Import Data
Import data on an instance level to ZITADEL. It can be either directly in the request or you can point to a file on an S3 storage, from which the data should be loaded.
- application/json
- application/grpc
- application/grpc-web+proto
Request Body required
dataOrgs object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersdomainPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
validateOrgDomains booleandefines if organization domains should be validated org count as validated automatically
smtpSenderAddressMatchesInstanceDomain booleandefines if the SMTP sender address domain should match an existing domain on the instance
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsv1 object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersiamPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType stringPossible values: [
FLOW_TYPE_UNSPECIFIED,FLOW_TYPE_EXTERNAL_AUTHENTICATION]Default value:
FLOW_TYPE_UNSPECIFIEDtriggerType stringPossible values: [
TRIGGER_TYPE_UNSPECIFIED,TRIGGER_TYPE_POST_AUTHENTICATION,TRIGGER_TYPE_PRE_CREATION,TRIGGER_TYPE_POST_CREATION]Default value:
TRIGGER_TYPE_UNSPECIFIEDactionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]secondFactors object[]
Array [type stringPossible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]Default value:
SECOND_FACTOR_TYPE_UNSPECIFIED]multiFactors object[]
Array [type stringPossible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]Default value:
MULTI_FACTOR_TYPE_UNSPECIFIED]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsLocal object
path stringdataOrgsv1Local object
path stringdataOrgsS3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsv1S3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsGcs object
bucket stringserviceaccountJson stringpath stringdataOrgsv1Gcs object
bucket stringserviceaccountJson stringpath string- timeout string
Request Body required
dataOrgs object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersdomainPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
validateOrgDomains booleandefines if organization domains should be validated org count as validated automatically
smtpSenderAddressMatchesInstanceDomain booleandefines if the SMTP sender address domain should match an existing domain on the instance
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsv1 object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersiamPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType stringPossible values: [
FLOW_TYPE_UNSPECIFIED,FLOW_TYPE_EXTERNAL_AUTHENTICATION]Default value:
FLOW_TYPE_UNSPECIFIEDtriggerType stringPossible values: [
TRIGGER_TYPE_UNSPECIFIED,TRIGGER_TYPE_POST_AUTHENTICATION,TRIGGER_TYPE_PRE_CREATION,TRIGGER_TYPE_POST_CREATION]Default value:
TRIGGER_TYPE_UNSPECIFIEDactionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]secondFactors object[]
Array [type stringPossible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]Default value:
SECOND_FACTOR_TYPE_UNSPECIFIED]multiFactors object[]
Array [type stringPossible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]Default value:
MULTI_FACTOR_TYPE_UNSPECIFIED]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsLocal object
path stringdataOrgsv1Local object
path stringdataOrgsS3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsv1S3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsGcs object
bucket stringserviceaccountJson stringpath stringdataOrgsv1Gcs object
bucket stringserviceaccountJson stringpath string- timeout string
Request Body required
dataOrgs object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersdomainPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
validateOrgDomains booleandefines if organization domains should be validated org count as validated automatically
smtpSenderAddressMatchesInstanceDomain booleandefines if the SMTP sender address domain should match an existing domain on the instance
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsv1 object
orgs object[]
Array [orgId stringorg object
name string requiredPossible values:
non-emptyand<= 200 charactersiamPolicy object
orgId string requiredPossible values:
non-emptyand<= 200 charactersuserLoginMustBeDomain the username has to end with the domain of its organization (uniqueness is organization based)the username has to end with the domain of its organization
labelPolicy object
primaryColor stringPossible values:
<= 50 charactersRepresents a color scheme
hideLoginNameSuffix hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is sethides the org suffix on the login form if the scope "urn:zitadel:iam:org:domain:primary:{domainname}" is set
warnColor stringPossible values:
<= 50 charactershex value for warn color
backgroundColor stringPossible values:
<= 50 charactershex value for background color
fontColor stringPossible values:
<= 50 charactershex value for font color
primaryColorDark stringPossible values:
<= 50 charactershex value for the primary color dark theme
backgroundColorDark stringPossible values:
<= 50 charactershex value for background color dark theme
warnColorDark stringPossible values:
<= 50 charactershex value for warning color dark theme
fontColorDark stringPossible values:
<= 50 charactershex value for font color dark theme
disableWatermark booleanlockoutPolicy object
maxPasswordAttempts int64When the user has reached the maximum password attempts the account will be locked, If this is set to 0 the lockout will not trigger.
