RFC-3339 timestamp indicating where to start streaming events from. This should only be used on the initial query when a cursor may not be available. Subsequent requests should use the cursor (from) as it will be more accurate.
Event type(s) to listen for. Specify multiple times for multiple types (e.g., ?event_type=user.created&event_type=user.updated). If not provided, all event types will be streamed.
Available options:
connection.created,
connection.deleted,
connection.updated,
group.created,
group.deleted,
group.member.added,
group.member.deleted,
group.role.assigned,
group.role.deleted,
group.updated,
organization.connection.added,
organization.connection.removed,
organization.connection.updated,
organization.created,
organization.deleted,
organization.group.role.assigned,
organization.group.role.deleted,
organization.member.added,
organization.member.deleted,
organization.member.role.assigned,
organization.member.role.deleted,
organization.updated,
user.created,
user.deleted,
user.updated
Response
Event stream successfully established.
Option 1
Option 2
Option 3
Option 4
Option 5
Option 6
Option 7
Option 8
Option 9
Option 10
Option 11
Option 12
Option 13
Option 14
Option 15
Option 16
Option 17
Option 18
Option 19
Option 20
Option 21
Option 22
Option 23
Option 24
Option 25
Option 26
Option 27
The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, "error" for errors, and "offset-only" for cursor-only heartbeats.
Represents an event that occurs when a connection is created.
Show child attributes
{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Auth0 Docs","description":"Auth0 documentation","colors":{"primary":"#9921FE","light":"#BC6DFF","dark":"#343434"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/dark.svg","href":"https://auth0.com/docs/"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/favicon.svg","api":{"params":{"post":["x-release-lifecycle"]},"playground":{"proxy":false},"url":"full"},"background":{"decoration":"gradient"},"footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"Developers","items":[{"label":"Developer Hub","href":"https://developer.auth0.com"},{"label":"Code Samples \u0026 Guides","href":"https://developer.auth0.com/resources"},{"label":"Zero Index Newsletter","href":"https://auth0.com/blog/newsletter"},{"label":"Blog","href":"https://auth0.com/blog"},{"label":"Changelog","href":"https://auth0.com/changelog"}]},{"header":"Docs","items":[{"label":"Documentation","href":"https://auth0.com/docs"},{"label":"Quickstarts","href":"https://auth0.com/docs/quickstarts"},{"label":"APIs","href":"https://auth0.com/docs/api"},{"label":"SDK Libraries","href":"https://auth0.com/docs/libraries"},{"label":"Learn","href":"https://auth0.com/learn"},{"label":"Intro to IAM (CIAM)","href":"https://auth0.com/intro-to-iam"},{"label":"Reports","href":"https://auth0.com/resources/whitepapers"},{"label":"Webinars","href":"https://auth0.com/resources/webinars"}]},{"header":"Support Center","items":[{"label":"Community","href":"https://community.auth0.com"},{"label":"Help","href":"https://support.auth0.com"},{"label":"FAQs","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"Company","items":[{"label":"Our Customers","href":"https://auth0.com/customers"},{"label":"Compliance","href":"https://auth0.com/security"},{"label":"Partners","href":"https://auth0.com/partners"},{"label":"Careers","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"About us","href":"https://auth0.com/about"}]}]},"seo":{"metatags":{"canonical":"https://auth0.com","og:image":"docs/images/share-image.png"}},"fonts":{"body":{"family":"Inter","source":"https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026display=swap","format":"woff2"}},"styling":{"eyebrows":"breadcrumbs","latex":true},"integrations":{"adobe":{"launchUrl":"https://assets.adobedtm.com/6bb3f7663515/7006851c9849/launch-af624fe9e34f.min.js"},"gtm":{"tagId":"GTM-W7FRLJ"},"heap":{"appId":"1279799279"},"onetrust":{"domainScript":"96e22fd8-d619-4cdd-a3c6-d51529d21faf","categoryId":"C0002","scriptSource":"https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"}},"contextual":{"options":["copy","view","chatgpt","claude"],"display":"header"},"navigation":{"languages":[{"language":"en","href":"docs"},{"language":"fr","href":"docs/fr-ca"},{"language":"ja","href":"docs/ja-jp"}]}},"deployment":{"deploymentMetadataValue":{"subdomain":"docs-staging","hasAudioNarration":false,"actualSubdomain":"docs-staging","customDomains":["docs-staging.auth0-mintlify.app"],"gitSource":{"type":"github","owner":"atko-cic","repo":"docs","deployBranch":"staging","contentDirectory":"main","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ace95d40456156b29823175","collectionId":"833e092c-b52e-4501-b98a-01804fd1aef4","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ace95d40456156b29823175"},"feedback":{"thumbs":true,"contextualFeedback":{"textInputOnly":true}},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"REMOVE_BRANDING":{"status":"ENABLED"},"CONTEXTUAL_FEEDBACK":{"status":"ENABLED"},"CODE_SNIPPET_FEEDBACK":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ace95d40456156b29823175","clientVersion":"0.0.4045","searchFilterCounts":[{"language":"en","tag":"Dev Tools","count":1030},{"language":"fr","tag":"Dev Tools","count":1026},{"language":"ja","tag":"Dev Tools","count":1026},{"language":"en","tag":"APIs","count":605},{"language":"fr","tag":"APIs","count":601},{"language":"ja","tag":"APIs","count":601},{"language":"en","tag":"Management API","count":481},{"language":"fr","tag":"Management API","count":481},{"language":"ja","tag":"Management API","count":481},{"language":"en","tag":"Get Started","count":277},{"language":"fr","tag":"Get Started","count":274},{"language":"ja","tag":"Get Started","count":274},{"language":"en","tag":"Customize","count":269},{"language":"fr","tag":"Customize","count":269},{"language":"ja","tag":"Customize","count":269},{"language":"en","tag":"Manage Users","count":206},{"language":"fr","tag":"Manage Users","count":206},{"language":"ja","tag":"Manage Users","count":206},{"language":"en","tag":"SDKs","count":202},{"language":"fr","tag":"SDKs","count":202},{"language":"ja","tag":"SDKs","count":202},{"language":"en","tag":"Authenticate","count":185},{"language":"fr","tag":"Authenticate","count":185},{"language":"ja","tag":"Authenticate","count":185},{"language":"en","tag":"Tenant Log Catalog","count":170},{"language":"fr","tag":"Tenant Log Catalog","count":170},{"language":"ja","tag":"Tenant Log Catalog","count":170},{"language":"en","tag":"Secure","count":159},{"language":"fr","tag":"Secure","count":159},{"language":"ja","tag":"Secure","count":159},{"language":"default","tag":"Dev Tools","count":1},{"language":"default","tag":"APIs","count":1},{"language":"default","tag":"Authentication API","count":1},{"language":"default","tag":"On-Behalf-Of Token