": "id", "type": "type", "method": "method", "name": "name", "criteria": "criteria" } ] } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Authenticate V 2

Authenticate V 2 endpoints.

POST/v2/request_access

/v2/request_access

Request access with facts

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Returns

Returns the user info, user_token and next. (password)

Or the user info, pon_data and jwt token. (otp)

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key
authorizationstringJWT Access Token / Try Authorize &#128274;
factsstring(encrypted) json object containing "deviceId", "deviceDomain"
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
usernamestring—
web_otpstring—
hw_otpstring—
mobile_totpstring—
any_otpstring—
profile_otpstring—
passwordstring—
uwlSessionIdstring—
SAMLResponsestring—
mobilestring—
landlinestring—
challengeHashstring—
biometricConsentAcceptedboolean—
webauthnAssertionobject—
isPreauthenticatedbooleanEAM flag — true when user arrives via Entra EAM id_token_hint flow
interactionUidstringOIDC interaction UID — used to fetch oid/tid from the server-side interaction record during EAM flow
behavior_authobjectBehavior auth (typing biometrics) data for behavior_auth_and_user_pin journey
user_pinstringUser PIN for behavior_auth_and_user_pin journey (second factor)
POSThttps://pilot-root.1kosmos.net/adminapi/v2/request_access
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/v2/request_access' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'facts: <value>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "username": "string", "web_otp": "string", "mobile_totp": "string", "hw_otp": "string", "any_otp": "string", "profile_otp": "string", "password": "string", "uwlSessionId": "string", "challengeHash": "some string", "SAMLResponse": "string, b64 encoded xml", "isPreauthenticated": true, "interactionUid": "OIDC interaction UID", "behavior_auth": {"pattern": "TypingDNA pattern string", "phrase": "notoriety pink holly puppy", "user_token": "token from previous response"}, "user_pin": "1234"}'
RESPONSE
200
400
401
500
Success
{
  "jwt": "string",
  "next": {
    "step": "need_mfa",
    "allowed_factors": [
      "behavior_auth"
    ],
    "step_token": "string",
    "phrase": "notoriety pink holly puppy"
  }
}
Admin API

Authz V 2

Authz V 2 endpoints.

GET/v2/authz/roles/fetch

Fetch All Roles

Get all available roles for community.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing self registration config for community

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/v2/authz/roles/fetch
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/v2/authz/roles/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success
[
  "role1",
  "role2",
  "role3"
]
Admin API

Caas Config

Caas Config endpoints.

POST/config/fetch

Get Global Caas Config

Get Global Caas Config.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object with public key and encrypted data containing global Caas config

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
  tenantId: "string required",
  communityId: "string required",
  key_paths: ["string required"]
}
FieldTypeDescription
tenantIdstring—
communityIdstring—
key_pathsarray<string>—
POSThttps://pilot-root.1kosmos.net/adminapi/config/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/config/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "key_paths": ["string"]}'
RESPONSE
200
400
401
500
Success
{}
Admin API

Certificate

Certificate endpoints.

POST/certificate/generate

Generate certificate and private key

Generate certificate and private key.

This endpoint must be accessed by admin

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) Bearer JWT

Returns

Returns object with generated certificate and privateKey

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

 {
   "keySize": "number, required",
   "algorithm": "string, required",
   "expirationDays": "number, required"
 }
FieldTypeDescription
keySizenumber—
algorithmstring—
expirationDaysnumber—
POSThttps://pilot-root.1kosmos.net/adminapi/certificate/generate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/certificate/generate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"keySize": 1024, "algorithm": "sha256", "expirationDays": 365}'
RESPONSE
200
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "cert": "cert", "privateKey": "privateKey", "fingerprints": { "sha1": "sha1", "sha256": "sha256", "sha384": "sha384", "sha512": "sha512" }, "keySize": "keySize", "algorithm": "algorithm", "expirationDate": "expirationDate", } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Community Auth Info

Community Auth Info endpoints.