loginPolicy object
allowUsernamePassword booleanallowRegister booleanallowExternalIdp booleanforceMfa booleanpasswordlessType - PASSWORDLESS_TYPE_ALLOWED: PLANNED: PASSWORDLESS_TYPE_WITH_CERTPossible values: [
PASSWORDLESS_TYPE_NOT_ALLOWED,PASSWORDLESS_TYPE_ALLOWED]Default value:
PASSWORDLESS_TYPE_NOT_ALLOWEDhidePasswordReset booleanignoreUnknownUsernames booleandefines if unknown username on login screen directly returns an error or always displays the password screen
defaultRedirectUri stringdefines where the user will be redirected to if the login is started without app context (e.g. from mail)
passwordCheckLifetime stringexternalLoginCheckLifetime stringmfaInitSkipLifetime stringsecondFactorCheckLifetime stringmultiFactorCheckLifetime stringsecondFactors string[]Possible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]multiFactors string[]Possible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]allowDomainDiscovery booleanIf set to true, the suffix (@domain.com) of an unknown username input on the login screen will be matched against the org domains and will redirect to the registration of that organization on success.
disableLoginWithEmail booleandefines if the user can additionally (to the login name) be identified by their verified email address
disableLoginWithPhone booleandefines if the user can additionally (to the login name) be identified by their verified phone number
passwordComplexityPolicy object
minLength uint64hasUppercase booleanDefines if the password MUST contain an upper case letter
hasLowercase booleanDefines if the password MUST contain a lowercase letter
hasNumber booleanDefines if the password MUST contain a number
hasSymbol booleanDefines if the password MUST contain a symbol. E.g. "$"
privacyPolicy object
tosLink stringIf registration is enabled, the user has to accept the TOS. Variable {{.Lang}} can be set to have different links based on the language.
privacyLink stringIf registration is enabled, the user has to accept the privacy terms. Variable {{.Lang}} can be set to have different links based on the language.
helpLink stringVariable {{.Lang}} can be set to have different links based on the language.
supportEmail stringhelp / support email address.
projects object[]
Array [projectId stringproject object
name string requiredPossible values:
non-emptyand<= 200 charactersprojectRoleAssertion booleanEnable this setting to have role information included in the user info endpoint. It is also dependent on your application settings to include it in tokens and other types.
projectRoleCheck booleanWhen enabled ZITADEL will check if a user has a role of this project assigned when login into an application of this project.
hasProjectCheck booleanWhen enabled ZITADEL will check if the organization of the user, that is trying to log in, has a grant to this project.
privateLabelingSetting stringPossible values: [
PRIVATE_LABELING_SETTING_UNSPECIFIED,PRIVATE_LABELING_SETTING_ENFORCE_PROJECT_RESOURCE_OWNER_POLICY,PRIVATE_LABELING_SETTING_ALLOW_LOGIN_USER_RESOURCE_OWNER_POLICY]Default value:
PRIVATE_LABELING_SETTING_UNSPECIFIEDDefine which private labeling/branding should trigger when getting to a login of this project.
]projectRoles object[]
Array [projectId stringroleKey string requiredPossible values:
non-emptyand<= 200 charactersThe key is the only relevant attribute for ZITADEL regarding the authorization checks.
displayName string requiredPossible values:
non-emptyand<= 200 charactersgroup stringPossible values:
<= 200 charactersThe group is only used for display purposes. That you have better handling, like giving all the roles from a group to a user.
]apiApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersauthMethodType stringPossible values: [
API_AUTH_METHOD_TYPE_BASIC,API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
API_AUTH_METHOD_TYPE_BASIC]oidcApps object[]
Array [appId stringapp object
projectId stringname string requiredPossible values:
non-emptyand<= 200 charactersredirectUris string[]Callback URI of the authorization request where the code or tokens will be sent to
responseTypes string[]Possible values: [
OIDC_RESPONSE_TYPE_CODE,OIDC_RESPONSE_TYPE_ID_TOKEN,OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN]Determines whether a code, id_token token or just id_token will be returned
grantTypes string[]Possible values: [
OIDC_GRANT_TYPE_AUTHORIZATION_CODE,OIDC_GRANT_TYPE_IMPLICIT,OIDC_GRANT_TYPE_REFRESH_TOKEN,OIDC_GRANT_TYPE_DEVICE_CODE]The flow type the application uses to gain access
appType stringPossible values: [
OIDC_APP_TYPE_WEB,OIDC_APP_TYPE_USER_AGENT,OIDC_APP_TYPE_NATIVE]Default value:
OIDC_APP_TYPE_WEBDetermines the paradigm of the application
authMethodType stringPossible values: [
OIDC_AUTH_METHOD_TYPE_BASIC,OIDC_AUTH_METHOD_TYPE_POST,OIDC_AUTH_METHOD_TYPE_NONE,OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT]Default value:
OIDC_AUTH_METHOD_TYPE_BASICDefines how the application passes login credentials
postLogoutRedirectUris string[]ZITADEL will redirect to this link after a successful logout
version stringPossible values: [
OIDC_VERSION_1_0]Default value:
OIDC_VERSION_1_0devMode booleanUsed for development, some checks of the OIDC specification will not be checked.
accessTokenType stringPossible values: [
OIDC_TOKEN_TYPE_BEARER,OIDC_TOKEN_TYPE_JWT]Default value:
OIDC_TOKEN_TYPE_BEARERType of the access token returned from ZITADEL
accessTokenRoleAssertion booleanAdds roles to the claims of the access token (only if type == JWT) even if they are not requested by scopes
idTokenRoleAssertion booleanAdds roles to the claims of the id token even if they are not requested by scopes
idTokenUserinfoAssertion booleanClaims of profile, email, address and phone scopes are added to the id token even if an access token is issued. Attention this violates the OIDC specification
clockSkew stringUsed to compensate time difference of servers. Duration added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims
additionalOrigins string[]Additional origins (other than the redirect_uris) from where the API can be used
skipNativeAppSuccessPage booleanSkip the successful login page on native apps and directly redirect the user to the callback.
]humanUsers object[]
Array [userId stringuser object
userName string requiredprofile object required
Profile includes the basic information of a user, like first name, last name, etc.
firstName string requiredPossible values:
non-emptyand<= 200 characterslastName string requiredPossible values:
non-emptyand<= 200 charactersnickName stringPossible values:
<= 200 charactersdisplayName stringPossible values:
<= 200 characterspreferredLanguage stringPossible values:
<= 10 charactersgender stringPossible values: [
GENDER_UNSPECIFIED,GENDER_FEMALE,GENDER_MALE,GENDER_DIVERSE]Default value:
GENDER_UNSPECIFIEDemail object required
email string requiredObject that contains the email address and a verified flag.
isEmailVerified booleanIf email verified is set to true, the email will be added as verified and the user doesn't have to verify.
phone object
Object that contains the number and a verified flag
phone stringPossible values:
non-emptyand<= 50 charactersmobile phone number of the user. (use global pattern of spec https://tools.ietf.org/html/rfc3966)
isPhoneVerified booleanpassword stringhashedPassword object
Use this to import hashed passwords from another system.
value stringalgorithm stringpasswordChangeRequired booleanIf this is set to true, the user has to change the password on the next login.
requestPasswordlessRegistration booleanIf this is set to true, you will get a link for the passwordless/passkey registration in the response.
otpCode stringidps object[]
To link your user directly with an external identity provider (Identity brokering)
Array [configId stringPossible values:
non-emptyand<= 200 charactersThe internal ID of the identity provider configured in ZITADEL.
externalUserId stringPossible values:
non-emptyand<= 200 charactersThe id of the user in the external identity provider
displayName stringPossible values:
<= 200 charactersA display name ZITADEL can show on the linked provider.