Exchange","count":1}]},"assistantConfig":{},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[],"googleFontsInlined":false},"customCss":[{"filePath":"ui/css/recipe.css","content":"#content-area:has(.recipe-container){overflow:visible!important}.recipe-content .recipe-section:first-of-type{margin-top:1rem}.active-section{opacity:1!important}"},{"filePath":"ui/css/styles.css","content":"@keyframes spin{0%{transform:rotate(0deg)}to{transform:rotate(360deg)}}@font-face{font-family:\"Inter Fallback\";src:local(\"Arial\");size-adjust:107%;ascent-override:90%;descent-override:22%;line-gap-override:0%}body{font-feature-settings:\"kern\",\"liga\",\"clig\",\"calt\",\"rvrn\";font-family:\"Inter\",\"Inter Fallback\",system-ui,-apple-system,sans-serif}.mdx-content{line-height:1.625}#page-title{font-size:var(--text-3xl);line-height:1.15}.mdx-content .link{font-weight:inherit;border:0;text-decoration:underline;text-underline-offset:2px;transition:opacity .15s ease-out}.mdx-content .link:hover{color:rgb(var(--tw-prose-links))}.dark .mdx-content .link:hover,.mdx-content .link,.nav-tabs-item:hover,.nav-tabs-item[data-active]{color:rgb(var(--primary))}.mdx-content table{border-radius:12px;border:0;box-shadow:0 0 0 1px rgb(from var(--border-muted) r g b/50%);overflow:hidden}img.icon.inline{margin:0}#navbar{padding-bottom:.5rem;box-shadow:0 0 0 1px oklch(from var(--border) l c h/.1),0 1px 1px -1px oklch(from var(--shadow) l c h/.06),0 2px 2px -2px oklch(from var(--shadow) l c h/.06),0 2px 4px -2px oklch(from var(--shadow) l c h/.06)}.nav-tabs{column-gap:0}.nav-tabs-item{padding:.25rem .75rem;text-shadow:none}.dark .nav-tabs-item[data-active]{color:rgb(var(--primary-light))}.nav-tabs-item:hover{background-color:rgb(var(--primary)/.1);transition:all .15s ease-out;border-radius:.75rem}#sidebar-content{border-color:transparent}.card{transition:all .15s ease}.libraries_card{border:1px solid var(--border-muted)}.api_card_wrapper .card{background-color:transparent;color:var(--foreground-card);border-radius:0;border-bottom:3px solid currentColor!important;margin-bottom:1rem}[data-component-part=field-meta-post]{background-color:lab(91.896% .077188 -6.94053);color:lab(36.091% 25.9241 -68.0384)}.dark [data-component-part=field-meta-post]{background-color:lab(16.0426% 6.71726 -27.2409);color:lab(72.6029% 4.08953 -41.9669)}.custom-grid-container{margin-top:2rem}.custom-grid-search-container{margin-bottom:2rem;display:flex;flex-direction:column;gap:1rem;align-items:flex-start}.custom-grid-search-filter-wrapper{display:flex;gap:1rem;align-items:center;width:100%;flex-wrap:wrap;justify-content:space-between}.custom-grid-search-input-wrapper{position:relative;width:320px;flex-shrink:0}.custom-grid-search-input{width:100%;padding:.35rem .5rem .35rem 2.5rem;border:1px solid var(--border-input);border-radius:16px;height:2.5rem;color:var(--foreground);font-size:.875rem;outline:0;transition:all .2s ease;box-sizing:border-box;box-shadow:inset 0 1px 2px rgb(0 0 0/5%)}.custom-grid-search-input:focus{border-color:rgb(var(--primary));background-color:var(--card);box-shadow:inset 0 1px 2px rgb(0 0 0/5%),0 0 0 3px rgb(var(--primary)/.1)}.custom-grid-search-input:not(:focus){border-color:var(--border-input);background-color:var(--page);box-shadow:inset 0 1px 2px rgb(0 0 0/5%)}.custom-grid-search-icon{position:absolute;left:.875rem;top:50%;transform:translateY(-50%);color:var(--foreground);pointer-events:none}.custom-grid-no-results{display:flex;flex-direction:column;align-items:center;justify-content:center;text-align:center;padding:3rem 2rem;border:2px dashed var(--border-muted);border-radius:8px}.custom-grid-no-results-icon{margin-bottom:1rem;padding:2rem;border-radius:1.5rem;box-shadow:inset 0 -1px 1px -1px rgb(0 0 0/6%),inset 0 -2px 4px -1px rgb(0 0 0/8%),0 0 0 .5px rgb(0 0 0/6%),0 1px 1px -1px rgb(0 0 0/8%),0 1px 2px -1px rgb(0 0 0/8%),0 2px 2px -1px rgb(0 0 0/8%),0 2px 4px -1px rgb(0 0 0/8%)}.custom-grid-no-results-title{margin:0 0 .5rem;color:var(--foreground-bold);font-size:1.25rem}.custom-grid-no-results-text{color:var(--foreground);margin:0;font-size:.875rem}.custom-grid-filter-buttons{display:flex;gap:1px;flex-wrap:wrap;height:2.5rem;background-color:rgb(from var(--border) r g b/50%);border-radius:16px;padding:1px;border:1px solid var(--border);position:relative}.custom-grid-filter-button{padding:.35rem .875rem;border-radius:14px;color:var(--foreground);font-size:.875rem;font-weight:600;cursor:pointer;transition:all .2s ease-out;outline:0;border:0;background:0 0;position:relative;z-index:1}.custom-grid-filter-button.active,.custom-grid-filter-button:hover{color:var(--foreground-bold)}.custom-grid-filter-buttons-indicator{position:absolute;top:2px;left:2px;height:calc(100% - 4px);background-color:#fff;transition:transform .3s cubic-bezier(.4,0,.2,1),width .3s cubic-bezier(.4,0,.2,1),opacity .2s cubic-bezier(.4,0,.2,1);border-radius:14px;z-index:0;pointer-events:none;opacity:0;box-shadow:inset 0 -1px 1px -1px rgb(0 0 0/6%),inset 0 -2px 4px -1px rgb(0 0 0/8%),0 0 0 .5px rgb(0 0 0/6%),0 1px 1px -1px rgb(0 0 0/8%),0 1px 2px -1px rgb(0 0 0/8%),0 2px 2px -1px rgb(0 0 0/8%),0 2px 4px -1px rgb(0 0 0/8%)}.dark .custom-grid-filter-buttons-indicator{background-color:var(--card)}.custom-card{display:flex;flex-direction:column;height:100%;min-height:200px}.custom-card-header{display:flex;align-items:center;margin-bottom:.75rem}.custom-card-icon{font-size:1.5rem;margin-right:.75rem}.custom-card-description.coming-soon,.custom-card-icon.coming-soon,.custom-card-title.coming-soon,.custom-card-type-tag.coming-soon{opacity:.6}.custom-card-icon img{width:1em;height:1em;vertical-align:middle}.custom-card-title{margin:0;font-size:1.25rem}.custom-card-description{margin:0;font-size:.875rem;line-height:1.5;flex:1}.custom-card-footer{display:flex;justify-content:space-between;align-items:flex-end;margin-top:auto}.custom-card-type-tag{font-size:.875rem;line-height:1.25;padding:.125rem .375rem;background-color:rgb(var(--primary)/.15);border-radius:.5rem;font-weight:500;color:rgb(var(--primary));display:inline-block}.custom-card-coming-soon{font-size:.875rem;font-style:italic}.download-button-container{display:inline-block;margin-bottom:1rem}.download-button{display:inline-flex;align-items:center;gap:.5rem;padding:.5rem 1.125rem .5rem 1rem;border-radius:.75rem;font-size:.95rem;font-weight:600;cursor:pointer;transition:all .2s ease;text-decoration:none;color:var(--foreground-inverse);background-color:var(--button-primary);box-shadow:0 0 0 1px oklch(from var(--button-primary) l c h/.12),0 1px 1px -1px oklch(from var(--button-primary) l c h/.06),0 2px 2px -2px oklch(from var(--button-primary) l c h/.06),0 2px 4px -2px oklch(from var(--button-primary) l c h/.06),0 4px 6px -4px oklch(from var(--button-primary) l c h/.06),0 6px 8px -6px oklch(from var(--button-primary) l c h/.06),0 -1px 2px 0 oklch(from var(--button-primary) l c h/.2) inset}.download-button:hover:not(:disabled){background-color:oklch(from var(--button-primary) l c h/.8);box-shadow:0 