Identity API

Base URL: https://id.epilot.cloud
API Docs: https://docs.epilot.io/api/identity

epilot as an OpenID Connect provider ("Sign in with epilot").

Quick Start

# List available operations
epilot identity

# Call an operation
epilot identity listClients

Common Flags

Flag	Description
`-p key=value`	Set a named parameter
`-d '{...}'`	Request body JSON
`-H 'Key: Value'`	Custom header
`-t, --token <token>`	Bearer token for authentication
`--profile <name>`	Use a named profile
`-s, --server <url>`	Override server base URL
`-i, --include`	Include response headers in output
`--json`	Output raw JSON (no formatting)
`-v, --verbose`	Verbose output (show request details)
`--jsonata <expr>`	JSONata expression to transform response
`--definition <file>`	Override OpenAPI spec file/URL
`--guided`	Prompt for all parameters interactively
`--no-interactive`	Disable interactive prompts

Operations

Operator Clients

listClients — List registered partner clients. The client secret is never returned.
createOidcClient — Create a partner client in draft status. The client secret is returned exactly once in this
getOidcClient — Read a partner client. The client secret is never returned.
updateClient — Replace the mutable configuration of a client. config_version must equal the current
retireClient — Retire a client. The record is kept as a tombstone, the client_id is never reused, every
activateClient — Activate a draft or suspended client. Validates that every redirect URI is an absolute
suspendClient — Immediately block the client for every organization. Provider-side artefacts (codes, tokens,
rotateClientSecret — Issue a new client secret. The new secret is returned exactly once. The previous secret

Operator Organizations

listClientOrganizations — List the organizations enabled on a client, including suspended and revoked ones.
enableClientOrganization — Enable an epilot organization on a client, recording the customer's authorization policy
getClientOrganization — Read one organization enablement.
updateClientOrganization — Record a new version of the customer's authorization policy. expected_policy_version must
revokeClientOrganization — Revoke an organization's enablement. The record is kept as an audited tombstone; future
suspendClientOrganization — Temporarily block one organization on this client. Reversible with activateClientOrganization.
activateClientOrganization — Resume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization ag

Session

createIdentitySession — Called by the epilot portal through the portal-host proxy after every persisted 360 session.
deleteIdentitySession — Clears the identity_session cookie. Called by the portal on logout.

Launch

launchClient — One validated place for partner start links (manager UI, hosted apps). Redirects the browser to the

`listClients`

List registered partner clients. The client secret is never returned.

GET /v1/identity/operator/clients

Parameters

Name	In	Type	Required	Description
`partner_key`	query	string	No	Filter by partner key
`status`	query	"draft" \| "active" \| "suspended" \| "retired"	No
`size`	query	number	No
`cursor`	query	string	No	Opaque cursor from a previous response

Sample Call

epilot identity listClients

With JSONata filter:

epilot identity listClients --jsonata 'results[0]'

Sample Response

{
  "results": [
    {
      "client_id": "bf-prod-x7k2",
      "partner_key": "string",
      "display_name": "string",
      "description": "string",
      "environment": "dev",
      "redirect_uris": ["https://partner.example.com/auth/callback"],
      "sector_identifier_uri": "https://partner.example.com/auth/callback",
      "initiate_login_uri": "https://partner.example.com/auth/callback",
      "launch_target_prefixes": ["string"],
      "token_endpoint_auth_method": "client_secret_basic",
      "grant_types": ["authorization_code"],
      "scopes_allowed": ["openid"],
      "status": "draft",
      "status_reason": "string",
      "config_version": 1,
      "secret_rotated_at": "1970-01-01T00:00:00.000Z",
      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
      "created_at": "1970-01-01T00:00:00.000Z",
      "updated_at": "1970-01-01T00:00:00.000Z",
      "created_by": "string",
      "updated_by": "string"
    }
  ],
  "next_cursor": "string"
}

`createOidcClient`

Create a partner client in draft status. The client secret is returned exactly once in this

POST /v1/identity/operator/clients

Request Body (required)

Sample Call

epilot identity createOidcClient

With request body:

epilot identity createOidcClient \
  -d '{
  "partner_key": "babelforce",
  "display_name": "Babelforce",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "scopes_allowed": ["openid"]
}'

Using stdin pipe:

cat body.json | epilot identity createOidcClient

With JSONata filter:

epilot identity createOidcClient --jsonata '$'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string",
  "client_secret": "string"
}

`getOidcClient`

Read a partner client. The client secret is never returned.

