> ## Documentation Index
> Fetch the complete documentation index at: https://docs-dev.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a connection

> Creates a new connection according to the JSON object received in `body`.

**Note:** If a connection with the same name was recently deleted and had a large number of associated users, the deletion may still be processing. Creating a new connection with that name before the deletion completes may fail or produce unexpected results.


export const Scopes = ({scopes = []}) => {
  return <div>
      <div class="api-section-heading flex flex-col gap-y-4 w-full">
        <div class="flex items-baseline border-b pb-2.5 border-gray-100 dark:border-gray-800 w-full">
          <h4 class="api-section-heading-title flex-1 mb-0">Scopes</h4>
          <div class="flex items-center"></div>
        </div>
      </div>
      <div class="mt-4">
        <div class="space-y-4 whitespace-normal prose prose-sm prose-gray dark:prose-invert overflow-wrap-anywhere [&_*]:overflow-wrap-anywhere">
          <p class="whitespace-pre-line text-xs">
            {"Scopes define permissions and access levels for API requests and authentication tokens."}
          </p>
        </div>
      </div>
      <div class="flex font-mono text-sm group/param-head param-head break-all relative mt-6" id="scopes-scopes">
        <div class="flex-1 flex flex-col content-start py-0.5 mr-5">
          <div class="flex items-center flex-wrap gap-2">
            <div class="absolute -top-1.5">
              <a href="#scopes-scopes" class="-ml-10 flex items-center opacity-0 border-0 group-hover/param-head:opacity-100 focus:opacity-100 focus:outline-0 py-2 [.expandable-content_&]:-ml-[2.1rem] group/link" aria-label="Navigate to header">
                ​
                <div class="w-6 h-6 rounded-md flex items-center justify-center shadow-sm text-gray-400 dark:text-white/50 dark:bg-background-dark dark:brightness-[1.35] dark:ring-1 dark:hover:brightness-150 bg-white ring-1 ring-gray-400/30 dark:ring-gray-700/25 hover:ring-gray-400/60 dark:hover:ring-white/20 group-focus/link:border-2 group-focus/link:border-primary dark:group-focus/link:border-primary-light">
                  <svg xmlns="http://www.w3.org/2000/svg" fill="gray" height="12px" viewBox="0 0 576 512">
                    <path d="M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z"></path>
                  </svg>
                </div>
              </a>
            </div>
            {scopes.map((scope, index) => {
    return <span class="flex items-center px-2 py-0.5 rounded-md bg-gray-100/50 dark:bg-white/5 text-gray-600 dark:text-gray-200 font-medium break-all" style={{
      lineHeight: "1rem",
      fontSize: "0.75rem",
      fontFamily: 'var(--font-jetbrains-mono), ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace'
    }} data-component-part="field-info-pill" key={index}>
                  {scope}
                </span>;
  })}
          </div>
        </div>
      </div>
    </div>;
};

export const ApiReleaseLifecycle = ({releaseLifecycle = 'GA'}) => {
  const lifecycleMap = {
    ea: 'Early Access',
    ga: 'Generally Available',
    deprecated: 'Deprecated',
    planned: 'Planned',
    beta: 'Beta'
  };
  const LIFECYCLE_THEMES = {
    info: {
      light: {
        bg: 'lab(91.896% .077188 -6.94053)',
        text: 'lab(36.091% 25.9241 -68.0384)'
      },
      dark: {
        bg: 'lab(16.0426% 6.71726 -27.2409)',
        text: 'lab(72.6029% 4.08953 -41.9669)'
      }
    },
    secondary: {
      light: {
        bg: 'lab(90.8548% 11.3355 8.01476)',
        text: 'lab(47.5286% 56.4238 43.4706)'
      },
      dark: {
        bg: 'lab(16.3609% 37.191 25.6346)',
        text: 'lab(71.881% 41.5 29.4839)'
      }
    },
    danger: {
      light: {
        bg: 'lab(94.7916% -.0000298023 0)',
        text: 'lab(54.3656% 0 -.0000119209)'
      },
      dark: {
        bg: 'lab(13.232% 0 0)',
        text: 'lab(51.6164% 0 0)'
      }
    }
  };
  const LIFECYCLE_THEME_MAP = {
    ea: 'info',
    ga: 'info',
    beta: 'info',
    deprecated: 'secondary',
    planned: 'danger'
  };
  const lifecycle = releaseLifecycle.toLocaleLowerCase();
  const lifecycleText = lifecycleMap[lifecycle];
  if (!lifecycleText) {
    return null;
  }
  const theme = LIFECYCLE_THEMES[LIFECYCLE_THEME_MAP[lifecycle]];
  return <div>
      <div className="api-section-heading flex flex-col gap-y-4 w-full">
        <div className="flex items-baseline border-b pb-2.5 border-gray-100 dark:border-gray-800 w-full">
          <h4 className="api-section-heading-title flex-1 mb-0">
            Release Lifecycle
          </h4>
        </div>
      </div>
      <div className="flex font-mono text-sm group/param-head param-head break-all relative mt-2.5" id="releaselifecycle-lifecycle">
        <div className="flex-1 flex flex-col content-start py-0.5 mr-5">
          <div className="flex items-center flex-wrap gap-2">
            <div className="absolute -top-1.5">
              <a href="#releaselifecycle-lifecycle" className="-ml-10 flex items-center opacity-0 border-0 group-hover/param-head:opacity-100 focus:opacity-100 focus:outline-0 py-2 [.expandable-content_&]:-ml-[2.1rem] group/link" aria-label="Navigate to header">
                <div className="w-6 h-6 rounded-md flex items-center justify-center shadow-sm text-gray-400 dark:text-white/50 dark:bg-background-dark dark:brightness-[1.35] dark:ring-1 dark:hover:brightness-150 bg-white ring-1 ring-gray-400/30 dark:ring-gray-700/25 hover:ring-gray-400/60 dark:hover:ring-white/20 group-focus/link:border-2 group-focus/link:border-primary dark:group-focus/link:border-primary-light">
                  <svg xmlns="http://www.w3.org/2000/svg" fill="gray" height="12px" viewBox="0 0 576 512">
                    <path d="M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z"></path>
                  </svg>
                </div>
              </a>
            </div>
            <span className="inline-flex items-center w-fit font-medium gap-1 py-0.5 px-2 rounded-md" style={{
    lineHeight: '1rem',
    fontSize: '0.75rem',
    fontFamily: 'var(--font-jetbrains-mono), ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace',
    backgroundColor: `light-dark(${theme.light.bg}, ${theme.dark.bg})`,
    color: `light-dark(${theme.light.text}, ${theme.dark.text})`,
    borderColor: `light-dark(color-mix(in oklab, ${theme.light.text} 25%, transparent), color-mix(in oklab, ${theme.dark.text} 25%, transparent))`
  }}>
              {lifecycleText}
            </span>
          </div>
        </div>
      </div>
    </div>;
};

<ApiReleaseLifecycle releaseLifecycle="GA" />

<Scopes scopes={["create:connections"]} />


## OpenAPI

````yaml management-api-oas post /connections
openapi: 3.1.0
info:
  title: Auth0 Management API
  description: Auth0 Management API v2.