0 0 4px oklch(from var(--button-primary) l c h/.06),0 1px 1px -1px oklch(from var(--button-primary) l c h/.06),0 2px 2px -2px oklch(from var(--button-primary) l c h/.06),0 2px 4px -2px oklch(from var(--button-primary) l c h/.06),0 4px 6px -4px oklch(from var(--button-primary) l c h/.06),0 6px 8px -6px oklch(from var(--button-primary) l c h/.06),0 -1px 2px 0 oklch(from var(--button-primary) l c h/.2) inset}.download-button:disabled{opacity:.6;cursor:not-allowed}.download-button.downloading{pointer-events:none}.download-spinner{animation:spin 1s linear infinite}"},{"filePath":"ui/css/apiExplorer.css","content":".api-section-heading-subtitle,.array-param-field,.object-param-field,.primitive-param-field{font-size:.875rem}"},{"filePath":"ui/auth0-docs-ui-1.10.0.css","content":"/*! tailwindcss v4.1.13 | MIT License | https://tailwindcss.com */\n@keyframes pulse{50%{opacity:.5}}@keyframes enter{0%{opacity:var(--tw-enter-opacity,1);transform:translate3d(var(--tw-enter-translate-x,0),var(--tw-enter-translate-y,0),0)scale3d(var(--tw-enter-scale,1),var(--tw-enter-scale,1),var(--tw-enter-scale,1))rotate(var(--tw-enter-rotate,0));filter:blur(var(--tw-enter-blur,0))}}@keyframes exit{to{opacity:var(--tw-exit-opacity,1);transform:translate3d(var(--tw-exit-translate-x,0),var(--tw-exit-translate-y,0),0)scale3d(var(--tw-exit-scale,1),var(--tw-exit-scale,1),var(--tw-exit-scale,1))rotate(var(--tw-exit-rotate,0));filter:blur(var(--tw-exit-blur,0))}}@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,::backdrop,:after,:before{--tw-border-style:solid;--tw-leading:initial;--tw-font-weight:initial;--tw-tracking:initial;--tw-shadow:0 0 #0000;--tw-shadow-color:initial;--tw-shadow-alpha:100%;--tw-inset-shadow:0 0 #0000;--tw-inset-shadow-color:initial;--tw-inset-shadow-alpha:100%;--tw-ring-color:initial;--tw-ring-shadow:0 0 #0000;--tw-inset-ring-color:initial;--tw-inset-ring-shadow:0 0 #0000;--tw-ring-inset:initial;--tw-ring-offset-width:0px;--tw-ring-offset-color:#fff;--tw-ring-offset-shadow:0 0 #0000;--tw-ease:initial;--tw-animation-delay:0s;--tw-animation-direction:normal;--tw-animation-duration:initial;--tw-animation-fill-mode:none;--tw-animation-iteration-count:1;--tw-enter-blur:0;--tw-enter-opacity:1;--tw-enter-rotate:0;--tw-enter-scale:1;--tw-enter-translate-x:0;--tw-enter-translate-y:0;--tw-exit-blur:0;--tw-exit-opacity:1;--tw-exit-rotate:0;--tw-exit-scale:1;--tw-exit-translate-x:0;--tw-exit-translate-y:0}}}@layer theme{:host,:root{--adu-font-sans:ui-sans-serif,system-ui,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\";--adu-font-mono:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,\"Liberation Mono\",\"Courier New\",monospace;--adu-color-blue-500:oklch(62.3% .214 259.815);--adu-color-white:#fff;--adu-spacing:.25rem;--adu-text-xs--line-height:calc(1/.75);--adu-text-sm--line-height:calc(1.25/.875);--adu-text-base--line-height:1.5;--adu-text-lg--line-height:calc(1.75/1.125);--adu-text-xl--line-height:calc(1.75/1.25);--adu-text-2xl--line-height:calc(2/1.5);--adu-text-3xl--line-height:1.2;--adu-tracking-widest:.1em;--adu-ease-in-out:cubic-bezier(.4,0,.2,1);--adu-animate-pulse:pulse 2s cubic-bezier(.4,0,.6,1)infinite;--adu-default-transition-duration:.15s;--adu-default-transition-timing-function:cubic-bezier(.4,0,.2,1);--adu-default-font-family:var(--adu-font-sans);--adu-default-mono-font-family:var(--adu-font-mono)}}@layer base{*,::backdrop,:after,:before{box-sizing:border-box;border:0 solid;margin:0;padding:0}::file-selector-button{box-sizing:border-box;border:0 solid;margin:0;padding:0;font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0;margin-inline-end:4px}:host,html{-webkit-text-size-adjust:100%;tab-size:4;line-height:1.5;font-family:var(--adu-default-font-family,ui-sans-serif,system-ui,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\");font-feature-settings:var(--adu-default-font-feature-settings,normal);font-variation-settings:var(--adu-default-font-variation-settings,normal);-webkit-tap-highlight-color:transparent}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;-webkit-text-decoration:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,pre,samp{font-family:var(--adu-default-mono-font-family,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,\"Liberation Mono\",\"Courier New\",monospace);font-feature-settings:var(--adu-default-mono-font-feature-settings,normal);font-variation-settings:var(--adu-default-mono-font-variation-settings,normal);font-size:1em}small{font-size:80%}sub,sup{vertical-align:baseline;font-size:75%;line-height:0;position:relative}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}:-moz-focusring{outline:auto}progress{vertical-align:baseline}summary{display:list-item}menu,ol,ul{list-style:none}audio,canvas,embed,iframe,img,object,svg,video{vertical-align:middle;display:block}img,video{max-width:100%;height:auto}button,input,optgroup,select,textarea{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}:where(select:is([multiple],[size])) optgroup{font-weight:bolder}:where(select:is([multiple],[size])) optgroup option{padding-inline-start:20px}::placeholder{opacity:1}@supports (not ((-webkit-appearance:-apple-pay-button))) or (contain-intrinsic-size:1px){::placeholder{color:currentColor}@supports (color:color-mix(in lab,red,red)){::placeholder{color:color-mix(in oklab,currentcolor 50%,transparent)}}}textarea{resize:vertical}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-date-and-time-value{min-height:1lh;text-align:inherit}::-webkit-datetime-edit{display:inline-flex}::-webkit-datetime-edit-fields-wrapper{padding:0}::-webkit-datetime-edit{padding-block:0}::-webkit-datetime-edit-year-field{padding-block:0}::-webkit-datetime-edit-month-field{padding-block:0}::-webkit-datetime-edit-day-field{padding-block:0}::-webkit-datetime-edit-hour-field{padding-block:0}::-webkit-datetime-edit-minute-field{padding-block:0}::-webkit-datetime-edit-second-field{padding-block:0}::-webkit-datetime-edit-millisecond-field{padding-block:0}::-webkit-datetime-edit-meridiem-field{padding-block:0}::-webkit-calendar-picker-indicator{line-height:1}:-moz-ui-invalid{box-shadow:none}button,input:where([type=button],[type=reset],[type=submit]){appearance:button}::file-selector-button{appearance:button}::-webkit-inner-spin-button{height:auto}::-webkit-outer-spin-button{height:auto}[hidden]:where(:not([hidden=until-found])){display:none!important}*{border-color:var(--color-border);outline-color:var(--color-ring)}@supports (color:color-mix(in lab,red,red)){*{outline-color:color-mix(in srgb,var(--color-ring)50%,transparent)}}body{background-color:var(--color-background);color:var(--color-foreground);text-rendering:optimizeLegibility;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-synthesis:style;font-feature-settings:\"kern\",\"liga\",\"clig\",\"calt\",\"rvrn\"}}@layer components;@layer