Search
TrustX API Reference TrustX xDeTECH
TrustX API Reference
Authentication
Api Keys
POSTObtain a bearer token by API Key for the tenant
GETList API Keys for the tenant
POSTCreate an API Key for a tenant
GETGet an API Key for a tenant
POSTUpdate an API Key for a tenant
DELETEDelete an API Key.
Admin Sessions
GETGet an Admin Session by sessionId for a tenant
GETList Admin Sessions for a tenant
GETGet an Admin Session by id for a tenant
Process Instance
POSTContinue process.
POSTStart a process instance.
Process Tokens
GETGet Process Token.
PUTInvalidate a process token.
DELETEDelete a process token.
GETList Process Tokens.
POSTCreate a process token.
Process Definition Tags
GETGet tag list
DELETEDelete tag
POSTTag process definition
Process Instances
GETGet a Process Instance.
DELETEDelete a Process Instance.
GETList Process Instances.
POSTCreate a Process Instance (with redirect).
POSTExport process instance search results to CSV.
POSTGet Process Instances by IDs.
GETGet a Process Instance with additional paramaters.
POSTCreate a Process Instance.
GETSearch Process Instances.
Cloud Secrets
GETList the Cloud Secrets.
POSTCreate a Cloud Secret.
GETGet a Cloud Secret.
POSTUpdate an existing Cloud Secret.
DELETEDelete a Cloud Secret.
Audits
GETQuery the status of an audit query.
POSTCreate an audit query.
GETGet a query result.
Userdata-controller
GETGet Checks.
GETGet Image.
GETGet User Data.
POSTGet Summary Archive.
Custom Pages
GETList Custom Pages
POSTCreate Custom Page
GETGet Custom Page By Name And Version
POSTCreate Custom Page Preview
POSTChange Custom Page Status
DELETEDelete Custom Page Archive
GETGet Custom Page
POSTUpdate Custom Page
DELETEDelete Custom Page
GETGet Custom Page Versions
Watchlist V2
GETGet a watchlist by ID
POSTUpdate a watchlist
DELETEDelete a watchlist
GETGet largest watchlists by entry count
GETGet individual watchlist usage statistics
GETList watchlists
POSTCreate a new watchlist
GETGet watchlist usage statistics
POSTQuery a watchlist
Trends
GETList trend records
POSTAdd trend record
DELETEDelete trend records by process instance ID
GETList process instances for a trend value
GETGet trend record by ID
GETQuery trend statistics
Watchlist Member Management Deprecated
GETList watchlist members. (DEPRECATED)
POSTAdd watchlist member. (DEPRECATED)
GETGet a watchlist member. (DEPRECATED)
DELETEDelete a watchlist member. (DEPRECATED)
GETGet a watchlist member's face image if available (DEPRECATED)
Watchlist Management Deprecated
GETList watchlist. (DEPRECATED)
POSTCreate a watchlist. (DEPRECATED)
GETGet a watchlist. (DEPRECATED)
POSTUpdate a watchlist. (DEPRECATED)
DELETEDelete a watchlist. (DEPRECATED)
Watchlist Entry V2
GETGet a watchlist entry by ID
DELETEDelete a watchlist entry
GETList watchlist entries
POSTCreate a new watchlist entry
Tenant Management
GETGet the results of a store event query
GETGet the status of a store event query
GETGet tenant statistics (key rollover, configured limits, identity store events statistics)
POSTStart a store event query
User Biometric Management
GETList biometric verisons for a user identified by external ID, the type and subtype
GETList biometrics for a user identified by external ID
GETList biometric versions for a user identified by internal ID and the type and subtype
DELETEDelete a user biometric by external user ID and biometric ID
GETList biometrics for a user identified by internal ID
POSTAdd or update biometric within an identity store for a user identified by its internal ID
POSTUpdate all biometrics for a user (identified by external user ID) of the specified type to the specified status
GETGet the biometric sample versions references by the biometric specified by its type, subtype and versionId
GETGet a biometric including sensitive data for a user identified by internal ID
DELETEDelete a user biometric by internal user ID and biometric ID
POSTAdd or update biometric within an identity store for a user identified by its external ID
GETGet a biometric version including sensitive data for a user identified by external ID with the specified type, subtype and versionId
POSTRecord that a failed authentication has taken place with a user biometric. The user is identified by its external ID.
GETGet a biometric including sensitive data for a user identified with type and subtype
DELETEDelete a user biometric by internal user ID and biometric type and subtype
GETGet the biometric samples references by the biometric specified by its type, subtype and versionId by user external ID
POSTPerform a biometric face match. The user is identified by its external ID.
POSTRecord that a failed authentication has taken place with a user biometric. The user is identified by its internal ID.
GETGet a biometric version sensitive data for a user identified with type and subtype and version Id
POSTPerform a biometric face match. The user is identified by its internal ID.
GETGet a biometric including sensitive data for a user identified by external ID with the specified type and subtype
GETGet a biometric version including sensitive data for a user identified with type and subtype and version Id
GETGet a biometric including sensitive data for a user identified by external ID
POSTUpdate all biometrics for a user (identified by internal user ID) of the specified type to the specified status
DELETEDelete a user biometric by external user ID and biometric type and subtype
User Appkey Management
DELETEDelete registered appkeys from a device given an appkey's key ID from the device itself and the user identified by its internal ID.
POSTDelete registered appkeys for a user (identified by internal ID) and create a deregistration request for the client. Appkeys can be deleted by type (silent, biometric) or AAID and can be restricted to a device or can be deleted across all devices for that user.
POSTComplete an appkey authentication for an externally managed session.
GETList registered appkeys for a user (identified by internal ID) optionally filtered by device
POSTCreate an appkey authentication request for a known user identified by external ID using the specified authentication policy for the specified relying party
POSTCreate an anonymous appkey authentication request (where a user is not supplied) using the specified authentication policy for the specified relying party
GETGet a user appkey registration record for a user identified by internal ID
POSTSet a preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.
DELETEClear the preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.
POSTSet a preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.
DELETEClear the preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.
POSTComplete an appkey authentication for an internally managed session.
POSTCreate an appkey authentication request for a known user identified by internal ID using the specified authentication policy for the specified relying party
POSTDelete registered appkeys for a user (identified by external ID) and create a deregistration request for the client. Appkeys can be deleted by type (silent, biometric) or AAID and can be restricted to a device or can be deleted across all devices for that user.
POSTComplete an appkey registration for an externally managed session.
GETList registered appkeys for a user (identified by external ID) optionally filtered by device
POSTCreate an appkey registration request for a user identified by an optional external ID using the specified registration policy for the specified relying party
POSTUpdate an existing appkey's status by external user ID
DELETEDelete the preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.
DELETEDelete user appkeys by internal user ID for a specified device
GETGet an appkey for a user identified by external ID
DELETEDelete a user appkey by external user ID and internal appkey ID
DELETEDelete the preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.
GETGet a user appkey registration record for a user identified by external ID
GETGet an appkey for a user identified by internal ID
POSTUpdate an existing appkey's status by internal user ID
DELETEDelete a user appkey by internal user ID and appkey ID
POSTCreate an appkey registration request for an existing user identified by its external ID within an identity store using the specified registration policy for the specified relying party
DELETEDelete user appkeys by external user ID for a specified device
DELETEDelete registered appkeys from a device given an appkey's key ID from the device itself and the user identified by its external ID.
POSTComplete an appkey registration for an internally managed session.
POSTCreate an appkey registration request for an existing user identified by its internal ID within an identity store using the specified registration policy for the specified relying party
User Passkey Management
POSTCreate a passkey credential creation request for an existing user identified by its external ID within an identity store using the specified registration policy for the specified relying party
POSTComplete a passkey credential creation request for an internally managed session.
GETGet a passkey for a user identified by external ID
DELETEDelete a user passkey by external user ID and internal passkey ID
GETGet a user passkey registration record for a user identified by external ID
GETGet a passkey for a user identified by internal ID
POSTUpdate an existing passkey's name and/or status by internal user ID
DELETEDelete a user passkey by internal user ID and passkey ID
GETList registered passkeys for a user (identified by internal ID)
GETList registered passkeys for a user (identified by external ID)
POSTCreate a passkey credential creation request and generate a user identified by the supplied external ID using the specified registration policy for the specified relying party
POSTUpdate an existing passkey's name and/or status by external user ID
POSTCreate a passkey authentication request for a known user identified by internal ID using the specified authentication policy for the specified relying party
POSTComplete a passkey authentication for an externally managed session.
POSTCreate a passkey credential creation request for an existing user identified by its internal ID within an identity store using the specified registration policy for the specified relying party
GETGet a user passkey registration record for a user identified by internal ID
POSTComplete a passkey credential creation request for an externally managed session.
POSTComplete a passkey authentication for an internally managed session.
POSTCreate a passkey authentication request for a known user identified by external ID using the specified authentication policy for the specified relying party
POSTCreate an anonymous passkey authentication request (where a user is not supplied) using the specified authentication policy for the specified relying party
Tenant Key Management
POSTForce a key rotation for one or more keys belonging to a tenant.
GETList a tenant's keys
User Passcode Management
POSTComplete a passcode renewal.
POSTComplete a passcode registration.
POSTStart a registration for a client-validated password belonging to an existing user identified by its external ID using the specified policy
GETList registered passcodes for a user (identified by external ID)
POSTStart an authentication for a client-validated password belonging to an existing user identified by its external ID using the specified policy
POSTStart an authentication for a client-validated password belonging to an existing user identified by its internal ID using the specified policy
GETGet a passcode for a user identified by internal ID
POSTUpdate an existing passcode's status or expiration date by internal user ID
DELETEDelete a user passcode by internal user ID and user passcode ID
GETGet a passcode for a user identified by external ID
POSTUpdate an existing passcode's status or expiration date by external user ID
DELETEDelete a user passcode by external user ID and user passcode ID
GETList registered passcodes for a user (identified by internal ID)
POSTDeregister a passcode for user identified by external ID
POSTStart a renewal for a client-validated password belonging to an existing user identified by its internal ID using the specified policy
GETGet a user passcode by external user ID and policy
POSTComplete a passcode authentication.
POSTStart a renewal for a client-validated password belonging to an existing user identified by its external ID using the specified policy
GETGet a user passcode by internal user ID and policy
POSTStart a registration for a client-validated password belonging to an existing user identified by its internal ID using the specified policy
POSTDeregister a passcode for user identified by ID
User Push Notification Management
POSTSend push notification to user devices with registered appkeys for the specified relying party. The user is identified by internal ID.
POSTSend push notification to user devices with registered appkeys for the specified relying party. The user is identified by external ID.
GETList active push notifications grouped by relying party ID and device ID for the specified user. The user is identified by internal ID.
GETGet a push notification record for a user. The record is identified by the ID returned by the list user push notifications API. The user is identified by external ID.
GETList active push notifications grouped by relying party ID and device ID for the specified user. The user is identified by external ID.
GETGet a push notification record for a user. The record is identified by the ID returned by the list user push notifications API. The user is identified by internal ID.
User Management
GETList user authentications by external user ID
GETList users
POSTCreate a new user within an identity store
GETGet an existing user by internal ID **contains examples**
POSTUpdate an existing user by internal user ID
DELETEDelete an existing user by internal ID
GETList user authentications by internal user ID
GETGet a detailed authentication record for a user by internal ID
GETList active user appkey/passkey operation session data. The user is identified by the external ID.
GETGet an existing user by external ID
POSTUpdate an existing user by external user ID. **Only the fields to be updated need to be supplied**
DELETEDelete an existing user by external ID
GETGet a detailed authentication record for a user by external ID
GETList active user appkey/passkey operation session data. The user is identified by the internal database ID.
User Totp Management
GETGet a TOTP for a user identified by external ID
POSTUpdate an existing TOTP's status by external user ID
DELETEDelete a user TOTP by external user ID and user TOTP ID
GETGet TOTP registration for user identified by ID
POSTStart a TOTP registration for an existing user identified by its internal ID within an identity store using the specified policy
POSTPerform TOTP authentication for an existing user identified by its internal ID within an identity store using the specified policy
POSTPerform TOTP authentication for an existing user identified by its external ID within an identity store using the specified policy
POSTDeregister a TOTP for user identified by ID
POSTComplete a TOTP registration for an existing user identified by its external ID within an identity store using the specified policy
GETList registered TOTPs for a user (identified by external ID)
POSTComplete a TOTP registration for an existing user identified by its internal ID within an identity store using the specified policy
GETList registered TOTPs for a user (identified by internal ID)
GETGet a TOTP for a user identified by internal ID
POSTUpdate an existing TOTP's status by internal user ID
DELETEDelete a user TOTP by internal user ID and user TOTP ID
GETGet TOTP registration for user identified by external ID
POSTStart a TOTP registration for an existing user identified by its external ID within an identity store using the specified policy
POSTDeregister a TOTP for user identified by external ID
Store Appkey Configuration Management
GETGet an existing appkey configuration for a relying party
POSTUpdate an existing appkey configuration for a relying party
DELETEDelete an existing appkey configuration for a relying party
POSTCreate a new appkey configuration within an identity store for a relying party.
Store Passcode Policy Management
GETGet an existing passcode policy by name
POSTUpdate an existing passcode policy
DELETEDelete an existing passcode policy
POSTCreate a new passcode policy within an identity store for policy name
Store Totp Policy Management
GETGet an existing TOTP policy by policy name
POSTUpdate an existing TOTP policy for policy name
DELETEDelete an existing TOTP policy with policy name
POSTCreate a new TOTP policy within an identity store for policy name
Store Push Notification Policy Management
GETGet an existing Push Notification policy by relying party
POSTUpdate an existing Push Notification policy for relying party
DELETEDelete an existing Push Notification policy with relying party
GETGet a list of valid relying parties for push notifications. Relying parties can be filtered by their configuration status.
POSTCreate a new Push Notification policy within an identity store for relying party
Store Management
GETGet an existing identity store
POSTUpdate an existing identity store
DELETEDelete an existing store
GETList stores
POSTCreate a new identity store
GETGet store event statistics
Store Passkey Configuration Management
POSTCreate a new passkey configuration within an identity store for a relying party.
GETGet an existing passkey configuration for a relying party
POSTUpdate an existing passkey configuration for a relying party
DELETEDelete an existing passkey configuration for a relying party