]]machineUsers object[]
Array [userId stringuser object
userName string requiredPossible values:
non-emptyand<= 200 charactersname string requiredPossible values:
non-emptyand<= 200 charactersdescription stringPossible values:
<= 500 charactersaccessTokenType stringPossible values: [
ACCESS_TOKEN_TYPE_BEARER,ACCESS_TOKEN_TYPE_JWT]Default value:
ACCESS_TOKEN_TYPE_BEARER]triggerActions object[]
Array [flowType stringPossible values: [
FLOW_TYPE_UNSPECIFIED,FLOW_TYPE_EXTERNAL_AUTHENTICATION]Default value:
FLOW_TYPE_UNSPECIFIEDtriggerType stringPossible values: [
TRIGGER_TYPE_UNSPECIFIED,TRIGGER_TYPE_POST_AUTHENTICATION,TRIGGER_TYPE_PRE_CREATION,TRIGGER_TYPE_POST_CREATION]Default value:
TRIGGER_TYPE_UNSPECIFIEDactionIds string[]]actions object[]
Array [actionId stringaction object
name string requiredPossible values:
non-emptyand<= 200 charactersscript string requiredPossible values:
non-emptyand<= 2000 charactersJavascript code that should be executed
timeout stringafter which time the action will be terminated if not finished
allowedToFail booleanwhen true, the next action will be called even if this action fails
]projectGrants object[]
Array [grantId stringprojectGrant object
projectId stringgrantedOrgId stringroleKeys string[]]userGrants object[]
Array [userId string requiredPossible values:
non-emptyprojectId string requiredPossible values:
non-emptyand<= 200 charactersprojectGrantId stringPossible values:
<= 200 charactersMake sure to fill in the project grant id if the user grant is for a granted project and the organization is not the owner of the project.
roleKeys string[]]orgMembers object[]
Array [userId stringroles string[]If no roles are provided the user won't have any rights
]projectMembers object[]
Array [projectId stringuserId stringroles string[]If no roles are provided the user won't have any rights
]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string requiredPossible values:
non-emptyand<= 200 charactersroles string[]If no roles are provided the user won't have any rights
]userMetadata object[]
Array [id stringPossible values:
non-emptyand<= 200 characterskey stringPossible values:
non-emptyand<= 200 charactersvalue bytePossible values:
non-emptyand<= 500000 charactersThe value has to be base64 encoded.