utilities{.adu\\:\\@container\\/card-header{container:card-header/inline-size}.adu\\:pointer-events-none{pointer-events:none}.adu\\:sr-only{clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden}.adu\\:absolute,.adu\\:sr-only{position:absolute}.adu\\:fixed{position:fixed}.adu\\:relative{position:relative}.adu\\:static{position:static}.adu\\:top-0{top:calc(var(--adu-spacing)*0)}.adu\\:right-0{right:calc(var(--adu-spacing)*0)}.adu\\:left-0{left:calc(var(--adu-spacing)*0)}.adu\\:left-2{left:calc(var(--adu-spacing)*2)}.adu\\:left-73{left:calc(var(--adu-spacing)*73)}.adu\\:z-0{z-index:0}.adu\\:z-30{z-index:30}.adu\\:z-50{z-index:50}.adu\\:z-\\[39\\]{z-index:39}.adu\\:col-start-2{grid-column-start:2}.adu\\:row-span-2{grid-row:span 2/span 2}.adu\\:row-start-1{grid-row-start:1}.adu\\:-mx-1{margin-inline:calc(var(--adu-spacing)*-1)}.adu\\:my-1{margin-block:calc(var(--adu-spacing)*1)}.adu\\:mr-2{margin-right:calc(var(--adu-spacing)*2)}.adu\\:-ml-8{margin-left:calc(var(--adu-spacing)*-8)}.adu\\:ml-2{margin-left:calc(var(--adu-spacing)*2)}.adu\\:ml-auto{margin-left:auto}.adu\\:flex{display:flex}.adu\\:grid{display:grid}.adu\\:hidden{display:none}.adu\\:inline-block{display:inline-block}.adu\\:inline-flex{display:inline-flex}.adu\\:aspect-square{aspect-ratio:1}.adu\\:size-2{width:calc(var(--adu-spacing)*2);height:calc(var(--adu-spacing)*2)}.adu\\:size-3\\.5{width:calc(var(--adu-spacing)*3.5);height:calc(var(--adu-spacing)*3.5)}.adu\\:size-4{width:calc(var(--adu-spacing)*4);height:calc(var(--adu-spacing)*4)}.adu\\:size-8{width:calc(var(--adu-spacing)*8);height:calc(var(--adu-spacing)*8)}.adu\\:size-9{width:calc(var(--adu-spacing)*9);height:calc(var(--adu-spacing)*9)}.adu\\:size-full{width:100%;height:100%}.adu\\:h-4{height:calc(var(--adu-spacing)*4)}.adu\\:h-8{height:calc(var(--adu-spacing)*8)}.adu\\:h-9{height:calc(var(--adu-spacing)*9)}.adu\\:h-10{height:calc(var(--adu-spacing)*10)}.adu\\:h-14{height:calc(var(--adu-spacing)*14)}.adu\\:h-\\[18px\\]{height:18px}.adu\\:h-px{height:1px}.adu\\:max-h-\\(--radix-dropdown-menu-content-available-height\\){max-height:var(--radix-dropdown-menu-content-available-height)}.adu\\:max-h-72\\.5{max-height:calc(var(--adu-spacing)*72.5)}.adu\\:max-h-\\[calc\\(100\\%\\+2px\\)\\]{max-height:calc(100% + 2px)}.adu\\:w-4{width:calc(var(--adu-spacing)*4)}.adu\\:w-8{width:calc(var(--adu-spacing)*8)}.adu\\:w-9{width:calc(var(--adu-spacing)*9)}.adu\\:w-48{width:calc(var(--adu-spacing)*48)}.adu\\:w-73{width:calc(var(--adu-spacing)*73)}.adu\\:w-\\[24px\\]{width:24px}.adu\\:w-full{width:100%}.adu\\:min-w-\\[8rem\\]{min-width:8rem}.adu\\:flex-1{flex:1}.adu\\:shrink-0{flex-shrink:0}.adu\\:origin-\\(--radix-dropdown-menu-content-transform-origin\\){transform-origin:var(--radix-dropdown-menu-content-transform-origin)}.adu\\:animate-in{animation:enter var(--tw-animation-duration,var(--tw-duration,.15s))var(--tw-ease,ease)var(--tw-animation-delay,0s)var(--tw-animation-iteration-count,1)var(--tw-animation-direction,normal)var(--tw-animation-fill-mode,none)}.adu\\:animate-out{animation:exit var(--tw-animation-duration,var(--tw-duration,.15s))var(--tw-ease,ease)var(--tw-animation-delay,0s)var(--tw-animation-iteration-count,1)var(--tw-animation-direction,normal)var(--tw-animation-fill-mode,none)}.adu\\:animate-pulse{animation:var(--adu-animate-pulse)}.adu\\:cursor-default{cursor:default}.adu\\:auto-rows-min{grid-auto-rows:min-content}.adu\\:grid-rows-\\[auto_auto\\]{grid-template-rows:auto auto}.adu\\:flex-col{flex-direction:column}.adu\\:flex-wrap{flex-wrap:wrap}.adu\\:items-center{align-items:center}.adu\\:items-start{align-items:flex-start}.adu\\:justify-center{justify-content:center}.adu\\:gap-0{gap:calc(var(--adu-spacing)*0)}.adu\\:gap-1{gap:calc(var(--adu-spacing)*1)}.adu\\:gap-1\\.5{gap:calc(var(--adu-spacing)*1.5)}.adu\\:gap-2{gap:calc(var(--adu-spacing)*2)}.adu\\:gap-3{gap:calc(var(--adu-spacing)*3)}.adu\\:gap-4{gap:calc(var(--adu-spacing)*4)}.adu\\:gap-6{gap:calc(var(--adu-spacing)*6)}.adu\\:gap-8{gap:calc(var(--adu-spacing)*8)}.adu\\:self-start{align-self:flex-start}.adu\\:self-stretch{align-self:stretch}.adu\\:justify-self-end{justify-self:flex-end}.adu\\:overflow-auto{overflow:auto}.adu\\:overflow-hidden{overflow:hidden}.adu\\:overflow-x-hidden{overflow-x:hidden}.adu\\:overflow-y-auto{overflow-y:auto}.adu\\:rounded{border-radius:.25rem}.adu\\:rounded-full{border-radius:9999px}.adu\\:rounded-md{border-radius:.5rem}.adu\\:rounded-none{border-radius:0}.adu\\:rounded-sm{border-radius:.375rem}.adu\\:rounded-xl{border-radius:.875rem}.adu\\:border{border-style:var(--tw-border-style);border-width:1px}.adu\\:border\\!{border-style:var(--tw-border-style)!important;border-width:1px!important}.adu\\:border-border-input{border-color:var(--border-input)}.adu\\:border-border-muted{border-color:var(--border-muted)}.adu\\:bg-\\[\\#232220\\]{background-color:#232220}.adu\\:bg-blue-500{background-color:var(--adu-color-blue-500)}.adu\\:bg-border-input{background-color:var(--border-input)}.adu\\:bg-button-primary{background-color:var(--button-primary)}.adu\\:bg-card{background-color:var(--card)}.adu\\:bg-destructive{background-color:var(--destructive)}.adu\\:bg-input{background-color:var(--input)}.adu\\:bg-page{background-color:var(--page)}.adu\\:bg-popover{background-color:var(--popover)}.adu\\:bg-surface-muted{background-color:var(--surface-muted)}.adu\\:bg-surface-selected{background-color:var(--surface-selected)}.adu\\:fill-current{fill:currentColor}.adu\\:p-0{padding:calc(var(--adu-spacing)*0)}.adu\\:p-1{padding:calc(var(--adu-spacing)*1)}.adu\\:p-2\\.5{padding:calc(var(--adu-spacing)*2.5)}.adu\\:p-4{padding:calc(var(--adu-spacing)*4)}.adu\\:px-1{padding-inline:calc(var(--adu-spacing)*1)}.adu\\:px-2{padding-inline:calc(var(--adu-spacing)*2)}.adu\\:px-3{padding-inline:calc(var(--adu-spacing)*3)}.adu\\:px-4{padding-inline:calc(var(--adu-spacing)*4)}.adu\\:px-6{padding-inline:calc(var(--adu-spacing)*6)}.adu\\:py-1\\.5{padding-block:calc(var(--adu-spacing)*1.5)}.adu\\:py-2{padding-block:calc(var(--adu-spacing)*2)}.adu\\:py-3{padding-block:calc(var(--adu-spacing)*3)}.adu\\:py-6{padding-block:calc(var(--adu-spacing)*6)}.adu\\:pt-3{padding-top:calc(var(--adu-spacing)*3)}.adu\\:pr-2{padding-right:calc(var(--adu-spacing)*2)}.adu\\:pl-8{padding-left:calc(var(--adu-spacing)*8)}.adu\\:text-center{text-align:center}.adu\\:font-aeonik{font-family:Aeonik,sans-serif}.adu\\:font-inter{font-family:Inter,Inter Fallback,system-ui,-apple-system,sans-serif}.adu\\:font-roboto-mono{font-family:Roboto Mono,sans-serif}.adu\\:text-2xl{font-size:2rem;line-height:var(--tw-leading,var(--adu-text-2xl--line-height))}.adu\\:text-3xl{font-size:2.5rem;line-height:var(--tw-leading,var(--adu-text-3xl--line-height))}.adu\\:text-base{font-size:1rem;line-height:var(--tw-leading,var(--adu-text-base--line-height))}.adu\\:text-lg{font-size:1.25rem;line-height:var(--tw-leading,var(--adu-text-lg--line-height))}.adu\\:text-sm{font-size:.875rem;line-height:var(--tw-leading,var(--adu-text-sm--line-height))}.adu\\:text-sm\\!