POST/community_auth_info/fetch

/community_auth_info/fetch

Fetch community auth info.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

dns (required)

dns : string

communityName (required)

communityName : string

Returns

Returns the community auth info.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body
FieldTypeDescription
dnsstring—
communityNamestring—
POSThttps://pilot-root.1kosmos.net/adminapi/community_auth_info/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/community_auth_info/fetch' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"dns": "string", "communityName": "string"}'
RESPONSE
200
400
401
500
Success
{
  "community": "object",
  "tenant": "object",
  "authScheme": "object",
  "settings": "object",
  "branding": "object",
  "password_reset_options": "object"
}
Admin API

ECDSA Helper

ECDSA Helper endpoints.

POST/ecdsa_helper/{method}

/ecdsa_helper/{method}

Encrypt and decrypt the data string by public key and private key.

Parameters

method (optional)

The method parameter is type of enum. Default value is encrypt.

This parameter only accepts following values

encrypt, decrypt

Request Body

dataStr (required)

The dataStr key is type of string.

publicKey (required)

The publicKey is type of string.

privateKey (required)

The privateKey is type of string.

Returns

Returns the encrypted/decrypted string.

This API throw an error if something goes wrong. A common source of error is public or private key is not valid.

Path parameters
NameTypeDescription
methodstring—
Request body
FieldTypeDescription
dataStrstring—
publicKeystring—
privateKeystring—
POSThttps://pilot-root.1kosmos.net/adminapi/ecdsa_helper/{method}
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/ecdsa_helper/<method>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"dataStr": "Hey, This is example data string.", "publicKey": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx=", "privateKey": "xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="}'
RESPONSE
200
successful operation
{
  "data": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Hardwareotp

Hardwareotp endpoints.

POST/hardwareotp/onespan/test

Test OneSpan Connection

Test OneSpan server Connection.

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Returns object with branding colors and images

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try to Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try to Authorize &#128274;
Request body

Request should contain *publicKey* field with caller's public key

Request body contains *data* field with encrypted object below:

{
  "user_name": "string (required)",
  "otp": "number (required)",
}

IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
user_namestring—
otpnumber—
POSThttps://pilot-root.1kosmos.net/adminapi/hardwareotp/onespan/test
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/hardwareotp/onespan/test' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"user_name": "XYZ", "otp": "123456"}'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: IMPORTANT - you can send unencrypted data, and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "code": "200",
  "message": "Success."
}
Admin API

Helpdesk

Helpdesk endpoints.

POST/helpdesk-passcode/generate

Generate Helpdesk Passcode

Generate a one-time passcode for a user on behalf of helpdesk admin.

This endpoint allows administrators with appropriate permissions to generate temporary passcodes for users who need assistance accessing their accounts.

The passcode is returned encrypted and is not sent to the user via email/SMS. The admin provides the passcode to the user through other means (phone, in-person, etc.).

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds

publickey (required)

Public key for ECDSA encryption

authorization (required)

Bearer JWT token with 'user.helpdesk-passcode.generate' permission

Request Body

userId (required)

User identifier (email or username) : string

communityId (required)

Community ID (MongoDB ObjectId) : string

tenantId (required)

Tenant ID (MongoDB ObjectId) : string

validitySeconds (required)

Passcode validity period in seconds (60-86400) : number

serviceName (required)

Service name (must be "1KosmosHelpdeskAdminCode") : string

Returns

Returns encrypted passcode with expiration details.

The response includes the generated passcode, validity period, and expiration timestamp.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringBearer JWT token / Try Authorize &#128274;
Request body
FieldTypeDescription
datarequiredstringECDSA encrypted request data
POSThttps://pilot-root.1kosmos.net/adminapi/helpdesk-passcode/generate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/helpdesk-passcode/generate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"data": "encrypted_string_here"}'
RESPONSE
200
400
401
403
429
500
Success.<br /><br /> Returns encrypted passcode response.
{
  "data": "string",
  "publicKey": "string"
}
Admin API

Image

Image endpoints.

POST/image/upload

Upload Image

Upload Image

This endpoint must be accessed by an administrator

Headers

### requestid (required) JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

### publickey (required) Public key

### authorization (required) JWT

Returns

Returns object with url of the image

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
POSThttps://pilot-root.1kosmos.net/adminapi/image/upload
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/image/upload' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
400
401
500
Success The publicKey of WebServer API used in decrypting Response body contains *data* field with encrypted object below: ``` { "url": "image url - string", } ``` IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger
{
  "url": "xxxxxxxxxx"
}
Admin API

JWT

JWT endpoints.