TrustX API Reference 1.0Terms of Service

API Documentation for TrustX

For more information, please visit: TrustX Documentation

Last Updated: 2026-04-27

Server
https://{tenantId}.fir.trustx.com

URL for fir regional system

https://{tenantId}.gum.trustx.com

URL for gum regional system

https://{tenantId}.oak.trustx.com

URL for oak regional system

Server Variables

Obtain a bearer token by API Key for the tenant

Returns the JWT token, otherwise 401 and an error code and message.

Auth
Headers
POST /api/arthr/apiKeys/issue
Copy
Responses
200

OK

400

Bad Request

401

Unauthorized

Response
Copy

List API Keys for the tenant

List API Keys for the tenant.

API Permissions: TNT#{tenantid}#ArthrServer:listTenantApiKeys

Auth
Query String
GET /api/arthr/apiKeys
Copy
Responses
200

OK

400

Bad Request

401

Unauthorized

Response
Copy

Create an API Key for a tenant

Create an API Key for a tenant.

API Permissions: TNT#{tenantid}#ArthrServer:createTenantApiKey

Auth
Request Body
POST /api/arthr/apiKeys
Copy
Responses
201

Created

400

Bad Request

401

Unauthorized

Response
Copy

Get an API Key for a tenant

Returns the specific API Key for a tenant.

API Permissions: TNT#{tenantid}#ArthrServer:getFromTenant

Auth
Path Params
GET /api/arthr/apiKeys/{apiKeyId}
Copy
Responses
200

OK

400

Bad Request

401

Unauthorized

Response
Copy

Update an API Key for a tenant

Updates an API Key for a tenant.

API Permissions: TNT#{tenantid}#ArthrServer:updateTenantApiKey

Auth
Path Params
Request Body
POST /api/arthr/apiKeys/{apiKeyId}
Copy
Responses
200

OK

400

Bad Request

401

Unauthorized

Response
Copy

Delete an API Key.

Deletes the specific API Key. Once the API is deleted it cannot be recovered.

API Permissions: TNT#{tenantid}#ArthrServer:deleteFromTenant

Auth
Path Params
DELETE /api/arthr/apiKeys/{apiKeyId}
Copy
Responses
204

No Content

No response body
400

Bad Request

401

Unauthorized

Response
Copy

Get an Admin Session by sessionId for a tenant

Retrieves a specific OIDC session by its session ID for the specified tenant.

API Permissions: TNT#{tenantid}#ArthrServer:getTenantOidcSessionBySessionId

Auth
Path Params
GET /api/arthr/oidcSessions/{sessionId}/sessionId
Copy
Responses
200

Successfully retrieved OIDC session

400

Bad Request

401

Unauthorized

403

Access denied - insufficient tenant permissions

404

OIDC session not found

500

Internal server error

Response
Copy

List Admin Sessions for a tenant

Retrieves a paginated list of OIDC sessions for the specified tenant with optional filtering by client ID and subject.

API Permissions: TNT#{tenantid}#ArthrServer:listTenantOidcSessions

Auth
Query String
GET /api/arthr/oidcSessions
Copy
Responses
200

Successfully retrieved OIDC sessions

400

Bad Request

401

Unauthorized

403

Access denied - insufficient tenant permissions

500

Internal server error

Response
Copy

Get an Admin Session by id for a tenant

Retrieves a specific OIDC session by its unique ID for the specified tenant.

API Permissions: TNT#{tenantid}#ArthrServer:getTenantOidcSessionById

Auth
Path Params
GET /api/arthr/oidcSessions/{id}
Responses
200

Successfully retrieved OIDC session

400

Bad Request

401

Unauthorized

403

Access denied - insufficient tenant permissions

404

OIDC session not found

500

Internal server error

Response

Continue process.

Signal to the process instance that it should continue.

Auth
Path Params
Query String
Request Body
POST /api/process-server/processes/{processDefinitionName}/businessKeys/{businessKey}/topicName/{topicName}/continue
Responses
200

OK

Response

Start a process instance.

Start a process process instance given the process instance id (id).

Auth
Query String
Request Body
POST /api/process-server/startProcess
Responses
200

OK

Response

Get Process Token.

Get process token for the given ID.

API Permissions: TNT#{tenantid}#ProcessManager:getProcessToken

Auth
Path Params
GET /api/process-manager/processTokens/{processTokenId}
Responses
200

OK

400

Bad Request

404

Not Found

Response

Invalidate a process token.Deprecated

Deprecated

Invalidate process token given a processTokenId.

API Permissions: TNT#{tenantid}#ProcessManager:invalidateProcessToken

Auth
Path Params
PUT /api/process-manager/processTokens/{processTokenId}
Responses
200

OK

400

Bad Request

404

Not Found

Response

Delete a process token.

Beta

Delete a process token given a processTokenId.

API Permissions: TNT#{tenantid}#ProcessManager:deleteProcessToken

Auth
Path Params
DELETE /api/process-manager/processTokens/{processTokenId}
Responses
200

OK

No response body
400

Bad Request

404

Not Found

Response

List Process Tokens.

List process tokens given a search criteria.

API Permissions: TNT#{tenantid}#ProcessManager:listProcessTokens

Auth
Query String
GET /api/process-manager/processTokens
Responses
200

OK

400

Bad Request

404

Not Found

Response

Create a process token.

Create a process token.

API Permissions: TNT#{tenantid}#ProcessManager:addProcessToken

Auth
Request Body
POST /api/process-manager/processTokens
Responses
201

Created

400

Bad Request

404

Not Found

Response

Get tag list

Deprecated

List the Tags that exist (for the tenant). If successful, it returns HTTP 200 and a list of Tags; otherwise, an appropriate error is returned.
The API allows the caller to filter on one or more Tag names (comma-separated). Wildcard matches are performed for Tag names, unless the exactMatch parameter is set to true.

API Permissions: TNT#{tenantid}#ProcessManager:getTagsForTenant

Auth
Query String
GET /api/process-manager/processDefinitions/tags
Responses
200

OK

400

Bad Request

404

Not Found

Response

Delete tag

Deprecated

Delete a Tag from a Process Definition. Returns HTTP 204 for successful deletion of the Tag; otherwise, an appropriate error. Once the Tag is deleted, it cannot be referenced within the system (subject to cache expiry).
Warning: If you delete a Tag that is being used to reference a Process Definition when creating Process Tokens or Process Instances you will no longer be able to create Process Tokens or Instances.

API Permissions: TNT#{tenantid}#ProcessManager:deleteTagFromProcessDefinition

Auth
Path Params
DELETE /api/process-manager/processDefinitions/tags/{name}
Responses
204

No Content

No response body
400

Bad Request

404

Process definition tag not found

Response

Tag process definition

Deprecated

Create a Tag on the Process Definition. This operation will move an existing Tag from another Process Definition if it already exists. Returns HTTP 201 for successful creation or move of the tag(s) and tag(s) created or modified in body, otherwise an appropriate error.
Note:

  • Tags are unique but can be moved from one process definition to another.
  • Tags must be alphanumeric and can contain spaces, hyphen (-) or underscore (_).
  • Tags cannot start or end with a space; tags that start or end with a space will be trimmed.



    API Permissions: TNT#{tenantid}#ProcessManager:tagProcessDefinition

    • Auth
    Path Params
    Request Body
    POST /api/process-manager/processDefinitions/{processDefinitionId}/tags
    Responses
    201

    Created

    400

    Bad request

    404

    Process definition not found

    Response

    Get a Process Instance.

    Get a Process Instance based an ID.

    API Permissions: TNT#{tenantid}#ProcessManager:getProcessInstance

    Auth
    Path Params
    GET /api/process-manager/processInstances/{processInstanceId}
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Delete a Process Instance.

    Delete a Process Instance based an ID.

    API Permissions: TNT#{tenantid}#ProcessManager:deleteProcessInstance

    Auth
    Path Params
    Query String
    DELETE /api/process-manager/processInstances/{processInstanceId}
    Responses
    200

    OK

    No response body
    400

    Bad Request

    404

    Not Found

    Response

    List Process Instances.

    List Process Instances based on a filter.

    API Permissions: TNT#{tenantid}#ProcessManager:listProcessInstancesBetweenDates

    Auth
    Query String
    GET /api/process-manager/processInstances
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Create a Process Instance (with redirect).

    Create a Process Instance with redirect.

    API Permissions: TNT#{tenantid}#ProcessManager:createProcessInstanceAndRedirect

    Auth
    Query String
    Request Body
    POST /api/process-manager/processInstances
    Responses
    307

    Temporary Redirect

    No response body
    400

    Bad Request

    404

    Not Found

    Response

    Export process instance search results to CSV.

    Beta

    List Process Instances based on a filter and export results to a CSV file.

    API Permissions: TNT#{tenantid}#ProcessManager:exportProcessInstancesToCsv

    Auth
    Query String
    Request Body
    POST /api/process-manager/processInstances/csv
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Get Process Instances by IDs.

    Retrieve a list of process instances matching the provided IDs. Duplicate IDs are silently deduplicated; each matching instance is returned at most once.

    API Permissions: TNT#{tenantid}#ProcessManager:getProcessInstancesByIds

    Auth
    Request Body
    POST /api/process-manager/processInstances/byIds
    Responses
    200

    List of process instances matching the provided IDs

    400

    Invalid request (empty ID list or exceeds maximum size)

    401

    Unauthorized

    403

    Forbidden - insufficient tenant permissions

    404

    Not Found

    Response

    Get a Process Instance with additional paramaters.

    Get a Process Instance based an ID (with addititional paramaters).

    API Permissions: TNT#{tenantid}#ProcessManager:getProcessInstanceWithParameters

    Auth
    Path Params
    GET /api/process-manager/processInstances/{processInstanceId}/withParameters
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Create a Process Instance.

    Create a Process Instance.