{font-size:.875rem!important;line-height:var(--tw-leading,var(--adu-text-sm--line-height))!important}.adu\\:text-xl{font-size:1.5rem;line-height:var(--tw-leading,var(--adu-text-xl--line-height))}.adu\\:text-xs{font-size:.75rem;line-height:var(--tw-leading,var(--adu-text-xs--line-height))}.adu\\:leading-1\\.5{--tw-leading:calc(var(--adu-spacing)*1.5);line-height:calc(var(--adu-spacing)*1.5)}.adu\\:leading-1\\.15{--tw-leading:1.15;line-height:1.15}.adu\\:leading-1\\.20{--tw-leading:1.2;line-height:1.2}.adu\\:leading-1\\.25{--tw-leading:1.25;line-height:1.25}.adu\\:leading-1\\.30{--tw-leading:1.3;line-height:1.3}.adu\\:leading-1\\.33{--tw-leading:1.33;line-height:1.33}.adu\\:leading-1\\.40{--tw-leading:1.4;line-height:1.4}.adu\\:leading-1\\.45{--tw-leading:1.45;line-height:1.45}.adu\\:leading-1\\.65{--tw-leading:1.65;line-height:1.65}.adu\\:leading-none{--tw-leading:1;line-height:1}.adu\\:font-medium{--tw-font-weight:500;font-weight:500}.adu\\:font-normal{--tw-font-weight:400;font-weight:400}.adu\\:font-semibold{--tw-font-weight:600;font-weight:600}.adu\\:tracking-n-2xl{--tw-tracking:-.02em;letter-spacing:-.02em}.adu\\:tracking-n-3xl{--tw-tracking:-.02125em;letter-spacing:-.02125em}.adu\\:tracking-n-5xl{--tw-tracking:-.044em;letter-spacing:-.044em}.adu\\:tracking-n-6xl{--tw-tracking:-.05em;letter-spacing:-.05em}.adu\\:tracking-n-lg{--tw-tracking:-.011em;letter-spacing:-.011em}.adu\\:tracking-n-md{--tw-tracking:-.00625em;letter-spacing:-.00625em}.adu\\:tracking-n-sm{--tw-tracking:-.006em;letter-spacing:-.006em}.adu\\:tracking-n-xl{--tw-tracking:-.01125em;letter-spacing:-.01125em}.adu\\:tracking-n-xs{--tw-tracking:-.00525em;letter-spacing:-.00525em}.adu\\:tracking-p-2xl{--tw-tracking:.0375em;letter-spacing:.0375em}.adu\\:tracking-p-lg{--tw-tracking:.011em;letter-spacing:.011em}.adu\\:tracking-p-md{--tw-tracking:.01em;letter-spacing:.01em}.adu\\:tracking-p-sm{--tw-tracking:.005em;letter-spacing:.005em}.adu\\:tracking-p-xs{--tw-tracking:.0025em;letter-spacing:.0025em}.adu\\:tracking-widest{--tw-tracking:var(--adu-tracking-widest);letter-spacing:var(--adu-tracking-widest)}.adu\\:whitespace-nowrap{white-space:nowrap}.adu\\:text-\\[\\#f4f4f4\\]{color:#f4f4f4}.adu\\:text-\\[\\#f4f4f4\\]\\!{color:#f4f4f4!important}.adu\\:text-foreground{color:var(--foreground)}.adu\\:text-foreground-bold{color:var(--foreground-bold)}.adu\\:text-foreground-icon{color:var(--foreground-icon)}.adu\\:text-foreground-inverse{color:var(--foreground-inverse)}.adu\\:text-foreground-inverse\\!{color:var(--foreground-inverse)!important}.adu\\:text-white{color:var(--adu-color-white)}.adu\\:uppercase{text-transform:uppercase}.adu\\:underline{text-decoration-line:underline}.adu\\:underline-offset-4{text-underline-offset:4px}.adu\\:underline-offset-auto{text-underline-offset:auto}.adu\\:shadow-lg{--tw-shadow:0px 12px 12px -6px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-3))),0px 6px 6px -1.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-2))),0px 4px 4px 0px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)))}.adu\\:shadow-lg,.adu\\:shadow-md,.adu\\:shadow-sm{box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:shadow-md{--tw-shadow:0px 6px 6px -3px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-2))),0px 4px 4px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)))}.adu\\:shadow-sm{--tw-shadow:0px 4px 4px -2px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)))}.adu\\:outline-hidden{--tw-outline-style:none;outline-style:none}@media (forced-colors:active){.adu\\:outline-hidden{outline-offset:2px;outline:2px solid #0000}}.adu\\:transition-\\[height\\],.adu\\:transition-all{transition-property:height;transition-timing-function:var(--tw-ease,var(--adu-default-transition-timing-function));transition-duration:var(--tw-duration,var(--adu-default-transition-duration))}.adu\\:transition-all{transition-property:all}.adu\\:ease-in-out{--tw-ease:var(--adu-ease-in-out);transition-timing-function:var(--adu-ease-in-out)}.adu\\:fill-mode-both{--tw-animation-fill-mode:both;animation-fill-mode:both}.adu\\:outline-none{--tw-outline-style:none;outline-style:none}.adu\\:select-none{-webkit-user-select:none;user-select:none}.adu\\:fade-in{--tw-enter-opacity:0}.adu\\:fade-out{--tw-exit-opacity:0}.adu\\:slide-in-from-left{--tw-enter-translate-x:-100%}.adu\\:slide-in-from-right{--tw-enter-translate-x:100%}.adu\\:slide-out-to-left{--tw-exit-translate-x:-100%}.adu\\:slide-out-to-right{--tw-exit-translate-x:100%}@media (hover:hover){.adu\\:hover\\:bg-button-primary\\/90:hover{background-color:var(--button-primary)}@supports (color:color-mix(in lab,red,red)){.adu\\:hover\\:bg-button-primary\\/90:hover{background-color:color-mix(in oklab,var(--button-primary)90%,transparent)}}.adu\\:hover\\:bg-destructive\\/90:hover{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:hover\\:bg-destructive\\/90:hover{background-color:color-mix(in oklab,var(--destructive)90%,transparent)}}.adu\\:hover\\:underline:hover{text-decoration-line:underline}}.adu\\:focus-visible\\:ring-\\[3px\\]:focus-visible{--tw-ring-shadow:var(--tw-ring-inset,)0 0 0 calc(3px + var(--tw-ring-offset-width))var(--tw-ring-color,currentcolor);box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:focus-visible\\:ring-destructive\\/20:focus-visible{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:focus-visible\\:ring-destructive\\/20:focus-visible{--tw-ring-color:color-mix(in oklab,var(--destructive)20%,transparent)}}.adu\\:focus-visible\\:outline-hidden:focus-visible{--tw-outline-style:none;outline-style:none}@media (forced-colors:active){.adu\\:focus-visible\\:outline-hidden:focus-visible{outline-offset:2px;outline:2px solid #0000}}.adu\\:disabled\\:pointer-events-none:disabled{pointer-events:none}.adu\\:disabled\\:opacity-50:disabled{opacity:.5}.adu\\:has-data-\\[slot\\=card-action\\]\\:grid-cols-\\[1fr_auto\\]:has([data-slot=card-action]){grid-template-columns:1fr auto}.adu\\:has-\\[\\>svg\\]\\:px-2\\.5:has(>svg){padding-inline:calc(var(--adu-spacing)*2.5)}.adu\\:has-\\[\\>svg\\]\\:px-3:has(>svg){padding-inline:calc(var(--adu-spacing)*3)}.adu\\:has-\\[\\>svg\\]\\:px-4:has(>svg){padding-inline:calc(var(--adu-spacing)*4)}.adu\\:aria-invalid\\:border-destructive[aria-invalid=true]{border-color:var(--destructive)}.adu\\:aria-invalid\\:ring-destructive\\/20[aria-invalid=true]{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:aria-invalid\\:ring-destructive\\/20[aria-invalid=true]{--tw-ring-color:color-mix(in oklab,var(--destructive)20%,transparent)}}.adu\\:\\[\\\u0026_svg\\]\\:pointer-events-none svg,.adu\\:data-\\[disabled\\]\\:pointer-events-none[data-disabled]{pointer-events:none}.adu\\:data-\\[disabled\\]\\:opacity-50[data-disabled]{opacity:.5}.adu\\:data-\\[inset\\]\\:pl-8[data-inset]{padding-left:calc(var(--adu-spacing)*8)}.adu\\:data-\\[side\\=bottom\\]\\:slide-in-from-top-2[data-side=bottom]{--tw-enter-translate-y:calc(var(--adu-spacing)*2*-1)}.adu\\:data-\\[side\\=left\\]\\:slide-in-from-right-2[data-side=left]{--tw-enter-translate-x:calc(var(--adu-spacing)*2)}.adu\\:data-\\[side\\=right\\]\\:slide-in-from-left-2[data-side=right]{--tw-enter-translate-x:calc(var(--adu-spacing)*2*-1)}.adu\\:data-\\[side\\=top\\]\\:slide-in-from-bottom-2[data-side=top]{--tw-enter-translate-y:calc(var(--adu-spacing)*2)}.adu\\:data-\\[state\\=closed\\]\\:animate-out[data-state=closed]{animation:exit