GET /v1/identity/operator/clients/{client_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Sample Call

epilot identity getOidcClient \
  -p client_id=bf-prod-x7k2

Using positional args for path parameters:

epilot identity getOidcClient bf-prod-x7k2

With JSONata filter:

epilot identity getOidcClient -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`updateClient`

Replace the mutable configuration of a client. config_version must equal the current

PUT /v1/identity/operator/clients/{client_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Request Body (required)

Sample Call

epilot identity updateClient \
  -p client_id=bf-prod-x7k2

With request body:

epilot identity updateClient \
  -p client_id=bf-prod-x7k2 \
  -d '{
  "config_version": 1,
  "allow_sector_change": false,
  "display_name": "string",
  "description": "string",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "scopes_allowed": ["openid"]
}'

Using positional args for path parameters:

epilot identity updateClient bf-prod-x7k2

Using stdin pipe:

cat body.json | epilot identity updateClient -p client_id=bf-prod-x7k2

With JSONata filter:

epilot identity updateClient -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`retireClient`

Retire a client. The record is kept as a tombstone, the client_id is never reused, every

DELETE /v1/identity/operator/clients/{client_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Sample Call

epilot identity retireClient \
  -p client_id=bf-prod-x7k2

Using positional args for path parameters:

epilot identity retireClient bf-prod-x7k2

With JSONata filter:

epilot identity retireClient -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`activateClient`

Activate a draft or suspended client. Validates that every redirect URI is an absolute

POST /v1/identity/operator/clients/{client_id}:activate

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Sample Call

epilot identity activateClient \
  -p client_id=bf-prod-x7k2

Using positional args for path parameters:

epilot identity activateClient bf-prod-x7k2

With JSONata filter:

epilot identity activateClient -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`suspendClient`

Immediately block the client for every organization. Provider-side artefacts (codes, tokens,

POST /v1/identity/operator/clients/{client_id}:suspend

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Request Body

Sample Call

epilot identity suspendClient \
  -p client_id=bf-prod-x7k2 \
  -d '{"reason":"string"}'

Using positional args for path parameters:

epilot identity suspendClient bf-prod-x7k2

Using stdin pipe:

cat body.json | epilot identity suspendClient -p client_id=bf-prod-x7k2

With JSONata filter:

epilot identity suspendClient -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`rotateClientSecret`

Issue a new client secret. The new secret is returned exactly once. The previous secret

POST /v1/identity/operator/clients/{client_id}:rotateSecret

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Request Body

Sample Call

epilot identity rotateClientSecret \
  -p client_id=bf-prod-x7k2 \
  -d '{"compromise_mode":false,"migration_window_seconds":86400}'

Using positional args for path parameters:

epilot identity rotateClientSecret bf-prod-x7k2

Using stdin pipe:

cat body.json | epilot identity rotateClientSecret -p client_id=bf-prod-x7k2

With JSONata filter:

epilot identity rotateClientSecret -p client_id=bf-prod-x7k2 --jsonata '$'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "partner_key": "string",
  "display_name": "string",
  "description": "string",
  "environment": "dev",
  "redirect_uris": ["https://partner.example.com/auth/callback"],
  "sector_identifier_uri": "https://partner.example.com/auth/callback",
  "initiate_login_uri": "https://partner.example.com/auth/callback",
  "launch_target_prefixes": ["string"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code"],
  "scopes_allowed": ["openid"],
  "status": "draft",
  "status_reason": "string",
  "config_version": 1,
  "secret_rotated_at": "1970-01-01T00:00:00.000Z",
  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string",
  "client_secret": "string"
}

`listClientOrganizations`

List the organizations enabled on a client, including suspended and revoked ones.

GET /v1/identity/operator/clients/{client_id}/organizations

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`status`	query	"active" \| "suspended" \| "revoked"	No

Sample Call

epilot identity listClientOrganizations \
  -p client_id=bf-prod-x7k2

Using positional args for path parameters:

epilot identity listClientOrganizations bf-prod-x7k2

With JSONata filter:

epilot identity listClientOrganizations -p client_id=bf-prod-x7k2 --jsonata 'results[0]'

Sample Response

{
  "results": [
    {
      "client_id": "bf-prod-x7k2",
      "org_id": "739224",
      "status": "active",
      "status_reason": "string",
      "authorization_policy": {
        "mode": "preauthorized",
        "population": "all_current_org_members",
        "allowed_scopes": ["openid"],
        "customer_approval_ref": "string",
        "approved_at": "1970-01-01T00:00:00.000Z",
        "version": 1,
        "mandatory_claims": ["org_id"],
        "recorded_by": "string",
        "recorded_at": "1970-01-01T00:00:00.000Z"
      },
      "partner_account": {
        "id": "string",
        "label": "string"
      },
      "created_at": "1970-01-01T00:00:00.000Z",
      "updated_at": "1970-01-01T00:00:00.000Z",
      "created_by": "string",
      "updated_by": "string"
    }
  ]
}

`enableClientOrganization`

Enable an epilot organization on a client, recording the customer's authorization policy

POST /v1/identity/operator/clients/{client_id}/organizations

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes

Request Body (required)

Sample Call

epilot identity enableClientOrganization \
  -p client_id=bf-prod-x7k2

With request body:

epilot identity enableClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -d '{
  "org_id": "739224",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  }
}'

Using positional args for path parameters:

epilot identity enableClientOrganization bf-prod-x7k2

Using stdin pipe:

cat body.json | epilot identity enableClientOrganization -p client_id=bf-prod-x7k2

With JSONata filter:

epilot identity enableClientOrganization -p client_id=bf-prod-x7k2 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`getClientOrganization`

Read one organization enablement.

GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`org_id`	path	string	Yes

Sample Call

epilot identity getClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224

Using positional args for path parameters:

epilot identity getClientOrganization bf-prod-x7k2 739224

With JSONata filter:

epilot identity getClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`updateClientOrganization`

Record a new version of the customer's authorization policy. expected_policy_version must

PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`org_id`	path	string	Yes

Request Body (required)

Sample Call

epilot identity updateClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224

With request body:

epilot identity updateClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224 \
  -d '{
  "expected_policy_version": 1,
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  }
}'

Using positional args for path parameters:

epilot identity updateClientOrganization bf-prod-x7k2 739224

Using stdin pipe:

cat body.json | epilot identity updateClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224

With JSONata filter:

epilot identity updateClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`revokeClientOrganization`

Revoke an organization's enablement. The record is kept as an audited tombstone; future

DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`org_id`	path	string	Yes

Request Body

Sample Call

epilot identity revokeClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224 \
  -d '{"reason":"string"}'

Using positional args for path parameters:

epilot identity revokeClientOrganization bf-prod-x7k2 739224

Using stdin pipe:

cat body.json | epilot identity revokeClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224

With JSONata filter:

epilot identity revokeClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`suspendClientOrganization`

Temporarily block one organization on this client. Reversible with activateClientOrganization.

POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`org_id`	path	string	Yes

Request Body

Sample Call

epilot identity suspendClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224 \
  -d '{"reason":"string"}'

Using positional args for path parameters:

epilot identity suspendClientOrganization bf-prod-x7k2 739224

Using stdin pipe:

cat body.json | epilot identity suspendClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224

With JSONata filter:

epilot identity suspendClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`activateClientOrganization`

Resume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization ag

POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`org_id`	path	string	Yes

Sample Call

epilot identity activateClientOrganization \
  -p client_id=bf-prod-x7k2 \
  -p org_id=739224

Using positional args for path parameters:

epilot identity activateClientOrganization bf-prod-x7k2 739224

With JSONata filter:

epilot identity activateClientOrganization -p client_id=bf-prod-x7k2 -p org_id=739224 --jsonata 'client_id'

Sample Response

{
  "client_id": "bf-prod-x7k2",
  "org_id": "739224",
  "status": "active",
  "status_reason": "string",
  "authorization_policy": {
    "mode": "preauthorized",
    "population": "all_current_org_members",
    "allowed_scopes": ["openid"],
    "customer_approval_ref": "string",
    "approved_at": "1970-01-01T00:00:00.000Z",
    "version": 1,
    "mandatory_claims": ["org_id"],
    "recorded_by": "string",
    "recorded_at": "1970-01-01T00:00:00.000Z"
  },
  "partner_account": {
    "id": "string",
    "label": "string"
  },
  "created_at": "1970-01-01T00:00:00.000Z",
  "updated_at": "1970-01-01T00:00:00.000Z",
  "created_by": "string",
  "updated_by": "string"
}

`createIdentitySession`

Called by the epilot portal through the portal-host proxy after every persisted 360 session.

GET /v1/identity/session

Sample Call

epilot identity createIdentitySession

With JSONata filter:

epilot identity createIdentitySession --jsonata 'org_id'

Sample Response

{
  "org_id": "739224",
  "user_id": "string",
  "expires_at": "1970-01-01T00:00:00.000Z"
}

`deleteIdentitySession`

Clears the identity_session cookie. Called by the portal on logout.

DELETE /v1/identity/session

Sample Call

epilot identity deleteIdentitySession

With JSONata filter:

epilot identity deleteIdentitySession --jsonata '$'

`launchClient`

One validated place for partner start links (manager UI, hosted apps). Redirects the browser to the

GET /v1/identity/launch/{client_id}

Parameters

Name	In	Type	Required	Description
`client_id`	path	string	Yes
`target`	query	string (uri)	No	Deep link inside the partner application to continue to after login
`extra`	query	object	No	Any other query parameters (marketing tags on a start link, parameters a proxy appends) are accepted

and ignored. Start links and the session hop must never fail on an unknown parameter. |

Sample Call

epilot identity launchClient \
  -p client_id=bf-prod-x7k2

Using positional args for path parameters:

epilot identity launchClient bf-prod-x7k2

With JSONata filter:

epilot identity launchClient -p client_id=bf-prod-x7k2 --jsonata '$'

Identity API

Quick Start​

Common Flags​

Operations​

listClients​

createOidcClient​

getOidcClient​

updateClient​

retireClient​

activateClient​

suspendClient​

rotateClientSecret​

listClientOrganizations​

enableClientOrganization​

getClientOrganization​

updateClientOrganization​

revokeClientOrganization​

suspendClientOrganization​

activateClientOrganization​

createIdentitySession​

deleteIdentitySession​

launchClient​

Quick Start

Common Flags

Operations

`listClients`

`createOidcClient`

`getOidcClient`

`updateClient`

`retireClient`

`activateClient`

`suspendClient`

`rotateClientSecret`

`listClientOrganizations`

`enableClientOrganization`

`getClientOrganization`

`updateClientOrganization`

`revokeClientOrganization`

`suspendClientOrganization`

`activateClientOrganization`

`createIdentitySession`

`deleteIdentitySession`

`launchClient`