  termsOfService: https://auth0.com/web-terms/
  contact:
    name: Auth0 Support
    url: https://support.auth0.com
  version: '2.0'
servers:
  - url: https://{tenantDomain}/api/v2
    variables:
      tenantDomain:
        default: '{TENANT}.auth0.com'
        description: Auth0 Tenant Domain
security:
  - bearerAuth: []
externalDocs:
  description: Auth0 Management API Documentation
  url: https://auth0.com/docs/api/management/v2/
paths:
  /connections:
    post:
      tags:
        - connections
      summary: Create a connection
      description: >
        Creates a new connection according to the JSON object received in
        `body`.


        **Note:** If a connection with the same name was recently deleted and
        had a large number of associated users, the deletion may still be
        processing. Creating a new connection with that name before the deletion
        completes may fail or produce unexpected results.
      operationId: post_connections
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateConnectionRequestContent'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/CreateConnectionRequestContent'
      responses:
        '201':
          description: The connection was created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateConnectionResponseContent'
        '400':
          description: Invalid request body. The message will vary depending on the cause.
          x-description-1: Your account is not allowed to set options.set_user_root_attributes
          x-description-2: >-
            options.set_user_root_attributes can be set only for enterprise
            connections, social connections or custom database connections
            (using external users store)
          x-description-3: No phone provider configured for the tenant
          x-description-4: >-
            Passwordless connection cannot be made as delivery method (sms/text)
            is not supported by the configured Tenant phone provider
          x-description-5: >-
            custom_password_hash option cannot be set because the universal
            password hash feature is not enabled for this tenant
          x-description-6: >-
            The custom_password_hash option is only available for database
            connections
          x-description-7: The action_id field value cannot be empty, null or undefined
          x-description-8: The provided custom password hash action id does not exist
          x-description-9: >-
            The provided action does not support the password hash migration
            trigger
          x-description-10: >-
            The provided action must be deployed to be used for password hash
            migration
        '401':
          description: Invalid token.
          x-description-1: Client is not global.
          x-description-2: Invalid signature received for JSON Web Token validation
        '403':
          description: 'Insufficient scope, expected any of: create:connections'
          x-description-1: You reached the limit of entities of this type for this tenant.
          x-description-2: >-
            You can only create 1 non-Okta enterprise connection(s) for this
            tenant.
        '409':
          description: A connection with the same name already exists
          x-description-1: A connection with the same name is being deleted, try again later
          x-description-2: >-
            There is already another connection with some realms from "realms"
            parameter
          x-description-3: There is already a domain connection enabled for strategy
        '429':
          description: >-
            Too many requests. Check the X-RateLimit-Limit,
            X-RateLimit-Remaining and X-RateLimit-Reset headers.
      security:
        - bearerAuth: []
        - oAuth2ClientCredentials:
            - create:connections
      x-codeSamples:
        - lang: go
          label: Create a connection
          source: |
            package example

            import (
                context "context"

                management "github.com/auth0/go-auth0/management/management"
                client "github.com/auth0/go-auth0/management/management/client"
                option "github.com/auth0/go-auth0/management/management/option"
            )

            func do() {
                client := client.NewClient(
                    option.WithToken(
                        "<token>",
                    ),
                )
                request := &management.CreateConnectionRequestContent{
                    Name: "name",
                    Strategy: management.ConnectionIdentityProviderEnumAd,
                }
                client.Connections.Create(
                    context.TODO(),
                    request,
                )
            }
        - lang: typescript
          label: Create a connection
          source: |
            import { ManagementClient } from "auth0";

            async function main() {
                const client = new ManagementClient({
                    token: "<token>",
                });
                await client.connections.create({
                    name: "name",
                    strategy: "ad",
                });
            }
            main();
        - lang: javascript
          label: Create a connection
          source: |
            import { ManagementClient } from "auth0";

            async function main() {
                const client = new ManagementClient({
                    token: "<token>",
                });
                await client.connections.create({
                    name: "name",
                    strategy: "ad",
                });
            }
            main();
components:
  schemas:
    CreateConnectionRequestContent:
      type: object
      additionalProperties: false
      required:
        - name
        - strategy
      properties:
        name:
          type: string
          description: >-
            The name of the connection. Must start and end with an alphanumeric
            character and can only contain alphanumeric characters and '-'. Max
            length 128
          maxLength: 128
          pattern: ^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$
        display_name:
          type: string
          description: Connection name used in the new universal login experience
          maxLength: 128
        strategy:
          $ref: '#/components/schemas/ConnectionIdentityProviderEnum'
        options:
          $ref: '#/components/schemas/ConnectionPropertiesOptions'
        enabled_clients:
          type: array
          description: >-
            Use of this property is NOT RECOMMENDED. Use the PATCH
            /v2/connections/{id}/clients endpoint to enable the connection for a
            set of clients.
          items:
            type: string
            description: The id of the client for which the connection is to be enabled.
            format: client-id
        is_domain_connection:
          type: boolean
          description: >-
            <code>true</code> promotes to a domain-level connection so that
            third-party applications can use it. <code>false</code> does not
            promote the connection, so only first-party applications with the
            connection enabled can use it. (Defaults to <code>false</code>.)
        show_as_button:
          type: boolean
          description: >-
            Enables showing a button for the connection in the login page (new
            experience only). If false, it will be usable only by HRD. (Defaults
            to <code>false</code>.)
        realms:
          type: array
          description: >-
            Defines the realms for which the connection will be used (ie: email
            domains). If the array is empty or the property is not specified,
            the connection name will be added as realm.