var(--tw-animation-duration,var(--tw-duration,.15s))var(--tw-ease,ease)var(--tw-animation-delay,0s)var(--tw-animation-iteration-count,1)var(--tw-animation-direction,normal)var(--tw-animation-fill-mode,none)}.adu\\:data-\\[state\\=closed\\]\\:fade-out-0[data-state=closed]{--tw-exit-opacity:0}.adu\\:data-\\[state\\=closed\\]\\:zoom-out-95[data-state=closed]{--tw-exit-scale:.95}.adu\\:data-\\[state\\=open\\]\\:animate-in[data-state=open]{animation:enter var(--tw-animation-duration,var(--tw-duration,.15s))var(--tw-ease,ease)var(--tw-animation-delay,0s)var(--tw-animation-iteration-count,1)var(--tw-animation-direction,normal)var(--tw-animation-fill-mode,none)}.adu\\:data-\\[state\\=open\\]\\:fade-in-0[data-state=open]{--tw-enter-opacity:0}.adu\\:data-\\[state\\=open\\]\\:zoom-in-95[data-state=open]{--tw-enter-scale:.95}.adu\\:data-\\[variant\\=destructive\\]\\:text-destructive[data-variant=destructive]{color:var(--destructive)}.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/10[data-variant=destructive]:focus{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/10[data-variant=destructive]:focus{background-color:color-mix(in oklab,var(--destructive)10%,transparent)}}.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:text-destructive[data-variant=destructive]:focus{color:var(--destructive)}@media (min-width:64rem){.adu\\:lg\\:block{display:block}.adu\\:lg\\:w-auto{width:auto}}.adu\\:dark\\:bg-destructive\\/60:is(.dark *){background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:bg-destructive\\/60:is(.dark *){background-color:color-mix(in oklab,var(--destructive)60%,transparent)}}.adu\\:dark\\:bg-input\\/30:is(.dark *){background-color:var(--input)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:bg-input\\/30:is(.dark *){background-color:color-mix(in oklab,var(--input)30%,transparent)}}.adu\\:dark\\:shadow-xs:is(.dark *){--tw-shadow:0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)));box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}@media (hover:hover){.adu\\:dark\\:hover\\:bg-input\\/50:is(.dark *):hover{background-color:var(--input)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:hover\\:bg-input\\/50:is(.dark *):hover{background-color:color-mix(in oklab,var(--input)50%,transparent)}}}.adu\\:dark\\:focus-visible\\:ring-destructive\\/40:is(.dark *):focus-visible{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:focus-visible\\:ring-destructive\\/40:is(.dark *):focus-visible{--tw-ring-color:color-mix(in oklab,var(--destructive)40%,transparent)}}.adu\\:dark\\:aria-invalid\\:ring-destructive\\/40:is(.dark *)[aria-invalid=true]{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:aria-invalid\\:ring-destructive\\/40:is(.dark *)[aria-invalid=true]{--tw-ring-color:color-mix(in oklab,var(--destructive)40%,transparent)}}.adu\\:dark\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/20:is(.dark *)[data-variant=destructive]:focus{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/20:is(.dark *)[data-variant=destructive]:focus{background-color:color-mix(in oklab,var(--destructive)20%,transparent)}}.adu\\:\\[\\\u0026_svg\\]\\:shrink-0 svg{flex-shrink:0}.adu\\:\\[\\\u0026_svg\\:not\\(\\[class\\*\\=\\'size-\\'\\]\\)\\]\\:size-4 svg:not([class*=size-]){width:calc(var(--adu-spacing)*4);height:calc(var(--adu-spacing)*4)}.adu\\:\\[\\.border-b\\]\\:pb-6.border-b{padding-bottom:calc(var(--adu-spacing)*6)}.adu\\:\\[\\.border-t\\]\\:pt-6.border-t{padding-top:calc(var(--adu-spacing)*6)}:is(.adu\\:data-\\[variant\\=destructive\\]\\:\\*\\:\\[svg\\]\\:\\!text-destructive[data-variant=destructive]>*):is(svg){color:var(--destructive)!important}}@property --tw-animation-delay{syntax:\"*\";inherits:false;initial-value:0s}@property --tw-animation-direction{syntax:\"*\";inherits:false;initial-value:normal}@property --tw-animation-duration{syntax:\"*\";inherits:false}@property --tw-animation-fill-mode{syntax:\"*\";inherits:false;initial-value:none}@property --tw-animation-iteration-count{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-blur{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-opacity{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-rotate{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-scale{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-translate-x{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-translate-y{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-blur{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-opacity{syntax:\"*\";inherits:false;initial-value:1}@property --tw-exit-rotate{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-scale{syntax:\"*\";inherits:false;initial-value:1}@property --tw-exit-translate-x{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-translate-y{syntax:\"*\";inherits:false;initial-value:0}@font-face{font-family:Inter Fallback;src:local(Arial);size-adjust:107%;ascent-override:90%;descent-override:22%;line-gap-override:0%}:root{--page:#fff;--card:#fff;--input:#fff;--destructive:#f3e2de;--popover:#fff;--layer:#fffc;--success:#abdfb9;--info:#b2c5fb;--caution:#ffe573;--warning:#ffbf9f;--button-subtle:#00000008;--surface-muted:#c2c2c2;--surface-selected:#efefef;--button-primary:#191919;--foreground:#767676;--foreground-inverse:#f4f4f4;--foreground-bold:#232220;--foreground-card:#232220;--foreground-destructive:#ba351d;--foreground-popover:#232220;--foreground-selected:#6742d5;--foreground-success:#008140;--foreground-info:#344ac5;--foreground-caution:#907600;--foreground-warning:#c45915;--foreground-icon:#1f1f1f;--border-boldest:#1f1f1f;--border-input:#e6e6e6;--border:#afadaa;--border-muted:#cecdca;--border-success:#008140;--border-info:#344ac5;--border-caution:#907600;--border-warning:#c45915;--code-layer:#f4f4f4;--code-content:#fffc;--code-string-key:#595959;--code-string-value:#149750;--code-boolean:#e27133;--code-delimiter:#afafaf;--code-number:#374ec9;--code-object:#6742d5;--color-shadow:0,0%,0%;--color-shadow-destructive:5,85%,37%;--transparency-level-1:.04;--transparency-level-2:.06;--transparency-level-3:.08;--transparency-level-4:.1;--transparency-level-5:.12;--transparency-level-6:.16;--transparency-level-7:.2;--transparency-level-8:.24;--transparency-level-9:.4}.dark{--page:#191919;--card:#21201f;--input:#0000000d;--destructive:#43140b;--popover:#21201f;--layer:#29272580;--success:#225835;--info:#2f428b;--caution:#433600;--warning:#63361f;--button-subtle:#ffffffe6;--surface-muted:#4a4a4a;--surface-selected:#282828;--button-primary:#fff;--foreground:#7b7b7b;--foreground-inverse:#191919;--foreground-bold:#efede9;--foreground-card:#efede9;--foreground-destructive:#ff9179;--foreground-popover:#efede9;--foreground-selected:#b3a7ff;--foreground-success:#61d287;--foreground-info:#94b2ff;--foreground-caution:#f8d523;--foreground-warning:#ff9f6e;--foreground-icon:#eee;--border-boldest:#eee;--border-input:#282828;--border:#63615e;--border-muted:#3f3d3a;--border-success:#61d287;--border-info:#94b2ff;--border-caution:#f8d523;--border-warning:#ff9f6e;--code-layer:#21201f;--code-content:#1a1918;--code-string-key:#b4b4b4;--code-string-value:#61d287;--code-boolean:#ff9f6e;--code-delimiter:#7b7b7b;--code-number:#94b2ff;--code-object:#b3a7ff;--color-shadow:0,0%,100%;--color-shadow-destructive:5,85%,37%;--transparency-level-1:.04;--transparency-level-2:.06;--transparency-level-3:.08;--transparency-level-4:.1;--transparency-level-5:.12;--transparency-level-6:.16;--transparency-level-7:.2;--transparency-level-8:.24;--transparency-level-9:.4}.adu-dropdown-menu-content,.adu-dropdown-menu-content:after,.adu-dropdown-menu-content:before{border-width:1px;border-color:var(--border-input)}@property --tw-border-style{syntax:\"*\";inherits:false;initial-value:solid}@property --tw-leading{syntax:\"*\";inherits:false}@property --tw-font-weight{syntax:\"*\";inherits:false}@property --tw-tracking{syntax:\"*\";inherits:false}@property --tw-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-shadow-color{syntax:\"*\";inherits:false}@property --tw-shadow-alpha{syntax:\"\u003cpercentage>\";inherits:false;initial-value:100%}@property --tw-inset-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-inset-shadow-color{syntax:\"*\";inherits:false}@property --tw-inset-shadow-alpha{syntax:\"\u003cpercentage>\";inherits:false;initial-value:100%}@property --tw-ring-color{syntax:\"*\";inherits:false}@property --tw-ring-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-inset-ring-color{syntax:\"*\";inherits:false}@property --tw-inset-ring-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-ring-inset{syntax:\"*\";inherits:false}@property --tw-ring-offset-width{syntax:\"\u003clength>\";inherits:false;initial-value:0}@property --tw-ring-offset-color{syntax:\"*\";inherits:false;initial-value:#fff}@property --tw-ring-offset-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-ease{syntax:\"*\";inherits:false}"},{"filePath":"ui/universal-components/universal-components-1.0.22.css","href":"/_mintlify/custom/docs-staging/8ce0b80bca908d91/ui/universal-components/universal-components-1.0.22.css"}],"page":{"pagePath":"docs/api/management/v2/events/subscribe-events","slug":"/docs/api/management/v2/events/subscribe-events","pageMetadata":{"openapi":"docs/oas/management/v2/management-api-oas.json GET /events","playground":"interactive","deprecated":false,"title":"Subscribe to events via Server-Sent Events (SSE)","description":"Subscribe to events via Server-Sent Events (SSE)","href":"/docs/api/management/v2/events/subscribe-events"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Subscribe to events via Server-Sent Events (SSE)\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];const Scopes=({scopes=[]})=>{return _jsxs(`div`,{children:[_jsx(`div`,{class:`api-section-heading mint-flex mint-flex-col mint-gap-y-4 mint-w-full`,children:_jsxs(`div`,{class:`mint-flex mint-items-baseline mint-border-b mint-pb-2.5 mint-border-gray-100 dark:mint-border-gray-800 mint-w-full`,children:[_jsx(`h4`,{class:`api-section-heading-title mint-flex-1 mint-mb-0`,children:`Scopes`}),_jsx(`div`,{class:`mint-flex mint-items-center`})]})}),_jsx(`div`,{class:`mint-mt-4`,children:_jsx(`div`,{class:`mint-space-y-4 mint-whitespace-normal prose prose-sm prose-gray dark:prose-invert overflow-wrap-anywhere [\u0026_*]:overflow-wrap-anywhere`,children:_jsx(`p`,{class:`mint-whitespace-pre-line mint-text-xs`,children:`Scopes define permissions and access levels for API requests and authentication tokens.`})})}),_jsx(`div`,{class:`mint-flex mint-font-mono mint-text-sm mint-group/param-head param-head mint-break-all mint-relative mint-mt-6`,id:`scopes-scopes`,children:_jsx(`div`,{class:`mint-flex-1 mint-flex mint-flex-col mint-content-start mint-py-0.5 mint-mr-5`,children:_jsxs(`div`,{class:`mint-flex mint-items-center mint-flex-wrap mint-gap-2`,children:[_jsx(`div`,{class:`mint-absolute mint--top-1.5`,children:_jsxs(`a`,{href:`#scopes-scopes`,class:`mint--ml-10 mint-flex mint-items-center mint-opacity-0 mint-border-0 group-hover/param-head:mint-opacity-100 focus:mint-opacity-100 focus:mint-outline-0 mint-py-2 [.expandable-content_\u0026]:mint--ml-[2.1rem] mint-group/link`,\"aria-label\":`Navigate to header`,children:[`​`,_jsx(`div`,{class:`mint-w-6 mint-h-6 mint-rounded-md mint-flex mint-items-center mint-justify-center mint-shadow-sm mint-text-gray-400 dark:mint-text-white/50 dark:bg-background-dark dark:mint-brightness-[1.35] dark:mint-ring-1 dark:hover:mint-brightness-150 mint-bg-white mint-ring-1 mint-ring-gray-400/30 dark:mint-ring-gray-700/25 hover:mint-ring-gray-400/60 dark:hover:mint-ring-white/20 group-focus/link:mint-border-2 group-focus/link:border-primary dark:group-focus/link:border-primary-light`,children:_jsx(`svg`,{xmlns:`http://www.w3.org/2000/svg`,fill:`gray`,height:`12px`,viewBox:`0 0 576 512`,children:_jsx(`path`,{d:`M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z`})})})]})}),scopes.map((scope,index)=>{return _jsx(`span`,{class:`mint-flex mint-items-center mint-px-2 mint-py-0.5 mint-rounded-md mint-bg-gray-100/50 dark:mint-bg-white/5 mint-text-gray-600 dark:mint-text-gray-200 mint-font-medium mint-break-all`,style:{lineHeight:`1rem`,fontSize:`0.75rem`,fontFamily:`var(--font-jetbrains-mono), ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace`},\"data-component-part\":`field-info-pill`,children:scope},index)})]})})})]})};const ApiReleaseLifecycle=({releaseLifecycle=`GA`})=>{const lifecycleMap={ea:`Early Access`,ga:`Generally Available`,deprecated:`Deprecated`,planned:`Planned`,beta:`Beta`};const LIFECYCLE_THEMES={info:{light:{bg:`lab(91.896% .077188 -6.94053)`,text:`lab(36.091% 25.9241 -68.0384)`},dark:{bg:`lab(16.0426% 6.71726 -27.2409)`,text:`lab(72.6029% 4.08953 -41.9669)`}},secondary:{light:{bg:`lab(90.8548% 11.3355 8.01476)`,text:`lab(47.5286% 56.4238 43.4706)`},dark:{bg:`lab(16.3609% 37.191 25.6346)`,text:`lab(71.881% 41.5 29.4839)`}},danger:{light:{bg:`lab(94.7916% -.0000298023 0)`,text:`lab(54.3656% 0 -.0000119209)`},dark:{bg:`lab(13.232% 0 0)`,text:`lab(51.6164% 0 0)`}}};const LIFECYCLE_THEME_MAP={ea:`info`,ga:`info`,beta:`info`,deprecated:`secondary`,planned:`danger`};const lifecycle=releaseLifecycle.toLocaleLowerCase();const lifecycleText=lifecycleMap[lifecycle];if(!lifecycleText){return null}const theme=LIFECYCLE_THEMES[LIFECYCLE_THEME_MAP[lifecycle]];return _jsxs(`div`,{children:[_jsx(`div`,{className:`api-section-heading mint-flex mint-flex-col mint-gap-y-4 mint-w-full`,children:_jsx(`div`,{className:`mint-flex mint-items-baseline mint-border-b