POST/jwt/verifyToken

/jwt/verifyToken

Verify JWT token Anybody can use this endpoint This endpoint also checks if user has active login session, if user exists, is not disabled and is active, otherwise it destroys all user login sessions

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Request Body

token (required)

token : string

Returns

Returns a decoded token value.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
Request body

Request body contains 'data' field with encrypted object below:

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

{
    token: "string required"
}
FieldTypeDescription
tokenstring—
POSThttps://pilot-root.1kosmos.net/adminapi/jwt/verifyToken
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/jwt/verifyToken' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"token": "xxxx"}'
RESPONSE
200
401
{
  "data": "object",
  "publicKey": "string"
}
Admin API

Password Policy

Password Policy endpoints.

POST/pwd-policy/fetch

Get password policy by moduleId.

Get password policy by moduleId.

  • Any license.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Returns

Password policy rules with descriptions.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "tenantId": "required string",
  "communityId": "required string",
  "moduleId": "required string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/pwd-policy/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/pwd-policy/fetch' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "moduleId": "string"}'
RESPONSE
200
400
404
Success data is ECDSA encrypted object returns rules and descriptions: ``` { "rules": { "min": N, "special": true, "number": true, "noUsername": false, "noSpaces": true, "allowInRow": N }, "descriptions": [ "xxxxx xxxx xxxxx N xxxxxxx" ] } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Permission

Permission endpoints.

POST/permission/fetch

Fetch permissions.

Fetch permissions.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

moduleId (required)

moduleId : string

uid (required)

uid : string

Returns

Returns the list of permissions.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 60 seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
uidstring—
POSThttps://pilot-root.1kosmos.net/adminapi/permission/fetch
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/permission/fetch' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxx", "communityId": "xxxxx", "moduleId": "xxxxx", "uid": "xxxxx"}'
RESPONSE
200
400
401
500
Success
[
  {
    "_id": "xxxxx",
    "permission": "xxxxx",
    "objectId": "xxxxx",
    "objectType": "user",
    "subjectId": "xxxxx",
    "subjectType": "xxxxx",
    "createdBy": "xxxxx"
  }
]
Admin API

Public Key

Public Key endpoints.

GET/publickeys

/publickeys

Returns ecdsa public key for this service.

Returns

Returns a public key object

GEThttps://pilot-root.1kosmos.net/adminapi/publickeys
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/publickeys' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
401
{
  "publicKey": ""
}
Admin API

SAML

SAML endpoints.

POST/saml/samlRequest/generate

/saml/samlRequest/generate

Generate SAML Request.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Request Body

SAMLRequest (required)

SAMLRequest

Returns

Returns information to perform SAML SSO.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
idpIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/saml/samlRequest/generate
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/saml/samlRequest/generate' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "5f3d8d0cd866fa61019cf968", "communityId": "5f3d8d0cd866fa61019cf969", "idpId": "65c4ec704fc64768749ee0b3"}'
RESPONSE
200
400
401
420
500
Success
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Service Directory

Service Directory endpoints.

GET/sd

Get all service directories.

Get all service directories.

Returns

Returns all service directories.

GEThttps://pilot-root.1kosmos.net/adminapi/sd
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/sd' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'x-jwt-token: YOUR_JWT' \
  -H 'license: YOUR_LICENSE_KEY'
RESPONSE
200
{
  "name1": "https://xxx.xxxxxx.xxx/xxxxx",
  "name2": "https://xxx.xxxxxx.xxx/xxxxx",
  "name3": "https://xxx.xxxxxx.xxx/xxxxx"
}
Admin API

Service Provider Catalog

Service Provider Catalog endpoints.

GET/spcatalog/list

get list of Service Provider Catalog item

Get Service Provider Catalog item.