    API Permissions: TNT#{tenantid}#ProcessManager:createProcessInstance

    Auth
    Query String
    Request Body
    POST /api/process-manager/processInstances/create
    Responses
    201

    Created

    400

    Bad Request

    404

    Not Found

    Response

    Search Process Instances.

    Search Process Instances based on the provided criteria.

    API Permissions: TNT#{tenantid}#ProcessManager:searchProcessInstancesBetweenDates

    Auth
    Query String
    GET /api/process-manager/processInstances/search
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    List the Cloud Secrets.

    List the Cloud Secrets that exist (for the tenant). If successful returns HTTP 200 and a page of Cloud Secrets, otherwise an appriopriate error.

    API Permissions: TNT#{tenantid}#ProcessManager:listCloudSecrets

    Auth
    Query String
    GET /api/process-manager/cloudSecrets
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Create a Cloud Secret.

    Create a Cloud Secret. Returns HTTP 201 for successful creation of the Cloud Secret, otherwise an appropriate error. Once created the Cloud Secret is assigned a unique id.
    Note:

  • The Cloud Secret name must be unique
  • The Cloud Secret type must be specified
  • The Cloud Secret value must be specified

    API Permissions: TNT#{tenantid}#ProcessManager:addCloudSecret

    • Auth
    Request Body
    POST /api/process-manager/cloudSecrets
    Responses
    201

    Created

    400

    Bad Request

    404

    Not Found

    Response

    Get a Cloud Secret.

    Get a Cloud Secret based on the id of the Cloud Secret. If successful returns HTTP 200 and the Cloud Secret, otherwise an appropriate error.

    API Permissions: TNT#{tenantid}#ProcessManager:getCloudSecret

    Auth
    Path Params
    GET /api/process-manager/cloudSecrets/{cloudSecretId}
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Update an existing Cloud Secret.

    Update an Cloud Secret based in the ID. If successful returns HTTP 200 and the updated Cloud Secret, otherwise an appropriate error.
    Note:

  • The Cloud Secret name cannot be changed
  • The Cloud Secret type cannot be specified
  • The Cloud Secret value must be specified

    API Permissions: TNT#{tenantid}#ProcessManager:updateCloudSecret

    • Auth
    Path Params
    Request Body
    POST /api/process-manager/cloudSecrets/{cloudSecretId}
    Responses
    200

    OK

    400

    Bad Request

    404

    Not Found

    Response

    Delete a Cloud Secret.

    Delete a cloud secret based on the id. Returns HTTP 200 for successful deletion of the Cloud Secret, otherwise an appropriate error. Once the Cloud Secret is deleted, it cannot be referenced within the system (subject to cache expiry).

    API Permissions: TNT#{tenantid}#ProcessManager:addCloudSecret

    Auth
    Path Params
    DELETE /api/process-manager/cloudSecrets/{cloudSecretId}
    Responses
    200

    OK

    No response body
    400

    Bad Request

    404

    Not Found

    Response

    Query the status of an audit query.

    Query the status of an audit query based on the executionId.

    The state of query execution. QUEUED indicates that the query has been submitted to the service, and will execute the query as soon as resources are available. RUNNING indicates that the query is in execution phase. SUCCEEDED indicates that the query completed without errors. FAILED indicates that the query experienced an error and did not complete processing. CANCELLED indicates that a user input interrupted query execution.



    API Permissions: TNT#{tenantid}#MetricsServer:getAuditQueryStatus

    Auth
    Path Params
    GET /api/metrics-server/auditMessages/queries/{executionId}/status
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    500

    Internal Server Error

    Response

    Create an audit query.

    Create an audit query for which the result must be collected later.

    API Permissions: TNT#{tenantid}#MetricsServer:startAuditQuery

    Auth
    Request Body
    POST /api/metrics-server/auditMessages/queries/start
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    500

    Internal Server Error

    Response

    Get a query result.

    Get they query result based on the exeuctionId.

    API Permissions: TNT#{tenantid}#MetricsServer:getAuditQueryStatus

    Auth
    Path Params
    Query String
    GET /api/metrics-server/auditMessages/queries/{executionId}/result
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    500

    Internal Server Error

    Response

    Get Checks.

    Deprecated

    Get Checks for the Process Instance. Optionally filter by key

    API Permissions: TNT#{tenantid}#UserDataServer:getChecksByKey

    Auth
    Path Params
    Query String
    GET /api/userdata-server/processDefinitions/{processDefnId}/processInstances/{processInstanceId}/userdata/checks
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    Response

    Get Image.

    Get base64 encoded representation of user data such as a document or face image.

    API Permissions: TNT#{tenantid}#UserDataServer:getProcessInstanceImages

    Auth
    Path Params
    Query String
    GET /api/userdata-server/processDefinitions/{processDefnId}/processInstances/{processInstanceId}/getdata
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    Response

    Get User Data.

    Get the Process Instance information as User Data.

    API Permissions: TNT#{tenantid}#UserDataServer:getProcessInstanceUserData

    Auth
    Path Params
    Query String
    GET /api/userdata-server/processDefinitions/{processDefnId}/processInstances/{processInstanceId}/userdata
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    Response

    Get Summary Archive.

    Get Summary Archive. This file contains PII information - it is the responsibility of the consumer of the API to provide the apprioprate protections for the data.

    API Permissions: TNT#{tenantid}#UserDataServer:getProcessInstanceUserDataArchive

    Auth
    Path Params
    Request Body
    POST /api/userdata-server/processDefinitions/{processDefnId}/processInstances/{processInstanceId}/userdataarchive
    Responses
    200

    OK

    400

    Bad Request

    401

    Unauthorized

    Response

    List Custom Pages

    Deprecated

    List custom pages for a tenant. The list can be filtered by name and status.

    API Permissions: TNT#{tenantid}#ThemeServer:listCustomPages

    Auth
    Query String
    GET /api/theme-server/customPages
    Responses
    200

    OK

    400

    Bad Request

    Response

    Create Custom Page

    Deprecated

    Create a custom page with the provided details.

    API Permissions: TNT#{tenantid}#ThemeServer:createCustomPage

    Auth
    Request Body
    POST /api/theme-server/customPages
    Responses
    201

    Created

    400

    Bad Request

    Response

    Get Custom Page By Name And Version

    Deprecated

    Get a custom page by name and version for the specified tenant.

    API Permissions: TNT#{tenantid}#ThemeServer:getCustomPageByNameAndVersion

    Auth
    Path Params
    GET /api/theme-server/customPages/{name}/{version}
    Responses
    200

    OK

    400

    Bad Request

    Response

    Create Custom Page Preview

    Deprecated

    Create a custom page preview by uploading a preview archive.

    API Permissions: TNT#{tenantid}#ThemeServer:createCustomPagePreview

    Auth
    Request Body
    POST /api/theme-server/customPages/previews
    Responses
    200

    OK

    400

    Bad Request

    Response

    Change Custom Page Status

    Deprecated

    Change the status of a custom page by id for the specified tenant.

    API Permissions: TNT#{tenantid}#ThemeServer:changeCustomPageStatus

    Auth
    Path Params
    POST /api/theme-server/customPages/{id}/status/{status}
    Responses
    200

    OK

    400

    Bad Request

    Response

    Delete Custom Page Archive

    Deprecated

    Delete a custom page archive by custom page ID.

    API Permissions: TNT#{tenantid}#ThemeServer:deleteCustomPageArchive

    Auth
    Path Params
    DELETE /api/theme-server/customPages/{id}/archive
    Responses
    200

    OK

    No response body
    400

    Bad Request

    Response

    Get Custom Page

    Deprecated

    Get a custom page by id.

    API Permissions: TNT#{tenantid}#ThemeServer:getCustomPage

    Auth
    Path Params
    Query String
    GET /api/theme-server/customPages/{id}
    Responses
    200

    OK

    400

    Bad Request

    Response

    Update Custom Page

    Deprecated

    Update a custom page by id.

    API Permissions: TNT#{tenantid}#ThemeServer:updateCustomPage

    Auth
    Path Params
    Request Body
    POST /api/theme-server/customPages/{id}
    Responses
    200

    OK

    400

    Bad Request

    Response

    Delete Custom Page

    Deprecated

    Delete a custom page by id.

    API Permissions: TNT#{tenantid}#ThemeServer:deleteCustomPage

    Auth
    Path Params
    DELETE /api/theme-server/customPages/{id}
    Responses
    200

    OK

    No response body
    400

    Bad Request

    Response

    Get Custom Page Versions

    Deprecated

    Get custom page versions by name.

    API Permissions: TNT#{tenantid}#ThemeServer:getCustomPageVersions

    Auth
    Path Params
    Query String
    GET /api/theme-server/customPages/{name}/versions
    Responses
    200

    OK

    400

    Bad Request

    Response

    Get a watchlist by ID

    Deprecated

    Retrieves detailed information about a specific watchlist including metadata and current entry count.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistV2

    Auth
    Path Params
    GET /api/watchlist-manager/watchlists/{watchlistId}
    Responses
    200

    Watchlist retrieved successfully

    400

    Bad Request

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Update a watchlist

    Deprecated

    Updates an existing watchlist. The watchlist type cannot be changed after creation. The name must remain unique within the tenant.

    API Permissions: TNT#{tenantid}#WatchlistManager:updateWatchlistV2

    Auth
    Path Params
    Request Body
    POST /api/watchlist-manager/watchlists/{watchlistId}
    Responses
    200

    Watchlist updated successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 11 (VALIDATION_NAME_REQUIRED), Error Code 12 (VALIDATION_NAME_INVALID_FORMAT), Error Code 13 (VALIDATION_NAME_TOO_LONG), Error Code 14 (VALIDATION_DESCRIPTION_TOO_LONG), Error Code 16 (VALIDATION_DURATION_INVALID), Error Code 38 (INVALID_ISO_DURATION)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict - Watchlist name already exists (Error Code 21 - WATCHLIST_NAME_ALREADY_EXISTS)

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Delete a watchlist

    Deprecated

    Permanently deletes a watchlist and all its entries. This action cannot be undone.

    API Permissions: TNT#{tenantid}#WatchlistManager:deleteWatchlistV2

    Auth
    Path Params
    DELETE /api/watchlist-manager/watchlists/{watchlistId}
    Responses
    204

    Watchlist deleted successfully

    No response body
    400

    Bad Request - Cannot delete active watchlist (Error Code 28 - DELETE_OF_ACTIVE_WATCHLIST_ERROR)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Get largest watchlists by entry count

    Deprecated

    Retrieves the top N watchlists sorted by entry count (size) in descending order. Results are cached for 1 minute to improve performance. When multiple watchlists have the same entry count, they are ordered by most recently updated to ensure deterministic ordering. Exactly limit results are returned (no ties beyond limit). The response includes cache metadata indicating when the statistics were collected and when the cache will be expired.

    API Permissions: TNT#{tenantid}#WatchlistManager:getLargestWatchlists

    Auth
    Query String
    GET /api/watchlist-manager/watchlists/usage/largest
    Responses
    200

    Largest watchlists retrieved successfully

    400

    Bad Request - Invalid limit parameter (Error Code 9 - INVALID_API_FIELD_ERROR)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Get individual watchlist usage statistics

    Deprecated

    Retrieves usage statistics for a specific watchlist including total entry count, remaining capacity, and maximum allowed entries.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistUsage

    Auth
    Path Params
    GET /api/watchlist-manager/watchlists/{watchlistId}/usage
    Responses
    200

    Usage statistics retrieved successfully

    400

    Bad Request

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    List watchlists

    Deprecated

    Retrieves a paginated list of watchlists for the tenant. Supports filtering by type, status, name, and date range. Results are sorted by creation date in descending order by default.

    API Permissions: TNT#{tenantid}#WatchlistManager:listWatchlistsV2

    Auth
    Query String
    GET /api/watchlist-manager/watchlists
    Responses
    200

    Watchlists retrieved successfully

    400

    Bad Request - Cannot specify both 'name' and 'nameLike' parameters (Error Code 9 - INVALID_API_FIELD_ERROR)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Create a new watchlist

    Deprecated

    Creates a new watchlist for the specified type. Each tenant has a maximum number of watchlists they can create. The watchlist name must be unique within the tenant.