          items:
            type: string
            description: The realm where this connection belongs
            format: connection-realm
        metadata:
          $ref: '#/components/schemas/ConnectionsMetadata'
        authentication:
          $ref: '#/components/schemas/ConnectionAuthenticationPurpose'
          x-release-lifecycle: GA
        connected_accounts:
          $ref: '#/components/schemas/ConnectionConnectedAccountsPurpose'
          x-release-lifecycle: GA
        cross_app_access_requesting_app:
          $ref: '#/components/schemas/CrossAppAccessRequestingApp'
          x-release-lifecycle: EA
    CreateConnectionResponseContent:
      type: object
      additionalProperties: false
      properties:
        name:
          type: string
          description: The name of the connection
          default: My connection
        display_name:
          type: string
          description: Connection name used in login screen
        options:
          $ref: '#/components/schemas/ConnectionOptions'
        id:
          type: string
          description: The connection's identifier
          default: con_0000000000000001
        strategy:
          type: string
          description: The type of the connection, related to the identity provider
          default: auth0
        realms:
          type: array
          description: >-
            Defines the realms for which the connection will be used (ie: email
            domains). If the array is empty or the property is not specified,
            the connection name will be added as realm.
          items:
            type: string
            description: The realm where this connection belongs
            format: connection-realm
        enabled_clients:
          type: array
          description: >-
            DEPRECATED property. Use the GET /connections/:id/clients endpoint
            to get the ids of the clients for which the connection is enabled
          x-release-lifecycle: deprecated
          items:
            type: string
            description: The client id
        is_domain_connection:
          type: boolean
          description: True if the connection is domain level
        show_as_button:
          type: boolean
          description: >-
            Enables showing a button for the connection in the login page (new
            experience only). If false, it will be usable only by HRD.
        metadata:
          $ref: '#/components/schemas/ConnectionsMetadata'
        authentication:
          $ref: '#/components/schemas/ConnectionAuthenticationPurpose'
          x-release-lifecycle: GA
        connected_accounts:
          $ref: '#/components/schemas/ConnectionConnectedAccountsPurpose'
          x-release-lifecycle: GA
        cross_app_access_requesting_app:
          $ref: '#/components/schemas/CrossAppAccessRequestingApp'
          x-release-lifecycle: EA
    ConnectionIdentityProviderEnum:
      type: string
      description: The identity provider identifier for the connection
      enum:
        - ad
        - adfs
        - amazon
        - apple
        - dropbox
        - bitbucket
        - auth0-oidc
        - auth0
        - baidu
        - bitly
        - box
        - custom
        - daccount
        - dwolla
        - email
        - evernote-sandbox
        - evernote
        - exact
        - facebook
        - fitbit
        - github
        - google-apps
        - google-oauth2
        - instagram
        - ip
        - line
        - linkedin
        - oauth1
        - oauth2
        - office365
        - oidc
        - okta
        - paypal
        - paypal-sandbox
        - pingfederate
        - planningcenter
        - salesforce-community
        - salesforce-sandbox
        - salesforce
        - samlp
        - sharepoint
        - shopify
        - shop
        - sms
        - soundcloud
        - thirtysevensignals
        - twitter
        - untappd
        - vkontakte
        - waad
        - weibo
        - windowslive
        - wordpress
        - yahoo
        - yandex
    ConnectionPropertiesOptions:
      type: object
      description: The connection's options (depend on the connection strategy)
      additionalProperties: true
      properties:
        validation:
          $ref: '#/components/schemas/ConnectionValidationOptions'
        non_persistent_attrs:
          type:
            - array
            - 'null'
          description: >-
            An array of user fields that should not be stored in the Auth0
            database (https://auth0.com/docs/security/data-security/denylist)
          items:
            type: string
        precedence:
          type: array
          description: >-
            Order of precedence for attribute types. If the property is not
            specified, the default precedence of attributes will be used.
          minItems: 3
          items:
            $ref: '#/components/schemas/ConnectionIdentifierPrecedenceEnum'
        attributes:
          $ref: '#/components/schemas/ConnectionAttributes'
        enable_script_context:
          type: boolean
          description: >-
            Set to true to inject context into custom DB scripts (warning:
            cannot be disabled once enabled)
        enabledDatabaseCustomization:
          type: boolean
          description: Set to true to use a legacy user store
        import_mode:
          type: boolean
          description: >-
            Enable this if you have a legacy user store and you want to
            gradually migrate those users to the Auth0 user store
        configuration:
          type:
            - object
            - 'null'
          description: Stores encrypted string only configurations for connections
          additionalProperties:
            type:
              - string
              - 'null'
        customScripts:
          $ref: '#/components/schemas/ConnectionCustomScripts'
        authentication_methods:
          $ref: '#/components/schemas/ConnectionAuthenticationMethods'
        passkey_options:
          $ref: '#/components/schemas/ConnectionPasskeyOptions'
        passwordPolicy:
          $ref: '#/components/schemas/ConnectionPasswordPolicyEnum'
        password_complexity_options:
          $ref: '#/components/schemas/ConnectionPasswordComplexityOptions'
        password_history:
          $ref: '#/components/schemas/ConnectionPasswordHistoryOptions'
        password_no_personal_info:
          $ref: '#/components/schemas/ConnectionPasswordNoPersonalInfoOptions'
        password_dictionary:
          $ref: '#/components/schemas/ConnectionPasswordDictionaryOptions'
        api_enable_users:
          type: boolean
        api_enable_groups:
          type: boolean
          x-release-lifecycle: EA
        basic_profile:
          type: boolean
        ext_admin:
          type: boolean
        ext_is_suspended:
          type: boolean
        ext_agreed_terms:
          type: boolean
        ext_groups:
          type: boolean
        ext_assigned_plans:
          type: boolean
        ext_profile:
          type: boolean
        disable_self_service_change_password:
          type: boolean
        upstream_params:
          $ref: '#/components/schemas/ConnectionUpstreamParams'
        set_user_root_attributes:
          $ref: '#/components/schemas/ConnectionSetUserRootAttributesEnum'
        gateway_authentication:
          $ref: '#/components/schemas/ConnectionGatewayAuthentication'
        federated_connections_access_tokens:
          $ref: '#/components/schemas/ConnectionFederatedConnectionsAccessTokens'
        password_options:
          $ref: '#/components/schemas/ConnectionPasswordOptions'
        assertion_decryption_settings:
          $ref: '#/components/schemas/ConnectionAssertionDecryptionSettings'
        id_token_signed_response_algs:
          $ref: '#/components/schemas/ConnectionIdTokenSignedResponseAlgs'
        dpop_signing_alg:
          $ref: '#/components/schemas/ConnectionDpopSigningAlgEnum'
        token_endpoint_auth_method:
          $ref: '#/components/schemas/ConnectionTokenEndpointAuthMethodEnum'
        token_endpoint_auth_signing_alg:
          $ref: '#/components/schemas/ConnectionTokenEndpointAuthSigningAlgEnum'
        token_endpoint_jwtca_aud_format:
          $ref: '#/components/schemas/ConnectionTokenEndpointJwtcaAudFormatEnumOIDC'
        id_token_session_expiry_supported:
          $ref: '#/components/schemas/ConnectionIdTokenSessionExpirySupported'
    ConnectionsMetadata:
      type: object
      description: >-
        Metadata associated with the connection in the form of an object with
        string values (max 255 chars).  Maximum of 10 metadata properties
        allowed.