]loginTexts object[]
Array [language stringselectAccountText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringotherUser stringsessionStateActive stringsessionStateInactive stringuserMustBeMemberOfOrg stringloginText object
title stringdescription stringtitleLinkingProcess stringdescriptionLinkingProcess stringuserMustBeMemberOfOrg stringloginNameLabel stringregisterButtonText stringnextButtonText stringexternalUserDescription stringuserNamePlaceholder stringloginNamePlaceholder stringpasswordText object
title stringdescription stringpasswordLabel stringresetLinkText stringbackButtonText stringnextButtonText stringminLength stringhasUppercase stringhasLowercase stringhasNumber stringhasSymbol stringconfirmation stringusernameChangeText object
title stringdescription stringusernameLabel stringcancelButtonText stringnextButtonText stringusernameChangeDoneText object
title stringdescription stringnextButtonText stringinitPasswordText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringnextButtonText stringresendButtonText stringinitPasswordDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringemailVerificationText object
title stringdescription stringcodeLabel stringnextButtonText stringresendButtonText stringemailVerificationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringloginButtonText stringinitializeUserText object
title stringdescription stringcodeLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringresendButtonText stringnextButtonText stringinitializeDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringinitMfaPromptText object
title stringdescription stringotpOption stringu2fOption stringskipButtonText stringnextButtonText stringinitMfaOtpText object
title stringdescription stringdescriptionOtp stringsecretLabel stringcodeLabel stringnextButtonText stringcancelButtonText stringinitMfaU2fText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringinitMfaDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringmfaProvidersText object
chooseOther stringotp stringu2f stringverifyMfaOtpText object
title stringdescription stringcodeLabel stringnextButtonText stringverifyMfaU2fText object
title stringdescription stringvalidateTokenText stringnotSupported stringerrorRetry stringpasswordlessText object
title stringdescription stringloginWithPwButtonText stringvalidateTokenButtonText stringnotSupported stringerrorRetry stringpasswordChangeText object
title stringdescription stringoldPasswordLabel stringnewPasswordLabel stringnewPasswordConfirmLabel stringcancelButtonText stringnextButtonText stringpasswordChangeDoneText object
title stringdescription stringnextButtonText stringpasswordResetDoneText object
title stringdescription stringnextButtonText stringregistrationOptionText object
title stringdescription stringuserNameButtonText stringexternalLoginDescription stringloginButtonText stringregistrationUserText object
title stringdescription stringdescriptionOrgRegister stringfirstnameLabel stringlastnameLabel stringemailLabel stringusernameLabel stringlanguageLabel stringgenderLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringnextButtonText stringbackButtonText stringregistrationOrgText object
title stringdescription stringorgnameLabel stringfirstnameLabel stringlastnameLabel stringusernameLabel stringemailLabel stringpasswordLabel stringpasswordConfirmLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyConfirm stringprivacyLinkText stringsaveButtonText stringlinkingUserDoneText object
title stringdescription stringcancelButtonText stringnextButtonText stringexternalUserNotFoundText object
title stringdescription stringlinkButtonText stringautoRegisterButtonText stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringprivacyConfirm stringsuccessLoginText object
title stringautoRedirectDescription Text to describe that auto-redirect should happen after successful loginredirectedDescription Text to describe that the window can be closed after redirectnextButtonText stringlogoutText object
title stringdescription stringloginButtonText stringfooterText object
tos stringprivacyPolicy stringhelp stringsupportEmail stringpasswordlessPromptText object
title stringdescription stringdescriptionInit stringpasswordlessButtonText stringnextButtonText stringskipButtonText stringpasswordlessRegistrationText object
title stringdescription stringtokenNameLabel stringnotSupported stringregisterTokenButtonText stringerrorRetry stringpasswordlessRegistrationDoneText object
title stringdescription stringnextButtonText stringcancelButtonText stringdescriptionClose stringexternalRegistrationUserOverviewText object
title stringdescription stringemailLabel stringusernameLabel stringfirstnameLabel stringlastnameLabel stringnicknameLabel stringlanguageLabel stringphoneLabel stringtosAndPrivacyLabel stringtosConfirm stringtosLinkText stringprivacyLinkText stringbackButtonText stringnextButtonText stringprivacyConfirm string]initMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordResetMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyEmailMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]verifyPhoneMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]domainClaimedMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]passwordlessRegistrationMessages object[]