    API Permissions: TNT#{tenantid}#WatchlistManager:createWatchlistV2

    Auth
    Request Body
    POST /api/watchlist-manager/watchlists
    Responses
    201

    Watchlist created successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 11 (VALIDATION_NAME_REQUIRED), Error Code 12 (VALIDATION_NAME_INVALID_FORMAT), Error Code 13 (VALIDATION_NAME_TOO_LONG), Error Code 14 (VALIDATION_DESCRIPTION_TOO_LONG), Error Code 15 (VALIDATION_TYPE_REQUIRED), Error Code 16 (VALIDATION_DURATION_INVALID), Error Code 33 (WATCHLIST_MAX_LIMIT_REACHED), Error Code 38 (INVALID_ISO_DURATION), Error Code 40 (INVALID_WATCHLIST_TYPE)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict - Watchlist name already exists (Error Code 21 - WATCHLIST_NAME_ALREADY_EXISTS)

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Get watchlist usage statistics

    Deprecated

    Retrieves usage statistics for watchlists including total count, remaining capacity, and breakdown by watchlist type. Useful for monitoring quota limits and current usage.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistV2Usage

    Auth
    GET /api/watchlist-manager/watchlists/usage
    Responses
    200

    Usage statistics retrieved successfully

    400

    Bad Request

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Query a watchlist

    Deprecated

    Searches a watchlist for matches against the provided query. The query type must match the watchlist type. For documentNumber queries, the 'documentType' field is optional: when provided, the search is limited to that type; when omitted, the search runs across all document types in the watchlist. Returns matching entries with scores and metadata.

    API Permissions: TNT#{tenantid}#WatchlistManager:queryWatchlistV2

    Auth
    Path Params
    Request Body
    POST /api/watchlist-manager/watchlists/{watchlistId}/queries
    Responses
    200

    Query executed successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 22 (MISSING_FACE_IMAGE), Error Code 23 (GENERATING_FACE_TEMPLATE_ERROR), Error Code 27 (GENERATING_FACE_TEMPLATE_INVALID_IMAGE_ERROR), Error Code 39 (QUERY_LIMIT_EXCEEDED), Error Code 44 (INVALID_IPV4_ADDRESS_FOR_QUERY)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    List trend records

    Deprecated

    Lists individual trend records for a specific identifier over a time period. If 'type' is omitted, a unified view across all trend types is returned with common attributes only. If 'type' is provided, full type-specific details are included. Uses slice-based pagination for efficient handling of large datasets. The response includes a 'queryValue' field indicating the actual value used for the query (may be normalized). Pagination uses page (zero-based, default 0) and size (default 10). Sorting uses the sort query parameter, repeated as needed, each in the form property,(asc|desc) (e.g. sort=recordedDtm,desc). When omitted, the default is recordedDtm descending. Supported sort properties are the trend list view fields: recordedDtm, id, type, value, processDefnId, processDefnName, processDefnVersion, processInstanceId, trendGroup, expiresAfterDate, expiresAfterDays. Other property names are not supported and may result in an error.

    API Permissions: TNT#{tenantid}#WatchlistManager:listTrendRecords

    Auth
    Query String
    GET /api/watchlist-manager/trends
    Responses
    200

    Trend records retrieved successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 45 (INVALID_TREND_TYPE), Error Code 46 (INVALID_IPV4_ADDRESS_FORMAT), Error Code 51 (INVALID_TIME_RANGE), Error Code 58 (INVALID_EMAIL_FORMAT), Error Code 59 (INVALID_PHONE_NUMBER_FORMAT)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Add trend record

    Deprecated

    Adds a single trend record for a document number, IP address, visitor ID, email, or phone number. The request body is polymorphic based on the type of identifier being recorded.

    API Permissions: SYS#WatchlistManager:addTrendRecord

    Auth
    Query String
    Request Body
    POST /api/watchlist-manager/trends
    Responses
    201

    Trend record added successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 45 (INVALID_TREND_TYPE), Error Code 46 (INVALID_IPV4_ADDRESS_FORMAT), Error Code 55 (PROCESS_DEFINITION_FIELDS_REQUIRED), Error Code 56 (INVALID_EXPIRES_AFTER_DAYS), Error Code 58 (INVALID_EMAIL_FORMAT), Error Code 59 (INVALID_PHONE_NUMBER_FORMAT)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Delete trend records by process instance ID

    Deprecated

    Deletes all trend records associated with the supplied process instance ID across all trend types.

    API Permissions: TNT#{tenantid}#WatchlistManager:deleteTrendsByProcessInstanceId

    Auth
    Path Params
    DELETE /api/watchlist-manager/trends/processInstances/{processInstanceId}
    Responses
    204

    Trend records deleted successfully

    No response body
    400

    Bad Request

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    List process instances for a trend value

    Deprecated

    Returns process instances that share a given trend value over a time period. The response wraps the original process-manager process instance payloads and adds HATEOAS links so the UI can navigate directly to each process instance. Process instance IDs are deduplicated within each page; if the same process instance has multiple trend records that span page boundaries, it may appear in more than one page of results. Callers that require a fully deduplicated list across all pages should accumulate and deduplicate client-side. Pagination uses page (zero-based, default 0) and size (default 10, consistent with Watchlist Manager V2 list endpoints). Sorting is not client-configurable: the sort query parameter is ignored if sent. Results are always ordered by the most recent trend recordedDtm per distinct process instance within the time range (descending), i.e. process instances with the newest matching trend activity appear first.

    API Permissions: TNT#{tenantid}#WatchlistManager:listTrendProcessInstances

    Auth
    Query String
    GET /api/watchlist-manager/trends/processInstances
    Responses
    200

    Process instances retrieved successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 45 (INVALID_TREND_TYPE), Error Code 51 (INVALID_TIME_RANGE)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Get trend record by ID

    Deprecated

    Retrieves a single trend record by its unique ID, including all attributes. The response is polymorphic based on the type of identifier.

    API Permissions: TNT#{tenantid}#WatchlistManager:getTrendRecord

    Auth
    Path Params
    GET /api/watchlist-manager/trends/{id}
    Responses
    200

    Trend record retrieved successfully

    400

    Bad Request

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Trend record with the specified ID does not exist

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Query trend statistics

    Deprecated

    Returns trend statistics for a specific identifier over a given time period. Granularity is automatically determined from the time range using a snap-up algorithm that selects the smallest 'nice' interval from a fixed set (1s, 2s, 5s, 10s, 15s, 30s, 1m, 2m, 5m, 10m, 20m, 30m, 1h, 2h, 4h, 8h, 1d) to keep the response at approximately 90 data points, depending on bucket alignment. The granularity is returned as a compact label in the response (e.g. '5m', '2h', '1d'). The response includes a 'queryValue' field indicating the actual value used for the query (may be normalized).

    API Permissions: TNT#{tenantid}#WatchlistManager:getTrendStatistics

    Auth
    Query String
    GET /api/watchlist-manager/trends/stats
    Responses
    200

    Trend statistics retrieved successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 45 (INVALID_TREND_TYPE), Error Code 46 (INVALID_IPV4_ADDRESS_FORMAT), Error Code 51 (INVALID_TIME_RANGE), Error Code 52 (TIME_RANGE_EXCEEDED), Error Code 58 (INVALID_EMAIL_FORMAT), Error Code 59 (INVALID_PHONE_NUMBER_FORMAT)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Watchlist Member Management Deprecated

    List watchlist members. (DEPRECATED)Deprecated

    List the members of a watchlist. Returns a paged list of watchlist members. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:listWatchlistMembers

    Auth
    Path Params
    Query String
    GET /api/watchlist-manager/facewatchlists/{watchlistId}/watchlist-members
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Add watchlist member. (DEPRECATED)Deprecated

    Add a watchlist member to a watchlist. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:createWatchlistMember

    Auth
    Path Params
    Request Body
    POST /api/watchlist-manager/facewatchlists/{watchlistId}/watchlist-members
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Get a watchlist member. (DEPRECATED)Deprecated

    Get a watchlist member based on a member's id. Returns detailed information for the watchlist member. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistMember

    Auth
    Path Params
    GET /api/watchlist-manager/facewatchlists/{watchlistId}/watchlist-members/{watchlistMemberId}
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Delete a watchlist member. (DEPRECATED)Deprecated

    Delete a watchlist member based on a member's id. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:deleteWatchlistMember

    Auth
    Path Params
    DELETE /api/watchlist-manager/facewatchlists/{watchlistId}/watchlist-members/{watchlistMemberId}
    Responses
    200

    OK

    No response body
    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Get a watchlist member's face image if available (DEPRECATED)Deprecated

    Get a watchlist member's face image based on a member's id. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistMemberImage

    Auth
    Path Params
    GET /api/watchlist-manager/facewatchlists/{watchlistId}/watchlist-members/{watchlistMemberId}/image
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Watchlist Management Deprecated

    List watchlist. (DEPRECATED)Deprecated

    List watchlists. Returns a paged list of watchlists based on sort criteria. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:listWatchLists

    Auth
    Query String
    GET /api/watchlist-manager/facewatchlists
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Create a watchlist. (DEPRECATED)Deprecated

    Create a watchlist, watchlist members can be added once created. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:createWatchlist

    Auth
    Request Body
    POST /api/watchlist-manager/facewatchlists
    Responses
    201

    Created

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Get a watchlist. (DEPRECATED)Deprecated

    Get a watchlist based on the watchlist id. Returns detailed information on the watchlist. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlist

    Auth
    Path Params
    GET /api/watchlist-manager/facewatchlists/{watchlistId}
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Update a watchlist. (DEPRECATED)Deprecated

    Update a watchlist based on the watchlist id. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:updateWatchlist

    Auth
    Path Params
    Request Body
    POST /api/watchlist-manager/facewatchlists/{watchlistId}
    Responses
    200

    OK

    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Delete a watchlist. (DEPRECATED)Deprecated

    Delete a watchlist based on the watchlist id. The delete of watchlist data is not immediate and is performed as a background task. DEPRECATED: Use '/watchlists' API endpoints instead.

    API Permissions: TNT#{tenantid}#WatchlistManager:deleteWatchlist

    Auth
    Path Params
    DELETE /api/watchlist-manager/facewatchlists/{watchlistId}
    Responses
    200

    OK

    No response body
    400

    Bad Request

    403

    Forbidden

    404

    Not Found

    409

    Conflict

    500

    Internal Server Error

    Response

    Watchlist Entry V2

    Get a watchlist entry by ID

    Deprecated

    Retrieves detailed information about a specific watchlist entry. For face recognition entries, the face image can be optionally included in the response.

    API Permissions: TNT#{tenantid}#WatchlistManager:getWatchlistEntry

    Auth
    Path Params
    GET /api/watchlist-manager/watchlists/{watchlistId}/entries/{entryId}
    Responses
    200

    Watchlist entry retrieved successfully

    400

    Bad Request - Unsupported watchlist type (Error Code 9 - INVALID_API_FIELD_ERROR)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND), Watchlist member image not found (Error Code 30 - WATCHLIST_MEMBER_IMAGE_NOT_FOUND), Watchlist entry not found (Error Code 31 - WATCHLIST_ENTRY_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Delete a watchlist entry

    Deprecated

    Permanently removes an entry from the watchlist. This action cannot be undone.

    API Permissions: TNT#{tenantid}#WatchlistManager:deleteWatchlistEntry

    Auth
    Path Params
    DELETE /api/watchlist-manager/watchlists/{watchlistId}/entries/{entryId}
    Responses
    204

    Watchlist entry deleted successfully

    No response body
    400

    Bad Request - Unsupported watchlist type (Error Code 9 - INVALID_API_FIELD_ERROR), Inactive watchlist operation (Error Code 42 - INACTIVE_WATCHLIST_OPERATION_NOT_ALLOWED)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND), Watchlist entry not found (Error Code 31 - WATCHLIST_ENTRY_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    List watchlist entries

    Deprecated

    Retrieves a paginated list of entries in the watchlist. Supports filtering by date range and value. For face recognition watchlists, the face image is not included in the list for performance reasons.