      additionalProperties:
        type:
          - string
          - 'null'
        maxLength: 255
      maxProperties: 10
    ConnectionAuthenticationPurpose:
      type: object
      description: >-
        Configure the purpose of a connection to be used for authentication
        during login.
      additionalProperties: false
      required:
        - active
      x-release-lifecycle: GA
      properties:
        active:
          type: boolean
    ConnectionConnectedAccountsPurpose:
      type: object
      description: >-
        Configure the purpose of a connection to be used for connected accounts
        and Token Vault.
      additionalProperties: false
      required:
        - active
      x-release-lifecycle: GA
      properties:
        active:
          type: boolean
        cross_app_access:
          type: boolean
    CrossAppAccessRequestingApp:
      type: object
      description: >-
        Configure the connection to be used as a Requesting Application for
        Cross App Access.
      additionalProperties: false
      required:
        - active
      x-release-lifecycle: EA
      properties:
        active:
          type: boolean
          description: >-
            Set to `true` to enable the connection as a Requesting Application
            for Cross App Access.
    ConnectionOptions:
      type: object
      description: >-
        In order to return options in the response, the
        `read:connections_options` scope must be present
      additionalProperties: true
    ConnectionValidationOptions:
      type:
        - object
        - 'null'
      description: Options for validation
      additionalProperties: false
      properties:
        username:
          $ref: '#/components/schemas/ConnectionUsernameValidationOptions'
    ConnectionIdentifierPrecedenceEnum:
      type: string
      description: Order of precedence for attribute types
      enum:
        - email
        - phone_number
        - username
    ConnectionAttributes:
      type: object
      description: Attribute configuration
      additionalProperties: false
      minProperties: 1
      properties:
        email:
          $ref: '#/components/schemas/EmailAttribute'
        phone_number:
          $ref: '#/components/schemas/PhoneAttribute'
        username:
          $ref: '#/components/schemas/UsernameAttribute'
    ConnectionCustomScripts:
      type: object
      description: A map of scripts used to integrate with a custom database.
      additionalProperties: true
      properties:
        login:
          type: string
          minLength: 1
        get_user:
          type: string
          minLength: 1
        delete:
          type: string
          minLength: 1
        change_password:
          type: string
          minLength: 1
        verify:
          type: string
          minLength: 1
        create:
          type: string
          minLength: 1
        change_username:
          type: string
          minLength: 1
        change_email:
          type: string
          minLength: 1
        change_phone_number:
          type: string
          minLength: 1
    ConnectionAuthenticationMethods:
      type:
        - object
        - 'null'
      description: Options for enabling authentication methods.
      additionalProperties: false
      properties:
        password:
          $ref: '#/components/schemas/ConnectionPasswordAuthenticationMethod'
        passkey:
          $ref: '#/components/schemas/ConnectionPasskeyAuthenticationMethod'
        email_otp:
          $ref: '#/components/schemas/ConnectionEmailOtpAuthenticationMethod'
          x-release-lifecycle: EA
        phone_otp:
          $ref: '#/components/schemas/ConnectionPhoneOtpAuthenticationMethod'
          x-release-lifecycle: EA
    ConnectionPasskeyOptions:
      type:
        - object
        - 'null'
      description: Options for the passkey authentication method
      additionalProperties: false
      properties:
        challenge_ui:
          $ref: '#/components/schemas/ConnectionPasskeyChallengeUIEnum'
        progressive_enrollment_enabled:
          type: boolean
          description: >-
            Enables or disables progressive enrollment of passkeys for the
            connection.
        local_enrollment_enabled:
          type: boolean
          description: >-
            Enables or disables enrollment prompt for local passkey when user
            authenticates using a cross-device passkey for the connection.
    ConnectionPasswordPolicyEnum:
      type:
        - string
        - 'null'
      description: Password strength level
      enum:
        - none
        - low
        - fair
        - good
        - excellent
        - null
    ConnectionPasswordComplexityOptions:
      type:
        - object
        - 'null'
      description: Password complexity options
      additionalProperties: false
      properties:
        min_length:
          type: integer
          description: Minimum password length
          minimum: 1
          maximum: 128
    ConnectionPasswordHistoryOptions:
      type:
        - object
        - 'null'
      description: Options for password history policy
      additionalProperties: false
      required:
        - enable
      properties:
        enable:
          type: boolean
        size:
          type: integer
          minimum: 0
          maximum: 24
    ConnectionPasswordNoPersonalInfoOptions:
      type:
        - object
        - 'null'
      description: Options for personal info in passwords policy
      additionalProperties: false
      required:
        - enable
      properties:
        enable:
          type: boolean
    ConnectionPasswordDictionaryOptions:
      type:
        - object
        - 'null'
      description: Options for password dictionary policy
      additionalProperties: false
      required:
        - enable
      properties:
        enable:
          type: boolean
        dictionary:
          type: array
          description: Custom Password Dictionary. An array of up to 200 entries.
          items:
            type: string
            description: Custom Password Dictionary entry. 50 characters max.