Array [language stringtitle stringPossible values:
<= 200 characterspreHeader stringPossible values:
<= 200 characterssubject stringPossible values:
<= 200 charactersgreeting stringPossible values:
<= 200 characterstext stringPossible values:
<= 800 charactersbuttonText stringPossible values:
<= 200 charactersfooterText string]oidcIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
clientId string requiredPossible values:
non-emptyand<= 200 charactersclient id generated by the identity provider
clientSecret string requiredPossible values:
non-emptyand<= 200 charactersclient secret generated by the identity provider
issuer string requiredthe OIDC issuer of the identity provider
scopes string[]the scopes requested by ZITADEL during the request on the identity provider
displayNameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the display name of the user
usernameMapping stringPossible values: [
OIDC_MAPPING_FIELD_UNSPECIFIED,OIDC_MAPPING_FIELD_PREFERRED_USERNAME,OIDC_MAPPING_FIELD_EMAIL]Default value:
OIDC_MAPPING_FIELD_UNSPECIFIEDdefinition which field is mapped to the email of the user
autoRegister boolean]jwtIdps object[]
Array [idpId stringidp object
name string requiredPossible values:
non-emptyand<= 200 charactersstylingType stringPossible values: [
STYLING_TYPE_UNSPECIFIED,STYLING_TYPE_GOOGLE]Default value:
STYLING_TYPE_UNSPECIFIEDsome identity providers specify the styling of the button to their login
jwtEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint where the JWT can be extracted
issuer string requiredPossible values:
non-emptyand<= 200 charactersthe issuer of the JWT (for validation)
keysEndpoint string requiredPossible values:
non-emptyand<= 200 charactersthe endpoint to the key (JWK) which is used to sign the JWT with
headerName string requiredPossible values:
non-emptyand<= 200 charactersthe name of the header where the JWT is sent in, default is authorization
autoRegister boolean]secondFactors object[]
Array [type stringPossible values: [
SECOND_FACTOR_TYPE_UNSPECIFIED,SECOND_FACTOR_TYPE_OTP,SECOND_FACTOR_TYPE_U2F]Default value:
SECOND_FACTOR_TYPE_UNSPECIFIED]multiFactors object[]
Array [type stringPossible values: [
MULTI_FACTOR_TYPE_UNSPECIFIED,MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION]Default value:
MULTI_FACTOR_TYPE_UNSPECIFIED]idps object[]
Array [idpId stringownerType stringPossible values: [
IDP_OWNER_TYPE_UNSPECIFIED,IDP_OWNER_TYPE_SYSTEM,IDP_OWNER_TYPE_ORG]Default value:
IDP_OWNER_TYPE_UNSPECIFIEDthe owner of the identity provider.
- IDP_OWNER_TYPE_SYSTEM: system is managed by the ZITADEL administrators
- IDP_OWNER_TYPE_ORG: org is managed by de organization administrators
]userLinks object[]
Array [userId stringthe id of the user
idpId stringthe id of the identity provider
idpName stringthe name of the identity provider
providedUserId stringthe id of the user provided by the identity provider
providedUserName stringthe id of the identity provider
idpType authorization framework of the identity providerPossible values: [
IDP_TYPE_UNSPECIFIED,IDP_TYPE_OIDC,IDP_TYPE_JWT]Default value:
IDP_TYPE_UNSPECIFIEDthe authorization framework of the identity provider
]domains object[]
Array [orgId stringdetails object
sequence uint64on read: the sequence of the last event reduced by the projection
on manipulation: the timestamp of the event(s) added by the manipulation
creationDate date-timeon read: the timestamp of the first event of the object
on create: the timestamp of the event(s) added by the manipulation
changeDate date-timeon read: the timestamp of the last event reduced by the projection
on manipulation: the
resourceOwner resource_owner is the organization an object belongs todomainName stringisVerified booleandefines if the domain is verified
isPrimary booleandefines if the domain is the primary domain
validationType stringPossible values: [
DOMAIN_VALIDATION_TYPE_UNSPECIFIED,DOMAIN_VALIDATION_TYPE_HTTP,DOMAIN_VALIDATION_TYPE_DNS]Default value:
DOMAIN_VALIDATION_TYPE_UNSPECIFIEDdefines the protocol the domain was validated with
]appKeys object[]
Array [id stringprojectId stringappId stringclientId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]machineKeys object[]
Array [keyId stringuserId stringtype stringPossible values: [
KEY_TYPE_UNSPECIFIED,KEY_TYPE_JSON]Default value:
KEY_TYPE_UNSPECIFIEDexpirationDate date-timepublicKey byte]]dataOrgsLocal object
path stringdataOrgsv1Local object
path stringdataOrgsS3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsv1S3 object
path stringendpoint stringaccessKeyId stringsecretAccessKey stringssl booleanbucket stringdataOrgsGcs object
bucket stringserviceaccountJson stringpath stringdataOrgsv1Gcs object
bucket stringserviceaccountJson stringpath string- timeout string
- 200
- 403
- 404
- default
A successful response.