    API Permissions: TNT#{tenantid}#WatchlistManager:listWatchlistEntries

    Auth
    Path Params
    Query String
    GET /api/watchlist-manager/watchlists/{watchlistId}/entries
    Responses
    200

    Watchlist entries retrieved successfully

    400

    Bad Request - Unsupported watchlist type (Error Code 9 - INVALID_API_FIELD_ERROR)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Create a new watchlist entry

    Deprecated

    Adds a new entry to the watchlist. The entry type must match the watchlist type. Each entry value must be unique within the watchlist (for document numbers, the combination of value and document type must be unique).

    API Permissions: TNT#{tenantid}#WatchlistManager:createWatchlistEntry

    Auth
    Path Params
    Request Body
    POST /api/watchlist-manager/watchlists/{watchlistId}/entries
    Responses
    201

    Watchlist entry created successfully

    400

    Bad Request - Error Code 9 (INVALID_API_FIELD_ERROR), Error Code 17 (VALIDATION_VALUE_REQUIRED), Error Code 18 (VALIDATION_VALUE_TOO_LONG), Error Code 19 (VALIDATION_DOCUMENT_TYPE_REQUIRED), Error Code 22 (MISSING_FACE_IMAGE), Error Code 23 (GENERATING_FACE_TEMPLATE_ERROR), Error Code 27 (GENERATING_FACE_TEMPLATE_INVALID_IMAGE_ERROR), Error Code 34 (INVALID_IPV4_ADDRESS), Error Code 35 (INVALID_DOCUMENT_NUMBER), Error Code 36 (INVALID_VISITOR_ID), Error Code 37 (INVALID_EXPIRATION_DATE), Error Code 40 (INVALID_WATCHLIST_TYPE), Error Code 41 (WATCHLIST_MAX_ENTRIES_EXCEEDED), Error Code 42 (INACTIVE_WATCHLIST_OPERATION_NOT_ALLOWED), Error Code 43 (VALIDATION_DOCUMENT_TYPE_TOO_LONG)

    401

    Unauthorized - Authentication required

    403

    Forbidden - Insufficient permissions

    404

    Not Found - Watchlist not found (Error Code 20 - WATCHLIST_NOT_FOUND)

    409

    Conflict - Entry already exists (Error Code 32 - WATCHLIST_ENTRY_ALREADY_EXISTS)

    500

    Internal Server Error - Unexpected error occurred (Error Code 1 - UNEXPECTED_ERROR)

    Response

    Get the results of a store event query

    Deprecated

    Event querying may take a long time and so is implemented using three APIs:

    1. Start a query
    2. Get the query status. Poll until a result is available.
    3. Get the query results. this API

    NOTE: If there are too many results to return in this response then a token is returned which may be supplied in the request to this API get the next set of results.

    Refer to Daon documentation for more details on how to query identity store events.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:getStoreEventsQueryResults permission.

    API Permissions: TNT#{tenant}#IdentityStore:getStoreEventsQueryResults

    Auth
    Path Params
    Query String
    GET /api/identity-store/events/queries/{executionId}/result
    Responses
    200

    Query results returned successfully

    400

    An error occurred. Possible error codes:

    • 824: Failed to get query results from Athena
    401

    Unauthorized

    404

    Tenant not found.

    Response

    Get the status of a store event query

    Deprecated

    Event querying may take a long time and so is implemented using three APIs:

    1. Start a query
    2. Get the query status. Poll until a result is available. this API
    3. Get the query results.

    The API typically returns HTTP status 200 and response containing the status, for example QUEUED or SUCCEEDED.The API returns HTTP status 400 if the query failed to execute for some reason.Refer to Daon documentation for more details on how to query identity store events.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:getStoreEventsQueryStatus permission.

    API Permissions: TNT#{tenant}#IdentityStore:getStoreEventsQueryStatus

    Auth
    Path Params
    GET /api/identity-store/events/queries/{executionId}/status
    Responses
    200

    Query status returned successfully.

    The response is a string indiciating the state of an identity store event query in Athena. Possible values:

    • QUEUED: the query has been submitted to the service and Athena will execute the query as soon as resources are available.
    • RUNNING: the query is in execution phase.
    • SUCCEEDED: the query completed without errors.
    • FAILED: the query experienced an error and did not complete processing.
    • CANCELLED: a user input interrupted query execution.
    400

    An error occurred. Possible error codes:

    • 823: The Athena query failed to execute
    • 825: An unsupported column name was provided in a sort parameter
    401

    Unauthorized

    404

    Tenant not found.

    Response

    Get tenant statistics (key rollover, configured limits, identity store events statistics)

    Deprecated

    Returns:

    • configured limits set for the tenant such as maximum number of stores and users
    • the overall number of users added and deleted for this tenant
    • the statistics for each store defined for this tenant. For details of how stats data is populated for different types of store event, refer to Daon documentation

      Permission

      The JWT must contain the TNT#{tenant}#IdentityStore:getTenantStats permission.

      API Permissions: TNT#{tenant}#IdentityStore:getTenantStats

    Auth
    GET /api/identity-store/stats
    Responses
    200

    Tenant stats retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    Tenant not found.

    Response

    Start a store event query

    Deprecated

    Event querying may take a long time and so is implemented using three APIs:

    1. Start a query this API
    2. Get the query status. Poll until a result is available.
    3. Get the query results. Refer to Daon documentation for more details on how to query identity store events.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:startStoreEventQuery permission.

    API Permissions: TNT#{tenant}#IdentityStore:startStoreEventQuery

    Auth
    Request Body

    The query to execute

    POST /api/identity-store/events/queries/start
    Responses
    201

    Query created successfully.

    The response is a string containing the unique ID of the query execution which must be provided to the APIs which get the query status and results.

    400

    An error occurred. Possible error codes:

    • 822: Error trying to start the Athena query
    401

    Unauthorized

    404

    Tenant not found.

    Response

    User Biometric Management

    List biometric verisons for a user identified by external ID, the type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserBiometricVersionsByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserBiometricsByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/types/{type}/subtypes/{subtype}/versions/ext
    Responses
    200

    User biometric versions retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    List biometrics for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserBiometricsByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserBiometricsByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/ext
    Responses
    200

    User biometrics retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    List biometric versions for a user identified by internal ID and the type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserBiometricVersions permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserBiometricVersions

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}/versions
    Responses
    200

    User biometric versions retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    Delete a user biometric by external user ID and biometric ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserBiometricByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserBiometricByExtId

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{extId}/biometrics/{id}/ext
    Responses
    200

    User biometric deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric not found
    Response

    List biometrics for a user identified by internal ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserBiometrics permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserBiometrics

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics
    Responses
    200

    User biometrics retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    Add or update biometric within an identity store for a user identified by its internal ID

    Deprecated

    If a biometric for this user with the specified type and subtype already exists then the following fields will be updated from the request:

    • atributes- createdFromRefs- data- status.

    Otherwise a new biometric entry will be created using the details in the request with the user and store details set to reference the user and store specified in the request parameters.

    NOTE: The type, subtype and data fields of the biometric object are mandatory and the data must match the subtype.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:addUserBiometric permission.

    API Permissions: TNT#{tenant}#IdentityStore:addUserBiometric

    Auth
    Path Params
    Request Body

    The biometric to create or update

    POST /api/identity-store/stores/{storeName}/users/{userId}/biometrics
    Responses
    201

    Biometric created/updated successfully

    400

    An error occurred. Possible error codes:

    • 2002: A biometric for this user with a duplicate type and subtype exists
    • 2003: A data integrity violation occurred when saving the biometric to the database
    • 2014: The subtype biometric data is too long for the specified subtype and can't be stored in the database.
    • 2015: The user is not in a state to allow this operation.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    Update all biometrics for a user (identified by external user ID) of the specified type to the specified status

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:updateUserBiometricStatusByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserBiometricStatusByExtId

    Auth
    Path Params
    Request Body

    The biometric status information

    POST /api/identity-store/stores/{storeName}/users/{extId}/biometrics/{type}/ext
    Responses
    200

    User biometric updated successfully

    400

    An error occurred. Possible error codes:

    • 2007: All biometrics of the specified type are already in the specified state.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2009: No biometrics of the specified type found
    Response

    Get the biometric sample versions references by the biometric specified by its type, subtype and versionId

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getReferenceUserBiometrics permission.

    API Permissions: TNT#{tenant}#IdentityStore:getReferenceUserBiometrics

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}/versions/{versionId}/references
    Responses
    200

    Reference User biometric versions retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric versions not found
    Response

    Get a biometric including sensitive data for a user identified by internal ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometric permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometric

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/{id}
    Responses
    200

    User biometric retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Delete a user biometric by internal user ID and biometric ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserBiometric permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserBiometric

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/biometrics/{id}
    Responses
    200

    User biometric deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Add or update biometric within an identity store for a user identified by its external ID

    Deprecated

    If a biometric for this user with the specified type and subtype already exists then the following fields will be updated from the request:

    • atributes- createdFromRefs- data- status.

    Otherwise a new biometric entry will be created using the details in the request with the user and store details set to reference the user and store specified in the request parameters.

    NOTE: The type, subtype and data fields of the biometric object are mandatory.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:addUserBiometricByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:addUserBiometricByExtId

    Auth
    Path Params
    Request Body

    The biometric to create or update

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/biometrics/ext
    Responses
    201

    Biometric created/updated successfully

    400

    An error occurred. Possible error codes:

    • 2002: A biometric for this user with a duplicate type and subtype exists
    • 2003: A data integrity violation occurred when saving the biometric to the database
    • 2014: The subtype biometric data is too long for the specified subtype and can't be stored in the database.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    Get a biometric version including sensitive data for a user identified by external ID with the specified type, subtype and versionId

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricVersionWithTypeAndSubtypeByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricVersionWithTypeAndSubtypeByExtId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/types/{type}/subtypes/{subtype}/versions/{versionId}/ext
    Responses
    200

    User biometric version retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric not found
    Response

    Record that a failed authentication has taken place with a user biometric. The user is identified by its external ID.

    Deprecated

    If an authentication fails before the identity store must be notified so that it can record the failure and increment the user lock counter.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:recordUserBiometricAuthenticationFailureByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:recordUserBiometricAuthenticationFailureByExtId

    Auth
    Path Params
    Request Body

    Information about a failed biometric authentication

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/biometrics/authentications/failure/ext
    Responses
    200

    Failed biometric authentication recorded successfully

    400

    An error occurred. Possible error codes:

    • 2005: The specified biometric type is not supported
    • 2006: The specified biometric subtype is not supported
    • 2012: The type of the biometric data has not been specified
    • 2100: Can't authenticate because the user is locked
    • 2101: Can't authenticate because the user's modality is locked
    • 2102: Can't authenticate because the user is disabled
    • 20113: The subtype of the biometric data has not been specified.
    • 20130: The reason for the biometric authentication failure has not been specified.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    Get a biometric including sensitive data for a user identified with type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricWithTypeAndSubtype permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricWithTypeAndSubtype

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}
    Responses
    200

    User biometric retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Delete a user biometric by internal user ID and biometric type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserBiometricWithTypeAndSubtype permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserBiometricWithTypeAndSubtype

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}
    Responses
    200

    User biometric deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Get the biometric samples references by the biometric specified by its type, subtype and versionId by user external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getReferenceUserBiometricsByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getReferenceUserBiometricsByExtId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/types/{type}/subtypes/{subtype}/versions/{versionId}/references/ext
    Responses
    200

    User biometric versions retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric versions not found
    Response

    Perform a biometric face match. The user is identified by its external ID.

    Deprecated

    The face matching takes place within the identity store and the success or failure event is created. A face match sample must be provided with a type of Face, a subtype of Image or a supported template type, the data set to the image or template data and a status, typically set to ACTIVE.

    If the storeAudit configuration field is set to true in the identity store's biometric authentication configuration then a detailed audit of the biometric authentication is created.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:matchFaceByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:matchFaceByExtId

    Auth
    Path Params
    Request Body

    Information about the face authentication

    POST /api/identity-store/stores/{storeName}/users/{extId}/biometrics/authentications/face/ext
    Responses
    200

    Face matched successfully

    400

    An error occurred - including the face match failing.