            maxLength: 50
    ConnectionUpstreamParams:
      type:
        - object
        - 'null'
      description: Options for adding parameters in the request to the upstream IdP
      additionalProperties:
        $ref: '#/components/schemas/ConnectionUpstreamAdditionalProperties'
    ConnectionSetUserRootAttributesEnum:
      type: string
      description: >-
        When using an external IdP, this flag determines  whether 'name',
        'given_name', 'family_name', 'nickname', and 'picture' attributes are
        updated. In addition, it also determines whether the user is created
        when user doesnt exist previously. Possible values are 'on_each_login'
        (default value, it configures the connection to automatically create the
        user if necessary and update the root attributes from the external IdP
        with each user login. When this setting is used, root attributes cannot
        be independently updated), 'on_first_login' (configures the connection
        to create the user and set the root attributes on first login only,
        allowing them to be independently updated thereafter), and
        'never_on_login' (configures the connection not to create the user and
        not to set the root attributes from the external IdP, allowing them to
        be independently updated).
      default: on_each_login
      enum:
        - on_each_login
        - on_first_login
        - never_on_login
    ConnectionGatewayAuthentication:
      type:
        - object
        - 'null'
      description: >-
        Token-based authentication settings to be applied when connection is
        using an sms strategy.
      additionalProperties: true
      required:
        - method
        - audience
        - secret
      properties:
        method:
          type: string
          description: The Authorization header type.
        subject:
          type: string
          description: The subject to be added to the JWT payload.
        audience:
          type: string
          description: The audience to be added to the JWT payload.
        secret:
          type: string
          description: The secret to be used for signing tokens.
        secret_base64_encoded:
          type: boolean
          description: Set to true if the provided secret is base64 encoded.
    ConnectionFederatedConnectionsAccessTokens:
      type:
        - object
        - 'null'
      description: Federated Connections Access Tokens
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: >-
            Enables refresh tokens and access tokens collection for federated
            connections
    ConnectionPasswordOptions:
      type: object
      description: Password policy options for flexible password policy configuration
      additionalProperties: false
      properties:
        complexity:
          $ref: '#/components/schemas/ConnectionPasswordOptionsComplexity'
        dictionary:
          $ref: '#/components/schemas/ConnectionPasswordOptionsDictionary'
        history:
          $ref: '#/components/schemas/ConnectionPasswordOptionsHistory'
        profile_data:
          $ref: '#/components/schemas/ConnectionPasswordOptionsProfileData'
    ConnectionAssertionDecryptionSettings:
      type: object
      description: Settings for SAML assertion decryption.
      additionalProperties: false
      required:
        - algorithm_profile
      properties:
        algorithm_profile:
          $ref: >-
            #/components/schemas/ConnectionAssertionDecryptionAlgorithmProfileEnum
        algorithm_exceptions:
          type: array
          description: >-
            A list of insecure algorithms to allow for SAML assertion
            decryption.
          items:
            type: string
            minLength: 1
            maxLength: 100
    ConnectionIdTokenSignedResponseAlgs:
      description: List of algorithms allowed to verify the ID tokens.
      type:
        - array
        - 'null'
      items:
        $ref: '#/components/schemas/ConnectionIdTokenSignedResponseAlgEnum'
      x-merge-priority: -5
    ConnectionDpopSigningAlgEnum:
      type: string
      description: Algorithm used for DPoP proof JWT signing.
      enum:
        - ES256
        - ES384
        - ES512
        - Ed25519
      x-merge-priority: -5
    ConnectionTokenEndpointAuthMethodEnum:
      type:
        - string
        - 'null'
      description: >-
        Authentication method used at the identity provider's token endpoint.
        'client_secret_post' sends credentials in the request body;
        'private_key_jwt' uses a signed JWT assertion for enhanced security.
      enum:
        - client_secret_post
        - private_key_jwt
      x-merge-priority: -5
    ConnectionTokenEndpointAuthSigningAlgEnum:
      type:
        - string
        - 'null'
      description: Algorithm used to sign client_assertions.
      enum:
        - ES256
        - ES384
        - PS256
        - PS384
        - RS256
        - RS384
        - RS512
      x-merge-priority: -5
    ConnectionTokenEndpointJwtcaAudFormatEnumOIDC:
      type: string
      description: >-
        Specifies the format of the aud (audience) claim included in the JWT
        used for client authentication at the token endpoint. Accepted values
        are: 'issuer' (the aud claim is set to the OIDC issuer URL) or
        'token_endpoint' (the aud claim is set to the token endpoint URL).
      enum:
        - issuer
        - token_endpoint
      x-merge-priority: -5
    ConnectionIdTokenSessionExpirySupported:
      type: boolean
      description: >-
        Indicates whether the identity provider supports session expiry via the
        id_token. If true, the system will use the session_expiry claim in the
        id_token to determine session expiry.
      x-release-lifecycle: GA
      x-merge-priority: -5
    ConnectionUsernameValidationOptions:
      type:
        - object
        - 'null'
      additionalProperties: false
      required:
        - max
        - min
      properties:
        min:
          type: integer
          minimum: 1
        max:
          type: integer
          maximum: 128
    EmailAttribute:
      type: object
      description: Configuration for the email attribute for users.
      additionalProperties: false
      properties:
        identifier:
          $ref: '#/components/schemas/EmailAttributeIdentifier'
        unique:
          type: boolean
          description: Determines if the attribute is unique in a given connection
        profile_required:
          type: boolean
          description: Determines if property should be required for users
        verification_method:
          $ref: '#/components/schemas/VerificationMethodEnum'
        signup:
          $ref: '#/components/schemas/SignupVerified'
    PhoneAttribute:
      type: object
      description: Configuration for the phone number attribute for users.
      additionalProperties: false
      properties:
        identifier:
          $ref: '#/components/schemas/PhoneAttributeIdentifier'
        profile_required:
          type: boolean
          description: Determines if property should be required for users
        signup:
          $ref: '#/components/schemas/SignupVerified'
    UsernameAttribute:
      type: object
      description: Configuration for the username attribute for users.