- application/json
- application/grpc
- application/grpc-web+proto
- Schema
- Example (from schema)
Schema
errors object[]
Array [type stringid stringmessage string]success object
orgs object[]
Array [orgId stringprojectIds string[]projectRoles string[]oidcAppIds string[]apiAppIds string[]humanUserIds string[]machineUserIds string[]actionIds string[]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]projectGrants object[]
Array [grantId stringprojectId stringorgId string]userGrants object[]
Array [projectId stringuserId string]orgMembers string[]projectMembers object[]
Array [projectId stringuserId string]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string]oidcIpds string[]jwtIdps string[]idpLinks string[]userLinks object[]
Array [userId stringexternalUserId stringdisplayName stringidpId string]userMetadata object[]
Array [userId stringkey string]domains string[]appKeys string[]machineKeys string[]]
{
"errors": [
{
"type": "string",
"id": "string",
"message": "string"
}
],
"success": {
"orgs": [
{
"orgId": "string",
"projectIds": [
"string"
],
"projectRoles": [
"string"
],
"oidcAppIds": [
"string"
],
"apiAppIds": [
"string"
],
"humanUserIds": [
"string"
],
"machineUserIds": [
"string"
],
"actionIds": [
"string"
],
"triggerActions": [
{
"flowType": "1",
"triggerType": "1",
"actionIds": [
"string"
]
}
],
"projectGrants": [
{
"grantId": "string",
"projectId": "string",
"orgId": "string"
}
],
"userGrants": [
{
"projectId": "string",
"userId": "string"
}
],
"orgMembers": [
"string"
],
"projectMembers": [
{
"projectId": "string",
"userId": "string"
}
],
"projectGrantMembers": [
{
"projectId": "string",
"grantId": "string",
"userId": "string"
}
],
"oidcIpds": [
"string"
],
"jwtIdps": [
"string"
],
"idpLinks": [
"string"
],
"userLinks": [
{
"userId": "string",
"externalUserId": "string",
"displayName": "string",
"idpId": "string"
}
],
"userMetadata": [
{
"userId": "string",
"key": "string"
}
],
"domains": [
"string"
],
"appKeys": [
"string"
],
"machineKeys": [
"string"
]
}
]
}
}
- Schema
- Example (from schema)
Schema
errors object[]
Array [type stringid stringmessage string]success object
orgs object[]
Array [orgId stringprojectIds string[]projectRoles string[]oidcAppIds string[]apiAppIds string[]humanUserIds string[]machineUserIds string[]actionIds string[]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]projectGrants object[]
Array [grantId stringprojectId stringorgId string]userGrants object[]
Array [projectId stringuserId string]orgMembers string[]projectMembers object[]
Array [projectId stringuserId string]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string]oidcIpds string[]jwtIdps string[]idpLinks string[]userLinks object[]
Array [userId stringexternalUserId stringdisplayName stringidpId string]userMetadata object[]
Array [userId stringkey string]domains string[]appKeys string[]machineKeys string[]]
{
"errors": [
{
"type": "string",
"id": "string",
"message": "string"
}
],
"success": {
"orgs": [
{
"orgId": "string",
"projectIds": [
"string"
],
"projectRoles": [
"string"
],
"oidcAppIds": [
"string"
],
"apiAppIds": [
"string"
],
"humanUserIds": [
"string"
],
"machineUserIds": [
"string"
],
"actionIds": [
"string"
],
"triggerActions": [
{
"flowType": "1",
"triggerType": "1",
"actionIds": [
"string"
]
}
],
"projectGrants": [
{
"grantId": "string",
"projectId": "string",
"orgId": "string"
}
],
"userGrants": [
{
"projectId": "string",
"userId": "string"
}
],
"orgMembers": [
"string"
],
"projectMembers": [
{