    NOTE For convenience the updated user object is returned when there is a face match failure because it may contain updated information about the user lock state.

    Possible error codes:

    • 8: Face algorithm not supported
    • 2005: The biometric type is not supported
    • 2006: The biometric subtype is not supported
    • 2100: The user is locked so authentication cannot be performed
    • 2101: The face modality is locked so authentication cannot be performed
    • 2102: The user is disabled so authentication cannot be performed
    • 2103: The presented biometric is disabled so authentication cannot be performed
    • 20114: Biometric data is not supplied in the request
    • 20115: The specified biometric type is not supported
    • 20120: An unexpected error occurred while generating face template
    • 20121: An error occurred while attempting to perform a face match
    • 20122: There is no suitable face data available for matching against the presented sample
    • 20123: The matching process data is missing from the request
    • 20124: The matching algorithm is missing from the request
    • 20125: The matching threshold must be between 0 and 1
    • 20126: The internal matching threshold must be between 0 and 1
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2013: Biometric data not found for the specified user
    Response

    Record that a failed authentication has taken place with a user biometric. The user is identified by its internal ID.

    Deprecated

    If an authentication fails before the identity store must be notified so that it can record the failure and increment the user lock counter.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:recordUserBiometricAuthenticationFailure permission.

    API Permissions: TNT#{tenant}#IdentityStore:recordUserBiometricAuthenticationFailure

    Auth
    Path Params
    Request Body

    Information about a failed biometric authentication

    POST /api/identity-store/stores/{storeName}/users/{userId}/biometrics/authentications/failure
    Responses
    200

    Failed biometric authentication recorded successfully

    400

    An error occurred. Possible error codes:

    • 2005: The specified biometric type is not supported
    • 2006: The specified biometric subtype is not supported
    • 2012: The type of the biometric data has not been specified
    • 2100: Can't authenticate because the user is locked
    • 2101: Can't authenticate because the user's modality is locked
    • 2102: Can't authenticate because the user is disabled
    • 20113: The subtype of the biometric data has not been specified.
    • 20130: The reason for the biometric authentication failure has not been specified.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    Get a biometric version sensitive data for a user identified with type and subtype and version Id

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricVersionDataWithTypeAndSubtype permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricVersionDataWithTypeAndSubtype

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}/versions/{versionId}/data
    Responses
    200

    User biometric version retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Perform a biometric face match. The user is identified by its internal ID.

    Deprecated

    The face matching takes place within the identity store and the success or failure event is created. A face match sample must be provided with a type of Face, a subtype of Image or a supported template type, the data set to the image or template data and a status, typically set to ACTIVE.

    If the storeAudit configuration field is set to true in the identity store's biometric authentication configuration then a detailed audit of the biometric authentication is created.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:matchFace permission.

    API Permissions: TNT#{tenant}#IdentityStore:matchFace

    Auth
    Path Params
    Request Body

    Information about the face authentication

    POST /api/identity-store/stores/{storeName}/users/{userId}/biometrics/authentications/face
    Responses
    200

    Face matched successfully

    400

    An error occurred - including the face match failing.

    NOTE For convenience the updated user object is returned when there is a face match failure because it may contain updated information about the user lock state.

    Possible error codes:

    • 8: Face algorithm not supported
    • 2005: The biometric type is not supported
    • 2006: The biometric subtype is not supported
    • 2100: The user is locked so authentication cannot be performed
    • 2101: The face modality is locked so authentication cannot be performed
    • 2102: The user is disabled so authentication cannot be performed
    • 2103: The presented biometric is disabled so authentication cannot be performed
    • 20114: Biometric data is not supplied in the request
    • 20115: The specified biometric type is not supported
    • 20120: An unexpected error occurred while generating face template
    • 20121: An error occurred while attempting to perform a face match
    • 20122: There is no suitable face data available for matching against the presented sample
    • 20123: The matching process data is missing from the request
    • 20124: The matching algorithm is missing from the request
    • 20125: The matching threshold must be between 0 and 1
    • 20126: The internal matching threshold must be between 0 and 1
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2013: Biometric data not found for the specified user
    Response

    Get a biometric including sensitive data for a user identified by external ID with the specified type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricWithTypeAndSubtypeByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricWithTypeAndSubtypeByExtId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/types/{type}/subtypes/{subtype}/ext
    Responses
    200

    User biometric retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric not found
    Response

    Get a biometric version including sensitive data for a user identified with type and subtype and version Id

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricVersionWithTypeAndSubtype permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricVersionWithTypeAndSubtype

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/biometrics/types/{type}/subtypes/{subtype}/versions/{versionId}
    Responses
    200

    User biometric version retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2001: Biometric not found
    Response

    Get a biometric including sensitive data for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserBiometricByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserBiometricByExtId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/biometrics/{id}/ext
    Responses
    200

    User biometric retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric not found
    Response

    Update all biometrics for a user (identified by internal user ID) of the specified type to the specified status

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:updateUserBiometricStatus permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserBiometricStatus

    Auth
    Path Params
    Request Body

    The biometric status information

    POST /api/identity-store/stores/{storeName}/users/{userId}/biometrics/{type}
    Responses
    200

    User biometric updated successfully

    400

    An error occurred. Possible error codes:

    • 2007: All biometrics of the specified type are already in the specified state.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 2009: No biometrics of the specified type found
    Response

    Delete a user biometric by external user ID and biometric type and subtype

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserBiometricWithTypeAndSubtypeByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserBiometricWithTypeAndSubtypeByExtId

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{extId}/biometrics/types/{type}/subtypes/{subtype}/ext
    Responses
    200

    User biometric deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 2001: Biometric not found
    Response

    User Appkey Management

    Delete registered appkeys from a device given an appkey's key ID from the device itself and the user identified by its internal ID.

    Deprecated

    This API supports an appkey deregistration flow in which a key ID of an appkey to delete is sent from the device client. The appkey is deleted on the server and a deregistration request message is provided which is sent to the client to delete the key.

    The default behaviour is to delete the specified appkey from the server and generate a deregistration request to delete than single key from the client. A mode parameter may be supplied to delete:

    • all appkeys of the same type on the same device as the specified appkey
    • all appkeys for the same device as the specified appkey
    • all appkeys registered for the same user as the specified appkey

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deregisterUserAppkeyByUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deregisterUserAppkeyByUserId

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/registrations/keyIds/{keyId}
    Responses
    200

    User appkey(s) deleted successfully

    400

    An error occurred. Possible error codes:

    • 1068: The specified appkey is not registered to the specified user
    • 1100: The specified appkey does not have a registered device ID so the requested appkeys belonging to the same device cannot be deleted.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1058: Appkey not found
    Response

    Delete registered appkeys for a user (identified by internal ID) and create a deregistration request for the client. Appkeys can be deleted by type (silent, biometric) or AAID and can be restricted to a device or can be deleted across all devices for that user.

    Deprecated

    This API supports an TrustX process deregistration flow where the device ID and deregistration options (AAIDs, types to delete) are specified. The appkeys are deleted on the server and a deregistration request message is provided which is sent to the client to delete the keys.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deregisterUserAppkeys permission.

    API Permissions: TNT#{tenant}#IdentityStore:deregisterUserAppkeys

    Auth
    Path Params
    Request Body
    POST /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/deregistrations
    Responses
    200

    User appkey(s) deleted successfully

    400

    An error occurred. Possible error codes:

    • 1122: Parameters not supplied
    • 1123: AAID options are empty in the supplied parameters.
    • 1124: Appkey type options are empty in the supplied parameters.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    • 1125: No registered appkeys found for this device
    • 1126: No registered appkeys found for this device and RP ID
    • 1127: No registered appkeys found for this device and AAID
    • 1128: No registered appkeys found for this device and AAIDs
    • 1129: No registered appkeys found for this device and appkey type
    • 1130: No registered appkeys found for this device and appkey types
    • 1132: No registered appkeys found for this relying party
    • 1133: No registered appkeys found for this relying party and AAID
    • 1134: No registered appkeys found for this relying party and AAIDs
    • 1135: No registered appkeys found for this relying party and appkey type
    • 1136: No registered appkeys found for this relying party and appkey types
    Response

    Complete an appkey authentication for an externally managed session.

    Deprecated

    This API is used to complete an appkey authentication where the appkey configuration sessionManagementExternal parameter is set to true which means that the session data object was returned when the authentication was requested and must be provided back to the server along with the response from the client.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:completeAppkeyAuthenticationWithSession permission.

    API Permissions: TNT#{tenant}#IdentityStore:completeAppkeyAuthenticationWithSession

    Auth
    Path Params
    Request Body

    The client authentication response message and session data object.

    POST /api/identity-store/stores/{storeName}/appkeys/authentications
    Responses
    200

    Appkey authentication completed successfully

    Headers
    Body
    400

    An error occurred either on the server or the client. Not all the error codes are listed here as there are many and a lot of them are unlikely to occur when integrating a validated appkey client.

    NOTE For convenience the updated user object is returned when there is an authentication error because it may contain updated information about the user lock state.

    Some of the more likely errors are:

    • 502: The user associated with this authentication is not active- 1009: Session data not provided
    • 1011: Session data is missing the challenge
    • 1012: Session data is missing the relying party ID
    • 1017: The supplied client response message is not an authentication, it's a registration for example
    • 1026: The application on the client device is not registered in the trusted facets list of the appkey policy
    • 1029: The session challenge does not match the challenge in the client response
    • 1035: The appkey type is not supported- 1055: Session data is missing the policy
    • 1056: Session data is missing authentication policy name
    • 1058: No appkey was found which matched the appkey key ID supplied in the authentication assertion
    • 1059: The appkey referenced in the authentication assertion was not registered to the expected user
    • 1060: The appkey referenced in the authentication assertion is not active
    • 1061: Potential appkey clone detected, the signature count is lower than expected.
    • 1090: The single-shot challenge timestamp is outside the valid time window
    • 1091: Malformed authentication response message from the client
    • 1092: Client response message contains no authentication responses
    • 1093: Client response message contains multiple authentication responses
    • 1102: Malformed authentication failure response message from the client
    • 1104: The authentication failed on the client
    • 1105: The authentication was cancelled by the client
    • 1115: Operation success/failure response data not provided
    • 2100: The user is locked. Authentication cannot proceed.
    • 2101: The user appkey modality is locked. Authentication cannot proceed.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found by supplied user ID in session data
    • 1000: Appkey relying party not found
    • 1002: Appkey authentication policy not found
    Response

    List registered appkeys for a user (identified by internal ID) optionally filtered by device

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserAppkeys permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserAppkeys

    Auth
    Path Params
    Query String
    GET /api/identity-store/stores/{storeName}/users/{userId}/appkeys
    Responses
    200

    User appkeys retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    Create an appkey authentication request for a known user identified by external ID using the specified authentication policy for the specified relying party

    Deprecated

    The authentication request returned from the server must be supplied to the client to initiate a user appkey authentication. The response from the client is returned to the server to complete server authentication.

    Session data is shared between the authentication request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the authentication is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the authentication is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyAuthenticationForUserByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyAuthenticationForUserByExtId

    Auth
    Path Params
    Request Body

    Additional authentication parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/appkeys/relyingParties/{rpId}/authentications/{authPolicyName}/ext
    Responses
    201

    Appkey authentication request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1054: The provided transaction image could not be read.
    • 10541: The provided transaction image is not supported or not a valid image.
    • 1139: None of the appkeys allowed for this authentication support transaction processing.
    • 2100: The user is locked. Authentication cannot proceed.
    • 2101: The user appkey modality is locked. Authentication cannot proceed.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    • 1002: Appkey authentication policy not found
    Response

    Create an anonymous appkey authentication request (where a user is not supplied) using the specified authentication policy for the specified relying party

    Deprecated

    The authentication request returned from the server must be supplied to the client to initiate a user appkey authentication. The response from the client is returned to the server to complete server authentication.

    Session data is shared between the authentication request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the authentication is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the authentication is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyAuthentication permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyAuthentication

    Auth
    Path Params
    Request Body

    Additional authentication parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/appkeys/relyingParties/{rpId}/authentications/{authPolicyName}
    Responses
    201

    Appkey authentication request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1138: Transaction content is not supported for login authentications.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 1000: Appkey relying party ID not found
    • 1002: Appkey authentication policy not found
    Response

    Get a user appkey registration record for a user identified by internal ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserAppkeyRegistrationRecord permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserAppkeyRegistrationRecord

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/appkeys/{id}/registrationAudit
    Responses
    200

    User appkey registration record retrieved successfully

    400

    An error occurred. Possible error codes:

    • 1087: Failed to decompress and deserialize audit record
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1067: Appkey not found
    • 1086: Appkey registration not found
    Response

    Set a preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.

    Deprecated

    If a customer has multiple deployments of an app across multiple devices it may be useful to set a single device to receive push notifications.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:updateUserAppkeyPreferredDeviceByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserAppkeyPreferredDeviceByExtUserId

    Auth
    Path Params
    Request Body

    The preferred device identifier.

    POST /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/relyingParties/{rpId}/preferredDevices/ext
    Responses
    200

    User updated with the preferred device

    400

    An error occurred. Possible error codes:

    • 1117: The preferred device ID is missing from the request.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    • 1118: Device ID not found (no appkeys registered for this device ID)
    Response

    Clear the preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:clearUserAppkeyPreferredDeviceByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:clearUserAppkeyPreferredDeviceByExtUserId

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/relyingParties/{rpId}/preferredDevices/ext
    Responses
    200

    Preferred device cleared from user

    400

    An error occurred. Possible error codes:

    • 1132: No appkeys are registered for this RP ID
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    Response

    Set a preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.

    Deprecated

    If a customer has multiple deployments of an app across multiple devices it may be useful to set a single device to receive push notifications.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:updateUserAppkeyPreferredDevice permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserAppkeyPreferredDevice

    Auth
    Path Params
    Request Body

    The preferred device identifier.

    POST /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/preferredDevices
    Responses
    200

    User updated with the preferred device

    400

    An error occurred. Possible error codes:

    • 1117: The preferred device ID is missing from the request.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    • 1118: Device ID not found (no appkeys registered for this device ID)
    Response

    Clear the preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:clearUserAppkeyPreferredDevice permission.

    API Permissions: TNT#{tenant}#IdentityStore:clearUserAppkeyPreferredDevice

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/preferredDevices
    Responses
    200

    Preferred device cleared from user

    400

    An error occurred. Possible error codes:

    • 1132: No appkeys are registered for this RP ID
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    Response

    Complete an appkey authentication for an internally managed session.

    Deprecated

    This API is used to complete an appkey authentication where the appkey configuration sessionManagementExternal parameter is set to false which means that a session ID of an internally managed session was returned when the authentication was requested and must be provided back to the server along with the response from the client.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:completeAppkeyAuthenticationWithSessionId permission.

    API Permissions: TNT#{tenant}#IdentityStore:completeAppkeyAuthenticationWithSessionId

    Auth
    Path Params
    Request Body

    The client authentication response message.

    POST /api/identity-store/stores/{storeName}/appkeys/authentications/sessions/{sessionId}
    Responses
    200

    Appkey authentication completed successfully

    Headers
    Body
    400

    An error occurred either on the server or the client. Not all the error codes are listed here as there are many and a lot of them are unlikely to occur when integrating with a validated appkey client.

    NOTE For convenience the updated user object is returned when there is an authentication error because it may contain updated information about the user lock state.

    Some of the more likely errors are:

    • 502: The user associated with this authentication is not active- 1014: Session data was provided but session management for this authentication is configured as internal
    • 1017: The supplied client response message is not an authentication, it's a registration for example
    • 1026: The application on the client device is not registered in the trusted facets list of the appkey policy
    • 1029: The session challenge does not match the challenge in the client response
    • 1035: The appkey type is not supported- 1058: No appkey was found which matched the appkey key ID supplied in the authentication assertion
    • 1059: The appkey referenced in the authentication assertion was not registered to the expected user
    • 1060: The appkey referenced in the authentication assertion is not active
    • 1061: Potential appkey clone detected, the signature count is lower than expected.
    • 1090: The single-shot challenge timestamp is outside the valid time window
    • 1091: Malformed authentication response message from the client
    • 1092: Client response message contains no authentication responses
    • 1093: Client response message contains multiple authentication responses
    • 1102: Malformed authentication failure response message from the client
    • 1104: The authentication failed on the client
    • 1105: The authentication was cancelled by the client
    • 1115: Operation success/failure response data not provided
    • 2100: The user is locked. Authentication cannot proceed.
    • 2101: The user appkey modality is locked. Authentication cannot proceed.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found by supplied user ID in session data
    • 1000: Appkey relying party not found
    • 1002: Appkey authentication policy not found
    • 1052: Session data for the specified session ID not found.
    Response

    Create an appkey authentication request for a known user identified by internal ID using the specified authentication policy for the specified relying party

    Deprecated

    The authentication request returned from the server must be supplied to the client to initiate a user appkey authentication. The response from the client is returned to the server to complete server authentication.

    Session data is shared between the authentication request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the authentication is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the authentication is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyAuthenticationForUser permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyAuthenticationForUser

    Auth
    Path Params
    Request Body

    Additional authentication parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/authentications/{authPolicyName}
    Responses
    201

    Appkey authentication request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1054: The provided transaction image could not be read.
    • 10541: The provided transaction image is not supported or not a valid image.
    • 1139: None of the appkeys allowed for this authentication support transaction processing.
    • 2100: The user is locked. Authentication cannot proceed.
    • 2101: The user appkey modality is locked. Authentication cannot proceed.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    • 1002: Appkey authentication policy not found
    Response

    Delete registered appkeys for a user (identified by external ID) and create a deregistration request for the client. Appkeys can be deleted by type (silent, biometric) or AAID and can be restricted to a device or can be deleted across all devices for that user.

    Deprecated

    This API supports an TrustX process deregistration flow where the device ID and deregistration options (AAIDs, types to delete) are specified. The appkeys are deleted on the server and a deregistration request message is provided which is sent to the client to delete the keys.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deregisterUserAppkeysByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deregisterUserAppkeysByExtUserId

    Auth
    Path Params
    Request Body
    POST /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/relyingParties/{rpId}/deregistrations/ext
    Responses
    200

    User appkey(s) deleted successfully

    400

    An error occurred. Possible error codes:

    • 1122: Parameters not supplied
    • 1123: AAID options are empty in the supplied parameters.
    • 1124: Appkey type options are empty in the supplied parameters.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    • 1125: No registered appkeys found for this device
    • 1126: No registered appkeys found for this device and RP ID
    • 1127: No registered appkeys found for this device and AAID
    • 1128: No registered appkeys found for this device and AAIDs
    • 1129: No registered appkeys found for this device and appkey type
    • 1130: No registered appkeys found for this device and appkey types
    • 1132: No registered appkeys found for this relying party
    • 1133: No registered appkeys found for this relying party and AAID
    • 1134: No registered appkeys found for this relying party and AAIDs
    • 1135: No registered appkeys found for this relying party and appkey type
    • 1136: No registered appkeys found for this relying party and appkey types
    Response

    Complete an appkey registration for an externally managed session.

    Deprecated

    This API is used to complete an appkey registration where the appkey configuration sessionManagementExternal parameter is set to true which means that the session data object was returned when the registration was requested and must be provided back to the server along with the response from the client.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:completeAppkeyRegistrationWithSession permission.

    API Permissions: TNT#{tenant}#IdentityStore:completeAppkeyRegistrationWithSession

    Auth
    Path Params
    Request Body

    The client registration response message and session data object.

    POST /api/identity-store/stores/{storeName}/appkeys/registrations
    Responses
    200

    Appkey registration completed successfully

    Headers
    Body
    400

    An error occurred either on the server or the client. Not all the error codes are listed here as there are many and a lot of them are unlikely to occur when integrating with a valid appkey client. Some of the more likely errors are:

    • 501: When registration was requested neither a user object nor an external user ID was supplied therefore a user can't be found or created to associate with this appkey registration
    • 1009: Session data not provided
    • 1010: Session data is missing registration policy name
    • 1011: Session data is missing the challenge
    • 1012: Session data is missing the relying party ID
    • 1017: The supplied client response message is not a registration, it's an authentication for example
    • 1026: The application on the client device is not registered in the trusted facets list of the appkey policy
    • 1029: The session challenge does not match the challenge in the client response
    • 1035: The appkey type is not supported- 1050: The registered appkeys do not satisfy the registration policy- 1055: Session data is missing the policy
    • 1094: Malformed registration response message from the client
    • 1095: Client response message contains no registration responses
    • 1096: Client response message contains multiple registration responses
    • 1098: Maximum number of appkeys exceeded for this user
    • 1115: Operation success/failure response data not provided
    • 1116: Appkey registration failed on the client
    • 1121: Appkey registration cancelled on the client
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found by supplied user ID in session data
    • 1000: Appkey relying party not found
    • 1001: Appkey registration policy not found
    Response

    List registered appkeys for a user (identified by external ID) optionally filtered by device

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserAppkeysByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserAppkeysByExtUserId

    Auth
    Path Params
    Query String
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/ext
    Responses
    200

    User appkeys retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    Create an appkey registration request for a user identified by an optional external ID using the specified registration policy for the specified relying party

    Deprecated

    The request optionally contains the external ID of the user for whom the registration will be created. If this is not supplied an external ID with a random 32-character alphanumeric ID will be generated by the server and returned in the session data. A user will be created with this ext ID when registration is completed and the appkey will be registered to that user.

    The registration request returned from the server must be supplied to the client on the device to initiate a user appkey registration. The response from the client is returned to the server to complete registration and store the generated appkey in the server.

    Session data is shared between the registration request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the registration is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the registration is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyRegistration permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyRegistration

    Auth
    Path Params
    Request Body

    Additional registration parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/appkeys/relyingParties/{rpId}/registrations/{regPolicyName}
    Responses
    201

    Appkey registration request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1120: The user is not in a state to allow appkey registration
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 1000: Appkey relying party ID not found
    • 1001: Appkey registration policy not found
    Response

    Update an existing appkey's status by external user ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:updateUserAppkeyStatusByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserAppkeyStatusByExtId

    Auth
    Path Params
    Request Body

    The user appkey update information

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/appkeys/{id}/ext
    Responses
    200

    User appkey updated successfully

    400

    An error occurred. Possible error codes:

    • 1114: No update information provided
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1067: Appkey not found
    Response

    Delete the preferred device for notifications relating to a relying party's apps. The user is identified by its internal ID.

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserAppkeyPreferredDevice permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserAppkeyPreferredDevice

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/preferredDevice/{deviceId}
    Responses
    200

    Preferred device deleted from user

    400

    An error occurred. Possible error codes:

    • 1119: The specified device ID is not a preferred device for this RP ID
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    • 1118: Device ID not found
    Response

    Delete user appkeys by internal user ID for a specified device

    Deprecated

    Deletes all user appkeys registered on a particular device

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserAppkeysForDevice permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserAppkeysForDevice

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/appkeys/devices/{id}
    Responses
    200

    User appkeys deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 10671: Appkeys not found
    Response

    Get an appkey for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserAppkeyByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserAppkeyByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/{id}/ext
    Responses
    200

    User appkey retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1067: Appkey not found
    Response

    Delete a user appkey by external user ID and internal appkey ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserAppkeyByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserAppkeyByExtUserId

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/{id}/ext
    Responses
    200

    User appkey deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1067: Appkey not found
    Response

    Delete the preferred device for notifications relating to a relying party's apps. The user is identified by its external ID.