      additionalProperties: false
      properties:
        identifier:
          $ref: '#/components/schemas/UsernameAttributeIdentifier'
        profile_required:
          type: boolean
          description: Determines if property should be required for users
        signup:
          $ref: '#/components/schemas/SignupSchema'
        validation:
          $ref: '#/components/schemas/UsernameValidation'
    ConnectionPasswordAuthenticationMethod:
      type: object
      description: Password authentication enablement
      additionalProperties: false
      properties:
        enabled:
          type: boolean
          description: Determines whether passwords are enabled
        api_behavior:
          $ref: '#/components/schemas/ConnectionApiBehaviorEnum'
          x-release-lifecycle: EA
        signup_behavior:
          $ref: '#/components/schemas/ConnectionSignupBehaviorEnum'
          x-release-lifecycle: EA
    ConnectionPasskeyAuthenticationMethod:
      type: object
      description: Passkey authentication enablement
      additionalProperties: false
      properties:
        enabled:
          type: boolean
          description: Determines whether passkeys are enabled
    ConnectionEmailOtpAuthenticationMethod:
      type: object
      description: Email OTP authentication enablement
      additionalProperties: false
      x-release-lifecycle: EA
      properties:
        enabled:
          type: boolean
          description: Determines whether email OTP is enabled
    ConnectionPhoneOtpAuthenticationMethod:
      type: object
      description: Phone OTP authentication enablement
      additionalProperties: false
      x-release-lifecycle: EA
      properties:
        enabled:
          type: boolean
          description: Determines whether phone OTP is enabled
    ConnectionPasskeyChallengeUIEnum:
      type: string
      description: Controls the UI used to challenge the user for their passkey.
      enum:
        - both
        - autofill
        - button
    ConnectionUpstreamAdditionalProperties:
      type: object
      oneOf:
        - $ref: '#/components/schemas/ConnectionUpstreamAlias'
        - $ref: '#/components/schemas/ConnectionUpstreamValue'
    ConnectionPasswordOptionsComplexity:
      type: object
      description: Password complexity requirements configuration
      additionalProperties: false
      properties:
        min_length:
          type: integer
          description: Minimum password length required (1-72 characters)
          minimum: 1
          maximum: 72
        character_types:
          type: array
          description: >-
            Required character types that must be present in passwords. Valid
            options: uppercase, lowercase, number, special
          items:
            $ref: '#/components/schemas/PasswordCharacterTypeEnum'
        character_type_rule:
          $ref: '#/components/schemas/PasswordCharacterTypeRulePolicyEnum'
        identical_characters:
          $ref: '#/components/schemas/PasswordIdenticalCharactersPolicyEnum'
        sequential_characters:
          $ref: '#/components/schemas/PasswordSequentialCharactersPolicyEnum'
        max_length_exceeded:
          $ref: '#/components/schemas/PasswordMaxLengthExceededPolicyEnum'
    ConnectionPasswordOptionsDictionary:
      type: object
      description: Dictionary-based password restriction policy to prevent common passwords
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: >-
            Enables dictionary checking to prevent use of common passwords and
            custom blocked words
        custom:
          type: array
          description: >-
            Array of custom words to block in passwords. Maximum 200 items, each
            up to 50 characters
          items:
            type: string
            maxLength: 50
        default:
          $ref: '#/components/schemas/PasswordDefaultDictionariesEnum'
    ConnectionPasswordOptionsHistory:
      type: object
      description: Password history policy configuration to prevent password reuse
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: >-
            Enables password history checking to prevent users from reusing
            recent passwords
        size:
          type: integer
          description: Number of previous passwords to remember and prevent reuse (1-24)
          minimum: 1
          maximum: 24
    ConnectionPasswordOptionsProfileData:
      type: object
      description: >-
        Personal information restriction policy to prevent use of profile data
        in passwords
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: >-
            Prevents users from including profile data (like name, email) in
            their passwords
        blocked_fields:
          type: array
          description: Blocked profile fields. An array of up to 12 entries.
          items:
            type: string
            description: Blocked profile fields entry. 100 characters max.
            maxLength: 100
    ConnectionAssertionDecryptionAlgorithmProfileEnum:
      type: string
      description: The algorithm profile to use for decrypting SAML assertions.
      enum:
        - v2026-1
    ConnectionIdTokenSignedResponseAlgEnum:
      description: Algorithm allowed to verify the ID tokens.
      type: string
      enum:
        - ES256
        - ES384
        - PS256
        - PS384
        - RS256
        - RS384
        - RS512
      x-merge-priority: -5
    EmailAttributeIdentifier:
      type: object
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: Determines if the attribute is used for identification
        default_method:
          $ref: '#/components/schemas/DefaultMethodEmailIdentifierEnum'
          x-release-lifecycle: EA
    VerificationMethodEnum:
      type: string
      enum:
        - link
        - otp
    SignupVerified:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/SignupStatusEnum'
        verification:
          $ref: '#/components/schemas/SignupVerification'
    PhoneAttributeIdentifier:
      type: object
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: Determines if the attribute is used for identification
        default_method:
          $ref: '#/components/schemas/DefaultMethodPhoneNumberIdentifierEnum'
          x-release-lifecycle: EA
    UsernameAttributeIdentifier:
      type: object
      additionalProperties: false
      properties:
        active:
          type: boolean
          description: Determines if the attribute is used for identification
    SignupSchema:
      type: object
      additionalProperties: false
      properties:
        status:
          $ref: '#/components/schemas/SignupStatusEnum'
    UsernameValidation:
      type: object
      additionalProperties: false
      properties:
        min_length:
          type: number
          description: Minimum allowed length
          minimum: 1
          maximum: 128
        max_length:
          type: number
          description: Maximum allowed length
          minimum: 1
          maximum: 128
        allowed_types:
          $ref: '#/components/schemas/UsernameAllowedTypes'
    ConnectionApiBehaviorEnum:
      type: string
      description: Specifies the API behavior for password authentication
      enum:
        - required
        - optional
      x-release-lifecycle: EA
    ConnectionSignupBehaviorEnum:
      type: string
      description: Specifies the signup behavior for password authentication
      enum:
        - allow
        - block
      x-release-lifecycle: EA
    ConnectionUpstreamAlias:
      type: object
      additionalProperties: false
      properties:
        alias:
          $ref: '#/components/schemas/ConnectionUpstreamAliasEnum'
    ConnectionUpstreamValue:
      type: object
      additionalProperties: false
      properties:
        value:
          type: string
    PasswordCharacterTypeEnum:
      type: string
      enum:
        - uppercase
        - lowercase
        - number
        - special
    PasswordCharacterTypeRulePolicyEnum:
      type: string
      description: >-
        When enabled, passwords must contain at least 3 out of 4 character
        types. Can only be enabled when all 4 character types are specified
      enum:
        - all
