Project

For projects, the title is used as an identifier, converted to lowercase with spaces replaced by underscores. This can later be used as the project_id, which serves as the category for applications. The project name can include Latin letters (upper and lower case), digits, spaces, and the underscore symbol. The maximum length of the string is 32 characters.

Publish Project

Creates a new project with the specified title. The project ID is derived from the title (converted to lowercase, spaces replaced by underscores). Sets the project administrator flags for both the request author and the target user, if specified.

Pre-request validation:

Project title uniqueness
Application name uniqueness within the project
The target user must have 2FA enabled (email 2FA does not count)
The project title must not produce a reserved ID (internal, game)

Access Requirements

The request author must have a positive can_create_projects rule.

Note

It is possible to limit the number of projects a user can create by assigning a parameterized role that includes the can_create_projects rule. In the role parameters, specify an integer representing the maximum number of projects allowed.

If multiple rules of this type are present with different limits, the highest limit will apply. If both limited and unlimited rules are assigned, no limit will be enforced.

Request

POST /api/permissions/publish

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
project string required 

Project title.
user string optional 

Target user to assign as project administrator.

Request example

POST /api/permissions/publish

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "project": "Test Project",
  "user": "user123"
}

Response

OK

Success

status string required 
- “OK”
data object required 
- project object required 
  - id string required 
    
    Generated project ID.
  - title string required 
    
    Project title.

Response example

{
  "status": "OK",
  "data": {
    "project": {
      "id": "test_project",
      "title": "Test Project"
    }
  }
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "project already exists"
}

Retrieve, Edit, and Delete Project

Retrieves, updates, or deletes a project record.

Access Requirements

Retrieve ("get"): projectID/project.can_view_project
Edit ("save"): projectID/project.can_manage_project
Delete ("delete"): projectID/project.can_remove_project

Note

Deletion sets the removed=true flag on the project record. Project users will no longer be able to make API requests. To fully delete the record and all associated resources, use the control panel.

Request

POST /api/permissions/project

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
action string required 

Action to perform. Allowed values: "get", "save", "delete".
data object required 

Action payload. Fields vary by action.
- id string optional 
  
  Project ID. Required for "get", "save", and "delete".
- title string optional 
  
  Project title. Used for "save".
- description string optional 
  
  Project description.
- aliases array of strings optional 
  
  Additional project identifiers. Can be used in place of project_id in user schema requests.
- tags array of strings optional 
  
  Project tags. Read-only on retrieval, use the dedicated tags endpoint to update.
- settings object optional 
  
  Project access settings.
  - allowed_domains array of strings optional 
    
    List of allowed login domains.
- services object optional 
  
  Service settings for the project, keyed by application ID. Each entry contains a groups array with group role assignments (grant or revoke).

Request example

POST /api/permissions/project

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body (save)

{
  "action": "save",
  "data": {
    "id": "test_project",
    "title": "Test Project",
    "description": "Project description",
    "aliases": ["test_alias"],
    "settings": {
      "allowed_domains": ["example.com"]
    }
  }
}

Body (delete)

{
  "action": "delete",
  "data": {
    "id": "test_project"
  }
}

Response

OK

Success

status string required 
- “OK”
data object optional 

Returned for "get" and "save". Not returned for "delete".
- id string required 
  
  Project ID.
- title string required 
  
  Project title.
- description string optional 
  
  Project description.
- aliases array of strings optional 
  
  Additional project identifiers.
- tags array of strings optional 
  
  List of tags assigned to the project.

Response example (get/save)

{
  "status": "OK",
  "data": {
    "id": "test_project",
    "title": "Test Project",
    "description": "Project description",
    "aliases": ["test_alias"],
    "tags": ["internal"]
  }
}

Response example (delete)

{
  "status": "OK"
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "project not found"
}

Set Project Tags

Replaces the existing tags for the project with the provided set.

Access Requirements

The request author must have a positive can_manage_project_tags rule. Additional tag parameters are checked in the params field of the rule.

Request

POST /api/permissions/project/tags

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
data object required 
- id string required 
  
  Project ID.
- tags array of strings required 
  
  New list of tags. Replaces the existing tags entirely.

Request example

POST /api/permissions/project/tags

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "data": {
    "id": "test_project",
    "tags": ["internal", "game"]
  }
}

Response

OK

Success

status string required 
- “OK”
data object required 

Updated project data.
- title string required 
  
  Project title.
- description string optional 
  
  Project description.
- tags array of strings optional 
  
  List of tags assigned to the project.

Response example

{
  "status": "OK",
  "data": {
    "title": "Test Project",
    "description": "Project description",
    "tags": ["internal", "game"]
  }
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "project not found"
}

Retrieve and Update Project Membership Settings

Retrieves or updates the group-based membership restrictions for a project. Membership settings define which user groups are allowed or disallowed from joining the project.

Access Requirements

Retrieve ("get"): projectID/project.can_view_project
Update ("save"): projectID/project.can_manage_project

Note

Groups must have the project tag assigned before they can be added to the allow or disallow lists.

Request

POST /api/permissions/project/membership

Warning

Passing jwt, factor, and service_jwt in the request body is deprecated. Use the corresponding HTTP headers instead.

jwt string required 

User’s JWT token.
factor string conditionally required 

User device factor. Required if service_jwt is not provided.
service_jwt string conditionally required 

Service JWT. Required if factor is not provided.
action string required 

Action to perform. Allowed values: "get", "save".
data object required 
- id string required 
  
  Project ID.
- settings object optional 
  
  Required for the "save" action.
  - allow_groups array of strings optional 
    
    List of allowed group IDs.
  - disallow_groups array of strings optional 
    
    List of disallowed group IDs.

Request example (save)

POST /api/permissions/project/membership

Headers

Authorization: Bearer eyJhbGci...
Factor: ...

Body

{
  "action": "save",
  "data": {
    "id": "test_project",
    "settings": {
      "allow_groups": ["groupId1", "groupId2"],
      "disallow_groups": ["groupId3"]
    }
  }
}

Response

OK

Success

status string required 
- “OK”
data object required 

Current membership settings.
- allow_groups array of strings optional 
  
  List of allowed group IDs.
- disallow_groups array of strings optional 
  
  List of disallowed group IDs.
- allowed_domains array of strings optional 
  
  List of allowed login domains.
- max_users_cnt integer required 
  
  Maximum number of users allowed in the project.

Response example

{
  "status": "OK",
  "data": {
    "allow_groups": ["groupId1", "groupId2"],
    "disallow_groups": ["groupId3"],
    "allowed_domains": ["example.com"],
    "max_users_cnt": 100
  }
}

ERROR

Error

status string required 
- “ERROR”
error string required 

Descriptive error message.

Response example

{
  "status": "ERROR",
  "error": "project not found"
}