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserAppkeyPreferredDeviceByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserAppkeyPreferredDeviceByExtUserId

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/relyingParties/{rpId}/preferredDevice/{deviceId}/ext
    Responses
    200

    Preferred device deleted from user

    400

    An error occurred. Possible error codes:

    • 1119: The specified device ID is not a preferred device for this RP ID
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    • 1118: Device ID not found
    Response

    Get a user appkey registration record for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserAppkeyRegistrationRecordByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserAppkeyRegistrationRecordByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/{id}/registrationAudit/ext
    Responses
    200

    User appkey registration record retrieved successfully

    400

    An error occurred. Possible error codes:

    • 1087: Failed to decompress and deserialize audit record
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1067: Appkey not found
    • 1086: Appkey registration not found
    Response

    Get an appkey for a user identified by internal ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserAppkey permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserAppkey

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/appkeys/{id}
    Responses
    200

    User appkey retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1067: Appkey not found
    Response

    Update an existing appkey's status by internal user ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:updateUserAppkeyStatus permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserAppkeyStatus

    Auth
    Path Params
    Request Body

    The user appkey update information

    POST /api/identity-store/stores/{storeName}/users/{userId}/appkeys/{id}
    Responses
    200

    User appkey updated successfully

    400

    An error occurred. Possible error codes:

    • 1114: No update information provided
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1067: Appkey not found
    Response

    Delete a user appkey by internal user ID and appkey ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserAppkey permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserAppkey

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/appkeys/{id}
    Responses
    200

    User appkey deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1067: Appkey not found
    Response

    Create an appkey registration request for an existing user identified by its external ID within an identity store using the specified registration policy for the specified relying party

    Deprecated

    The registration request returned from the server must be supplied to the client on the device to initiate a user appkey registration. The response from the client is returned to the server to complete registration and store the generated appkey in the server.

    Session data is shared between the registration request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the registration is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the registration is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyRegistrationForUserByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyRegistrationForUserByExtId

    Auth
    Path Params
    Request Body

    Additional registration parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/appkeys/relyingParties/{rpId}/registrations/{regPolicyName}/ext
    Responses
    201

    Appkey registration request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1120: The user is not in a state to allow appkey registration
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1000: Appkey relying party ID not found
    • 1001: Appkey registration policy not found
    Response

    Delete user appkeys by external user ID for a specified device

    Deprecated

    Deletes all user appkeys registered on a particular device

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deleteAllUserAppkeysForDeviceByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteAllUserAppkeysForDeviceByExtUserId

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/devices/{id}/ext
    Responses
    200

    User appkeys deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 10671: Appkeys not found
    Response

    Delete registered appkeys from a device given an appkey's key ID from the device itself and the user identified by its external ID.

    Deprecated

    This API supports an appkey deregistration flow in which a key ID of an appkey to delete is sent from the device client. The appkey is deleted on the server and a deregistration request message is provided which is sent to the client to delete the key.

    The default behaviour is to delete the specified appkey from the server and generate a deregistration request to delete than single key from the client. A mode parameter may be supplied to delete:

    • all appkeys of the same type on the same device as the specified appkey
    • all appkeys for the same device as the specified appkey
    • all appkeys registered for the same user as the specified appkey

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:deregisterUserAppkeyByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deregisterUserAppkeyByExtUserId

    Auth
    Path Params
    Query String
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/appkeys/relyingParties/{rpId}/registrations/keyIds/{keyId}/ext
    Responses
    200

    User appkey(s) deleted successfully

    400

    An error occurred. Possible error codes:

    • 1068: The specified appkey is not registered to the specified user
    • 1100: The specified appkey does not have a registered device ID so the requested appkeys belonging to the same device cannot be deleted.
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 1058: Appkey not found
    Response

    Complete an appkey registration for an internally managed session.

    Deprecated

    This API is used to complete an appkey registration where the appkey configuration sessionManagementExternal parameter is set to false which means that a session ID of an internally managed session was returned when the registration was requested and must be provided back to the server along with the response from the client.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:completeAppkeyRegistrationWithSessionId permission.

    API Permissions: TNT#{tenant}#IdentityStore:completeAppkeyRegistrationWithSessionId

    Auth
    Path Params
    Request Body

    The client registration response message.

    POST /api/identity-store/stores/{storeName}/appkeys/registrations/sessions/{sessionId}
    Responses
    200

    Appkey registration completed successfully

    Headers
    Body
    400

    An error occurred either on the server or the client. Not all the error codes are listed here as there are many and a lot of them are unlikely to occur when integrating with a validated appkey client. Some of the more likely errors are:

    • 501: When registration was requested neither a user object nor an external user ID was supplied therefore a user can't be found or created to associate with this appkey registration
    • 1014: Session data was provided but session management for this registration is configured as internal
    • 1017: The supplied client response message is not a registration, it's an authentication for example
    • 1026: The application on the client device is not registered in the trusted facets list of the appkey policy
    • 1029: The session challenge does not match the challenge in the client response
    • 1035: The appkey type is not supported- 1050: The registered appkeys do not satisfy the registration policy- 1094: Malformed registration response message from the client
    • 1095: Client response message contains no registration responses
    • 1096: Client response message contains multiple registration responses
    • 1098: Maximum number of appkeys exceeded for this user
    • 1115: Operation success/failure response data not provided
    • 1116: Appkey registration failed on the client
    • 1121: Appkey registration cancelled on the client
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found by supplied user ID in session data
    • 1000: Appkey relying party not found
    • 1001: Appkey registration policy not found
    Response

    Create an appkey registration request for an existing user identified by its internal ID within an identity store using the specified registration policy for the specified relying party

    Deprecated

    The registration request returned from the server must be supplied to the client on the device to initiate a user appkey registration. The response from the client is returned to the server to complete registration and store the generated appkey in the server.

    Session data is shared between the registration request and completion API calls. If in the appkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the registration is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the registration is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createAppkeyRegistrationForUser permission.

    API Permissions: TNT#{tenant}#IdentityStore:createAppkeyRegistrationForUser

    Auth
    Path Params
    Request Body

    Additional registration parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/users/{userId}/appkeys/relyingParties/{rpId}/registrations/{regPolicyName}
    Responses
    201

    Appkey registration request created successfully

    400

    An error occurred. Possible error codes:

    • 1004: The appkey policy does not contain accepted match criteria
    • 1120: The user is not in a state to allow appkey registration
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 1000: Appkey relying party ID not found
    • 1001: Appkey registration policy not found
    Response

    User Passkey Management

    Create a passkey credential creation request for an existing user identified by its external ID within an identity store using the specified registration policy for the specified relying party

    Deprecated

    The credential creation request returned from the server must be supplied to the user agent on the device to initiate a passkey registration. The response from the user agent is returned to the server to complete registration and store the generated paskey in the server.

    Session data is shared between the registration request and completion API calls. If in the passkey configuration sessionManagementExternal is set to false then these session data are managed internally by the server and a session ID is returned by this API which must be provided when the registration is completed. Otherwise if sessionManagementExternal is true the session data itself is returned by the API and must be provided when the registration is completed. If session data is managed internally it is stored temporarily for the duration configured as sessionDuration.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:createPasskeyRegistrationForUserByExtId permission.

    API Permissions: TNT#{tenant}#IdentityStore:createPasskeyRegistrationForUserByExtId

    Auth
    Path Params
    Request Body

    Additional registration parameters. May be empty.

    POST /api/identity-store/stores/{storeName}/users/{userExtId}/passkeys/relyingParties/{rpId}/registrations/{regPolicyName}/ext
    Responses
    201

    Passkey credential creation request created successfully

    400

    An error occurred. Possible error codes

    • 1120: The user is not in a state to allow passkey registration
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 235: Passkey relying party ID not found
    • 233: Passkey registration policy not found
    Response

    Complete a passkey credential creation request for an internally managed session.

    Deprecated

    This API is used to complete a passkey registration where the passkey configuration sessionManagementExternal parameter is set to false which means that a session ID of an internally managed session was returned when the registration was requested and must be provided back to the server along with the response from the client.

    Permission

    The JWT must contain the TNT#{tenant}#IdentityStore:completePasskeyRegistrationWithSessionId permission.

    API Permissions: TNT#{tenant}#IdentityStore:completePasskeyRegistrationWithSessionId

    Auth
    Path Params
    Request Body

    The user agent registration response message and session data object.

    POST /api/identity-store/stores/{storeName}/passkeys/registrations/sessions/{sessionId}
    Responses
    200

    Passkey registration completed successfully

    400

    An error occurred either on the server or the client. Not all the error codes are listed here as there are many and a lot of them are unlikely to occur when integrating with a valid user agent. Some of the more likely errors are:

    • 352: The supplied client response message is not a registration, it's an authentication
    • 353: The provided challenge is not the same as the challenge signed in the assertion
    • 354: The origin in the client response is not in the restricted origins list
    • 356: Token binding in the client response does not match the expected value
    • 356: Token binding status missing from client response
    • 382: The origin in the client response does not start with https
    • 383: The origin in the client response does not match the relying party ID
    • 388: Session data was provided but session management for this registration is configured as internal
    • 389: Maximum number of passkeys exceeded for this user
    • 395: Operation success/failure response data not provided
    • 396: Passkey registration failed on the client
    • 399: Passkey registration was cancelled on the client
    • 401: The supplied user handle does not match the existing user handle for this user.
    • 402: Passkey registration timed out on the client
    • 501: When registration was requested neither a user object nor an external user ID was supplied therefore a user can't be found or created to associate with this passkey registration
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found by supplied user ID in session data
    • 235: Passkey relying party ID not found
    • 233: Passkey registration policy not found
    Response

    Get a passkey for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserPasskeyByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserPasskeyByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/passkeys/{id}/ext
    Responses
    200

    User passkey retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 390: Passkey not found
    Response

    Delete a user passkey by external user ID and internal passkey ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserPasskeyByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserPasskeyByExtUserId

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{extUserId}/passkeys/{id}/ext
    Responses
    200

    User passkey deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 390: Passkey not found
    Response

    Get a user passkey registration record for a user identified by external ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserPasskeyRegistrationRecordByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserPasskeyRegistrationRecordByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/passkeys/{id}/registrationAudit/ext
    Responses
    200

    User passkey registration record retrieved successfully

    400

    An error occurred. Possible error codes:

    • 392: Failed to decompress and deserialize audit record
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    • 390: Passkey not found
    • 391: Passkey registration not found
    Response

    Get a passkey for a user identified by internal ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:getUserPasskey permission.

    API Permissions: TNT#{tenant}#IdentityStore:getUserPasskey

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/passkeys/{id}
    Responses
    200

    User passkey retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 390: Passkey not found
    Response

    Update an existing passkey's name and/or status by internal user ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:updateUserPasskeyStatus permission.

    API Permissions: TNT#{tenant}#IdentityStore:updateUserPasskeyStatus

    Auth
    Path Params
    Request Body

    The user passkey update information

    POST /api/identity-store/stores/{storeName}/users/{userId}/passkeys/{id}
    Responses
    200

    User passkey updated successfully

    400

    An error occurred. Possible error codes:

    • 393: No update information provided
    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 390: Passkey not found
    Response

    Delete a user passkey by internal user ID and passkey ID

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:deleteUserPasskey permission.

    API Permissions: TNT#{tenant}#IdentityStore:deleteUserPasskey

    Auth
    Path Params
    DELETE /api/identity-store/stores/{storeName}/users/{userId}/passkeys/{id}
    Responses
    200

    User passkey deleted successfully

    No response body
    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    • 390: Passkey not found
    Response

    List registered passkeys for a user (identified by internal ID)

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserPasskeys permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserPasskeys

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{userId}/passkeys
    Responses
    200

    User passkeys retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 500: User not found
    Response

    List registered passkeys for a user (identified by external ID)

    Deprecated

    ### Permission The JWT must contain the TNT#{tenant}#IdentityStore:listUserPasskeysByExtUserId permission.

    API Permissions: TNT#{tenant}#IdentityStore:listUserPasskeysByExtUserId

    Auth
    Path Params
    GET /api/identity-store/stores/{storeName}/users/{extUserId}/passkeys/ext
    Responses
    200

    User passkeys retrieved successfully

    400

    An error occurred.

    401

    Unauthorized

    404

    A required entity was not found. Possible error codes:

    • 90: Tenant not found
    • 100: Store not found
    • 503: User not found
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response

    Responses
    Response