        - three_of_four
    PasswordIdenticalCharactersPolicyEnum:
      type: string
      description: >-
        Controls whether identical consecutive characters are allowed in
        passwords
      enum:
        - allow
        - block
    PasswordSequentialCharactersPolicyEnum:
      type: string
      description: Controls whether sequential characters are allowed in passwords
      enum:
        - allow
        - block
    PasswordMaxLengthExceededPolicyEnum:
      type: string
      description: >-
        Controls whether passwords that exceed the maximum length are truncated
        or rejected
      enum:
        - truncate
        - error
    PasswordDefaultDictionariesEnum:
      type: string
      description: >-
        Default dictionary to use for password validation. Options: "en_10k"
        (10,000 common words) or "en_100k" (100,000 common words)
      enum:
        - en_10k
        - en_100k
    DefaultMethodEmailIdentifierEnum:
      type: string
      description: Default authentication method for email identifier
      enum:
        - password
        - email_otp
      x-release-lifecycle: EA
    SignupStatusEnum:
      type: string
      enum:
        - required
        - optional
        - inactive
    SignupVerification:
      type: object
      additionalProperties: false
      properties:
        active:
          type: boolean
    DefaultMethodPhoneNumberIdentifierEnum:
      type: string
      description: Default authentication method for phone_number identifier
      enum:
        - password
        - phone_otp
      x-release-lifecycle: EA
    UsernameAllowedTypes:
      type: object
      additionalProperties: false
      properties:
        email:
          type: boolean
        phone_number:
          type: boolean
    ConnectionUpstreamAliasEnum:
      type: string
      enum:
        - acr_values
        - audience
        - client_id
        - display
        - id_token_hint
        - login_hint
        - max_age
        - prompt
        - resource
        - response_mode
        - response_type
        - ui_locales
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: jwt
    oAuth2ClientCredentials:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oauth/token/
          x-form-parameters:
            audience: /api/v2/
          scopes:
            create:actions: Create Actions
            read:actions: Read Actions
            update:actions: Update Actions
            delete:actions: Delete Actions
            read:anomaly_blocks: Read Anomaly Blocks
            delete:anomaly_blocks: Delete Anomaly Blocks
            read:attack_protection: Read Attack Protection
            update:attack_protection: Update Attack Protection
            create:authentication_methods: Create Authentication Methods
            read:authentication_methods: Read Authentication Methods
            update:authentication_methods: Update Authentication Methods
            delete:authentication_methods: Delete Authentication Methods
            read:branding: Read Branding
            update:branding: Update Branding
            delete:branding: Delete Branding
            create:client_credentials: Create Client Credentials
            read:client_credentials: Read Client Credentials
            update:client_credentials: Update Client Credentials
            delete:client_credentials: Delete Client Credentials
            create:client_grants: Create Client Grants
            read:client_grants: Read Client Grants
            update:client_grants: Update Client Grants
            delete:client_grants: Delete Client Grants
            read:client_keys: Read Client Keys
            update:client_keys: Update Client Keys
            read:client_summary: Read Client Summary
            update:client_token_vault_privileged_access: Update Client Token Vault Privileged Access
            create:clients: Create Clients
            read:clients: Read Clients
            update:clients: Update Clients
            delete:clients: Delete Clients
            create:connection_profiles: Create Connection Profiles
            read:connection_profiles: Read Connection Profiles
            update:connection_profiles: Update Connection Profiles
            delete:connection_profiles: Delete Connection Profiles
            create:connections: Create Connections
            read:connections: Read Connections
            update:connections: Update Connections
            delete:connections: Delete Connections
            create:connections_keys: Create Connections Keys
            read:connections_keys: Read Connections Keys
            update:connections_keys: Update Connections Keys
            read:current_user: Read Current User
            delete:current_user: Delete Current User
            create:current_user_device_credentials: Create Current User Device Credentials
            delete:current_user_device_credentials: Delete Current User Device Credentials
            update:current_user_identities: Update Current User Identities
            update:current_user_metadata: Update Current User Metadata
            create:custom_domains: Create Custom Domains
            read:custom_domains: Read Custom Domains
            update:custom_domains: Update Custom Domains
            delete:custom_domains: Delete Custom Domains
            create:custom_signing_keys: Create Custom Signing Keys
            read:custom_signing_keys: Read Custom Signing Keys
            update:custom_signing_keys: Update Custom Signing Keys
            delete:custom_signing_keys: Delete Custom Signing Keys
            read:device_credentials: Read Device Credentials
            delete:device_credentials: Delete Device Credentials
            create:directory_provisionings: Create Directory Provisionings
            read:directory_provisionings: Read Directory Provisionings
            update:directory_provisionings: Update Directory Provisionings
            delete:directory_provisionings: Delete Directory Provisionings
            create:email_provider: Create Email Provider
            read:email_provider: Read Email Provider
            update:email_provider: Update Email Provider
            delete:email_provider: Delete Email Provider
            create:email_templates: Create Email Templates
            read:email_templates: Read Email Templates
            update:email_templates: Update Email Templates
            create:encryption_keys: Create Encryption Keys
            read:encryption_keys: Read Encryption Keys
            update:encryption_keys: Update Encryption Keys
            delete:encryption_keys: Delete Encryption Keys
            read:event_deliveries: Read Event Deliveries
            update:event_deliveries: Update Event Deliveries
            create:event_streams: Create Event Streams
            read:event_streams: Read Event Streams
            update:event_streams: Update Event Streams
            delete:event_streams: Delete Event Streams
            read:events: Read Events
            create:experimentation: Create Experimentation
            read:experimentation: Read Experimentation
            update:experimentation: Update Experimentation
            delete:experimentation: Delete Experimentation
            read:federated_connections_tokens: Read Federated Connections Tokens
            delete:federated_connections_tokens: Delete Federated Connections Tokens
            create:flows: Create Flows
            read:flows: Read Flows
            update:flows: Update Flows
            delete:flows: Delete Flows
            read:flows_executions: Read Flows Executions
            delete:flows_executions: Delete Flows Executions
            create:flows_vault_connections: Create Flows Vault Connections
            read:flows_vault_connections: Read Flows Vault Connections
            update:flows_vault_connections: Update Flows Vault Connections
            delete:flows_vault_connections: Delete Flows Vault Connections
            create:forms: Create Forms
            read:forms: Read Forms
            update:forms: Update Forms
            delete:forms: Delete Forms
            read:grants: Read Grants
            delete:grants: Delete Grants
            read:group_members: Read Group Members