"projectId": "string",
"userId": "string"
}
],
"projectGrantMembers": [
{
"projectId": "string",
"grantId": "string",
"userId": "string"
}
],
"oidcIpds": [
"string"
],
"jwtIdps": [
"string"
],
"idpLinks": [
"string"
],
"userLinks": [
{
"userId": "string",
"externalUserId": "string",
"displayName": "string",
"idpId": "string"
}
],
"userMetadata": [
{
"userId": "string",
"key": "string"
}
],
"domains": [
"string"
],
"appKeys": [
"string"
],
"machineKeys": [
"string"
]
}
]
}
}
- Schema
- Example (from schema)
Schema
errors object[]
Array [type stringid stringmessage string]success object
orgs object[]
Array [orgId stringprojectIds string[]projectRoles string[]oidcAppIds string[]apiAppIds string[]humanUserIds string[]machineUserIds string[]actionIds string[]triggerActions object[]
Array [flowType id of the flow typeAt the moment you have to send the ID of the Flow Type: ExternalAuthentication=1, CustomiseToken=2, InternalAuthentication=3, PreUserinfoCreation=3
triggerType id of the trigger typeAt the moment you have to send the ID of the Trigger Type: PostAuthentication=1, PreCreation=2, PostCreation=3, PreUserinfoCreation=4, PreAccessTokenCreation=5
actionIds string[]]projectGrants object[]
Array [grantId stringprojectId stringorgId string]userGrants object[]
Array [projectId stringuserId string]orgMembers string[]projectMembers object[]
Array [projectId stringuserId string]projectGrantMembers object[]
Array [projectId stringgrantId stringuserId string]oidcIpds string[]jwtIdps string[]idpLinks string[]userLinks object[]
Array [userId stringexternalUserId stringdisplayName stringidpId string]userMetadata object[]
Array [userId stringkey string]domains string[]appKeys string[]machineKeys string[]]
{
"errors": [
{
"type": "string",
"id": "string",
"message": "string"
}
],
"success": {
"orgs": [
{
"orgId": "string",
"projectIds": [
"string"
],
"projectRoles": [
"string"
],
"oidcAppIds": [
"string"
],
"apiAppIds": [
"string"
],
"humanUserIds": [
"string"
],
"machineUserIds": [
"string"
],
"actionIds": [
"string"
],
"triggerActions": [
{
"flowType": "1",
"triggerType": "1",
"actionIds": [
"string"
]
}
],
"projectGrants": [
{
"grantId": "string",
"projectId": "string",
"orgId": "string"
}
],
"userGrants": [
{
"projectId": "string",
"userId": "string"
}
],
"orgMembers": [
"string"
],
"projectMembers": [
{
"projectId": "string",
"userId": "string"
}
],
"projectGrantMembers": [
{
"projectId": "string",
"grantId": "string",
"userId": "string"
}
],
"oidcIpds": [
"string"
],
"jwtIdps": [
"string"
],
"idpLinks": [
"string"
],
"userLinks": [
{
"userId": "string",
"externalUserId": "string",
"displayName": "string",
"idpId": "string"
}
],
"userMetadata": [
{
"userId": "string",
"key": "string"
}
],
"domains": [
"string"
],
"appKeys": [
"string"
],
"machineKeys": [
"string"
]
}
]
}
}
Returned when the user does not have permission to access the resource.
- application/json
- application/grpc
- application/grpc-web+proto
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
Returned when the resource does not exist.
- application/json
- application/grpc
- application/grpc-web+proto
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
An unexpected error response.
- application/json
- application/grpc
- application/grpc-web+proto
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}
- Schema
- Example (from schema)
Schema
- code int32
- message string
details object[]
Array [@type string]
{
"code": 0,
"message": "string",
"details": [
{
"@type": "string"
}
]
}