This endpoint must be accessed by an administrator.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

authorization (required)

JWT

Returns

Returns object represents list of service providers catalog items

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
publickeyrequiredstringPublic Key / Try Authorize &#128274;
authorizationrequiredstringJWT Access Token / Try Authorize &#128274;
GEThttps://pilot-root.1kosmos.net/adminapi/spcatalog/list
cURL
Node.js
Python
curl -X GET 'https://pilot-root.1kosmos.net/adminapi/spcatalog/list' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'authorization: Bearer YOUR_TOKEN' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN'
RESPONSE
200
401
404
Response body contains 'data' field with encrypted object below: ``` { "spCatalogItemOne": { name: "name", logo: "logo", sso_url: "sso_url", template: "template" }, "spCatalogItemTwo": { name: "name", logo: "logo", sso_url: "sso_url", template: "template" } } ```
{
  "data": "xxxxxxxxxxxxxxxxxxxx",
  "publicKey": "xxxxxxxxxxxxxxxxxxxx"
}
Admin API

Sign nonce

API for signing nonce

POST/nonce/sign

Sign a nonce

Sign a nonce sent by the UI.

<b>:: Note for website ::</b>

+ Default request body is {data: ecdsa_string}

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

licensekey (optional)

License key auth-type is a service/system, encrypted using ECDSA

Request Body

tenantId (required)

tenantId : string

communityId (required)

communityId : string

nonce (required)

nonce : string

Returns

Returns a singed nonce value.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
requestidrequiredstringJSON string encrypted with ECDSA containing "appid", "uuid", and "ts" (epoch timestamp in seconds).
publickeyrequiredstringPublic Key
Request body
FieldTypeDescription
tenantIdstring—
communityIdstring—
noncestring—
POSThttps://pilot-root.1kosmos.net/adminapi/nonce/sign
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/nonce/sign' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'publickey: <public-key>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "string", "communityId": "string", "nonce": "string"}'
RESPONSE
200
400
401
500
Successfully signed nonce
{
  "signed_nonce": "string"
}
Admin API

Test Connection

Test Connection endpoints.

POST/test-connection

Test auth module connection by moduleId.

test auth module.

  • Key must be authorized for community.

Headers

requestid (required)

JSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now

publickey (required)

Public key

Returns

Test Connection rules with descriptions.

This API throw an error if something goes wrong.

Headers
NameTypeDescription
licensekeyrequiredstringLicense key encrypted with ECDSA / Try Authorize &#128274;
requestidrequiredstringJSON string encrypted with ECDSA which should contain "appid" (string), "uuid" (string) and "ts" (number) representing epoch timestamp in seconds - it shouldn't be more or less than 'environment.allowed_time_span' seconds from now / Try Authorize &#128274;
Request body

Request body contains *data* field with encrypted object below:

{
  "tenantId": "required string",
  "communityId": "required string",
  "moduleId": "required string"
}

IMPORTANT - you can send unencrypted data and you will get unecrypted data as well, it is only a preview available in Swagger

FieldTypeDescription
tenantIdstring—
communityIdstring—
moduleIdstring—
POSThttps://pilot-root.1kosmos.net/adminapi/test-connection
cURL
Node.js
Python
curl -X POST 'https://pilot-root.1kosmos.net/adminapi/test-connection' \
  -H 'licensekey: YOUR_LICENSE_KEY' \
  -H 'requestid: <ecdsa-requestid>' \
  -H 'keyId: YOUR_KEY_ID' \
  -H 'keySecret: YOUR_KEY_SECRET' \
  -H 'license: YOUR_LICENSE_KEY' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"tenantId": "xxxxxxxxxxxxxxxxxxxxxxxx", "communityId": "xxxxxxxxxxxxxxxxxxxxxxxx", "moduleId": "xxxxxxxxxxxxxxxxxxxxxxxx"}'
RESPONSE
200
400
401
Success publicKey is publicKey of User Management API, useful for decryption response data is ECDSA encrypted object represents updated auth module: ``` { "_id": "ObjectID", "communityId": "ObjectID", "type": "db", // ad | ldap | db | azuread "subtype": "datastore", // for ad | ldap | azuread: "directory", for db: "datastore" "method": "authn", // for ad | ldap | db | azuread : "authn" "name": "Auth Module Name", "enabled": true, "mode": "broker/direct", "status": true, "message": "connection success/failed", "config": {} // see below config response samples } ``` config object for type **azuread**: ``` { "appName": "string", "tenantId": "string", "tenantName": "string", "clientId": "string", "clientSecret": "string", "loginBasePath": "string", "graphApiBasePath": "string" } ```
{
  "data": "xxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx="
}
© 2026 1Kosmos · Web Admin Backend services v2.1Generated from the OpenAPI spec · adminapi.json