            create:group_roles: Create Group Roles
            read:group_roles: Read Group Roles
            delete:group_roles: Delete Group Roles
            read:groups: Read Groups
            delete:groups: Delete Groups
            create:guardian_enrollment_tickets: Create Guardian Enrollment Tickets
            read:guardian_enrollments: Read Guardian Enrollments
            delete:guardian_enrollments: Delete Guardian Enrollments
            read:guardian_factors: Read Guardian Factors
            update:guardian_factors: Update Guardian Factors
            create:hooks: Create Hooks
            read:hooks: Read Hooks
            update:hooks: Update Hooks
            delete:hooks: Delete Hooks
            create:log_streams: Create Log Streams
            read:log_streams: Read Log Streams
            update:log_streams: Update Log Streams
            delete:log_streams: Delete Log Streams
            read:logs: Read Logs
            read:logs_users: Read Logs Users
            read:mfa_policies: Read Mfa Policies
            update:mfa_policies: Update Mfa Policies
            create:network_acls: Create Network Acls
            read:network_acls: Read Network Acls
            update:network_acls: Update Network Acls
            delete:network_acls: Delete Network Acls
            create:organization_client_grants: Create Organization Client Grants
            read:organization_client_grants: Read Organization Client Grants
            delete:organization_client_grants: Delete Organization Client Grants
            create:organization_connections: Create Organization Connections
            read:organization_connections: Read Organization Connections
            update:organization_connections: Update Organization Connections
            delete:organization_connections: Delete Organization Connections
            create:organization_discovery_domains: Create Organization Discovery Domains
            read:organization_discovery_domains: Read Organization Discovery Domains
            update:organization_discovery_domains: Update Organization Discovery Domains
            delete:organization_discovery_domains: Delete Organization Discovery Domains
            create:organization_group_roles: Create Organization Group Roles
            read:organization_group_roles: Read Organization Group Roles
            delete:organization_group_roles: Delete Organization Group Roles
            read:organization_groups: Read Organization Groups
            create:organization_invitations: Create Organization Invitations
            read:organization_invitations: Read Organization Invitations
            delete:organization_invitations: Delete Organization Invitations
            read:organization_member_effective_roles: Read Organization Member Effective Roles
            read:organization_member_role_source_groups: Read Organization Member Role Source Groups
            create:organization_member_roles: Create Organization Member Roles
            read:organization_member_roles: Read Organization Member Roles
            delete:organization_member_roles: Delete Organization Member Roles
            create:organization_members: Create Organization Members
            read:organization_members: Read Organization Members
            delete:organization_members: Delete Organization Members
            create:organizations: Create Organizations
            read:organizations: Read Organizations
            update:organizations: Update Organizations
            delete:organizations: Delete Organizations
            read:organizations_summary: Read Organizations Summary
            create:phone_providers: Create Phone Providers
            read:phone_providers: Read Phone Providers
            update:phone_providers: Update Phone Providers
            delete:phone_providers: Delete Phone Providers
            create:phone_templates: Create Phone Templates
            read:phone_templates: Read Phone Templates
            update:phone_templates: Update Phone Templates
            delete:phone_templates: Delete Phone Templates
            read:prompts: Read Prompts
            update:prompts: Update Prompts
            create:rate_limit_policies: Create Rate Limit Policies
            read:rate_limit_policies: Read Rate Limit Policies
            update:rate_limit_policies: Update Rate Limit Policies
            delete:rate_limit_policies: Delete Rate Limit Policies
            read:refresh_tokens: Read Refresh Tokens
            update:refresh_tokens: Update Refresh Tokens
            delete:refresh_tokens: Delete Refresh Tokens
            create:resource_servers: Create Resource Servers
            read:resource_servers: Read Resource Servers
            update:resource_servers: Update Resource Servers
            delete:resource_servers: Delete Resource Servers
            create:role_members: Create Role Members
            read:role_members: Read Role Members
            delete:role_members: Delete Role Members
            create:roles: Create Roles
            read:roles: Read Roles
            update:roles: Update Roles
            delete:roles: Delete Roles
            create:rules: Create Rules
            read:rules: Read Rules
            update:rules: Update Rules
            delete:rules: Delete Rules
            read:rules_configs: Read Rules Configs
            update:rules_configs: Update Rules Configs
            delete:rules_configs: Delete Rules Configs
            create:scim_config: Create Scim Config
            read:scim_config: Read Scim Config
            update:scim_config: Update Scim Config
            delete:scim_config: Delete Scim Config
            create:scim_token: Create Scim Token
            read:scim_token: Read Scim Token
            delete:scim_token: Delete Scim Token
            read:self_service_profile_custom_texts: Read Self Service Profile Custom Texts
            update:self_service_profile_custom_texts: Update Self Service Profile Custom Texts
            create:self_service_profiles: Create Self Service Profiles
            read:self_service_profiles: Read Self Service Profiles
            update:self_service_profiles: Update Self Service Profiles
            delete:self_service_profiles: Delete Self Service Profiles
            read:sessions: Read Sessions
            update:sessions: Update Sessions
            delete:sessions: Delete Sessions
            create:signing_keys: Create Signing Keys
            read:signing_keys: Read Signing Keys
            update:signing_keys: Update Signing Keys
            create:sso_access_tickets: Create Sso Access Tickets
            delete:sso_access_tickets: Delete Sso Access Tickets
            read:stats: Read Stats
            read:tenant_settings: Read Tenant Settings
            update:tenant_settings: Update Tenant Settings
            create:token_exchange_profiles: Create Token Exchange Profiles
            read:token_exchange_profiles: Read Token Exchange Profiles
            update:token_exchange_profiles: Update Token Exchange Profiles
            delete:token_exchange_profiles: Delete Token Exchange Profiles
            create:user_attribute_profiles: Create User Attribute Profiles
            read:user_attribute_profiles: Read User Attribute Profiles
            update:user_attribute_profiles: Update User Attribute Profiles
            delete:user_attribute_profiles: Delete User Attribute Profiles
            read:user_effective_permissions: Read User Effective Permissions
            read:user_effective_roles: Read User Effective Roles
            read:user_idp_tokens: Read User Idp Tokens
            read:user_permission_source_roles: Read User Permission Source Roles
            read:user_role_source_groups: Read User Role Source Groups
            create:user_tickets: Create User Tickets
            create:users: Create Users
            read:users: Read Users
            update:users: Update Users
            delete:users: Delete Users
            update:users_app_metadata: Update Users App Metadata
            create:vdcs_templates: Create Vdcs Templates
            read:vdcs_templates: Read Vdcs Templates
            update:vdcs_templates: Update Vdcs Templates
            delete:vdcs_templates: Delete Vdcs Templates

````