mint-pb-2.5 mint-border-gray-100 dark:mint-border-gray-800 mint-w-full`,children:_jsx(`h4`,{className:`api-section-heading-title mint-flex-1 mint-mb-0`,children:`Release Lifecycle`})})}),_jsx(`div`,{className:`mint-flex mint-font-mono mint-text-sm mint-group/param-head param-head mint-break-all mint-relative mint-mt-2.5`,id:`releaselifecycle-lifecycle`,children:_jsx(`div`,{className:`mint-flex-1 mint-flex mint-flex-col mint-content-start mint-py-0.5 mint-mr-5`,children:_jsxs(`div`,{className:`mint-flex mint-items-center mint-flex-wrap mint-gap-2`,children:[_jsx(`div`,{className:`mint-absolute mint--top-1.5`,children:_jsx(`a`,{href:`#releaselifecycle-lifecycle`,className:`mint--ml-10 mint-flex mint-items-center mint-opacity-0 mint-border-0 group-hover/param-head:mint-opacity-100 focus:mint-opacity-100 focus:mint-outline-0 mint-py-2 [.expandable-content_\u0026]:mint--ml-[2.1rem] mint-group/link`,\"aria-label\":`Navigate to header`,children:_jsx(`div`,{className:`mint-w-6 mint-h-6 mint-rounded-md mint-flex mint-items-center mint-justify-center mint-shadow-sm mint-text-gray-400 dark:mint-text-white/50 dark:bg-background-dark dark:mint-brightness-[1.35] dark:mint-ring-1 dark:hover:mint-brightness-150 mint-bg-white mint-ring-1 mint-ring-gray-400/30 dark:mint-ring-gray-700/25 hover:mint-ring-gray-400/60 dark:hover:mint-ring-white/20 group-focus/link:mint-border-2 group-focus/link:border-primary dark:group-focus/link:border-primary-light`,children:_jsx(`svg`,{xmlns:`http://www.w3.org/2000/svg`,fill:`gray`,height:`12px`,viewBox:`0 0 576 512`,children:_jsx(`path`,{d:`M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z`})})})})}),_jsx(`span`,{className:`mint-inline-flex mint-items-center mint-w-fit mint-font-medium mint-gap-1 mint-py-0.5 mint-px-2 mint-rounded-md`,style:{lineHeight:`1rem`,fontSize:`0.75rem`,fontFamily:`var(--font-jetbrains-mono), ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace`,backgroundColor:`light-dark(${theme.light.bg}, ${theme.dark.bg})`,color:`light-dark(${theme.light.text}, ${theme.dark.text})`,borderColor:`light-dark(color-mix(in oklab, ${theme.light.text} 25%, transparent), color-mix(in oklab, ${theme.dark.text} 25%, transparent))`},children:lifecycleText})]})})})]})};function _createMdxContent(props){const{_MdxComponentBoundary}={..._provideComponents(),...props.components};if(!_MdxComponentBoundary)_missingMdxReference(`_MdxComponentBoundary`,true);return _jsxs(_Fragment,{children:[_jsx(_MdxComponentBoundary,{name:`ApiReleaseLifecycle`,children:_jsx(ApiReleaseLifecycle,{releaseLifecycle:`GA`})}),`\n`,_jsx(_MdxComponentBoundary,{name:`Scopes`,children:_jsx(Scopes,{scopes:[`read:events`]})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{Scopes,ApiReleaseLifecycle,default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"openapi":"docs/oas/management/v2/management-api-oas.json GET /events","playground":"interactive","deprecated":false,"title":"Subscribe to events via Server-Sent Events (SSE)","description":"Subscribe to events via Server-Sent Events (SSE)","href":"/docs/api/management/v2/events/subscribe-events"}}},"mdxSourceWithNoJs":null,"noJsSplices":[[142,7089,")=>null;const ApiReleaseLifecycle=()=>null;function _createM"]]},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/docs-staging/68ac07e0f912aad4/docs/scripts/navbar-controller.js","/_mintlify/custom/docs-staging/98c52e2a822716a4/docs/scripts/overscroll-disable.js","/_mintlify/custom/docs-staging/354202415d9984b3/ui/auth0-docs-ui-1.10.0.umd.js","/_mintlify/custom/docs-staging/9464ddebf19c31a9/ui/universal-components/universal-components-1.0.22.umd.js"],"dynamicCss":".mint-absolute {\n position: absolute\n}\n.mint-relative {\n position: relative\n}\n.mint--top-1\\.5 {\n top: -0.375rem\n}\n.mint--ml-10 {\n margin-left: -2.5rem\n}\n.mint-mb-0 {\n margin-bottom: 0px\n}\n.mint-mr-5 {\n margin-right: 1.25rem\n}\n.mint-mt-2\\.5 {\n margin-top: 0.625rem\n}\n.mint-mt-4 {\n margin-top: 1rem\n}\n.mint-mt-6 {\n margin-top: 1.5rem\n}\n.mint-flex {\n display: flex\n}\n.mint-inline-flex {\n display: inline-flex\n}\n.mint-h-6 {\n height: 1.5rem\n}\n.mint-w-6 {\n width: 1.5rem\n}\n.mint-w-fit {\n width: fit-content\n}\n.mint-w-full {\n width: 100%\n}\n.mint-flex-1 {\n flex: 1 1 0%\n}\n.mint-flex-col {\n flex-direction: column\n}\n.mint-flex-wrap {\n flex-wrap: wrap\n}\n.mint-content-start {\n align-content: flex-start\n}\n.mint-items-center {\n align-items: center\n}\n.mint-items-baseline {\n align-items: baseline\n}\n.mint-justify-center {\n justify-content: center\n}\n.mint-gap-1 {\n gap: 0.25rem\n}\n.mint-gap-2 {\n gap: 0.5rem\n}\n.mint-gap-y-4 {\n row-gap: 1rem\n}\n.mint-space-y-4 > :not([hidden]) ~ :not([hidden]) {\n --tw-space-y-reverse: 0;\n margin-top: calc(1rem * calc(1 - var(--tw-space-y-reverse)));\n margin-bottom: calc(1rem * var(--tw-space-y-reverse))\n}\n.mint-whitespace-normal {\n white-space: normal\n}\n.mint-whitespace-pre-line {\n white-space: pre-line\n}\n.mint-break-all {\n word-break: break-all\n}\n.mint-rounded-md {\n border-radius: 0.375rem\n}\n.mint-border-0 {\n border-width: 0px\n}\n.mint-border-b {\n border-bottom-width: 1px\n}\n.mint-border-gray-100 {\n --tw-border-opacity: 1;\n border-color: rgb(243 244 246 / var(--tw-border-opacity, 1))\n}\n.mint-bg-gray-100\\/50 {\n background-color: rgb(243 244 246 / 0.5)\n}\n.mint-bg-white {\n --tw-bg-opacity: 1;\n background-color: rgb(255 255 255 / var(--tw-bg-opacity, 1))\n}\n.mint-px-2 {\n padding-left: 0.5rem;\n padding-right: 0.5rem\n}\n.mint-py-0\\.5 {\n padding-top: 0.125rem;\n padding-bottom: 0.125rem\n}\n.mint-py-2 {\n padding-top: 0.5rem;\n padding-bottom: 0.5rem\n}\n.mint-pb-2\\.5 {\n padding-bottom: 0.625rem\n}\n.mint-font-mono {\n font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace\n}\n.mint-text-sm {\n font-size: 0.875rem;\n line-height: 1.25rem\n}\n.mint-text-xs {\n font-size: 0.75rem;\n line-height: 1rem\n}\n.mint-font-medium {\n font-weight: 500\n}\n.mint-text-gray-400 {\n --tw-text-opacity: 1;\n color: rgb(156 163 175 / var(--tw-text-opacity, 1))\n}\n.mint-text-gray-600 {\n --tw-text-opacity: 1;\n color: rgb(75 85 99 / var(--tw-text-opacity, 1))\n}\n.mint-opacity-0 {\n opacity: 0\n}\n.mint-shadow-sm {\n --tw-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.05);\n --tw-shadow-colored: 0 1px 2px 0 var(--tw-shadow-color);\n box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow)\n}\n.mint-ring-1 {\n --tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);\n --tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);\n box-shadow: var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow, 0 0 #0000)\n}\n.mint-ring-gray-400\\/30 {\n --tw-ring-color: rgb(156 163 175 / 0.3)\n}\n.hover\\:mint-ring-gray-400\\/60:hover {\n --tw-ring-color: rgb(156 163 175 / 0.6)\n}\n.focus\\:mint-opacity-100:focus {\n opacity: 1\n}\n.focus\\:mint-outline-0:focus {\n outline-width: 0px\n}\n.mint-group\\/param-head:hover .group-hover\\/param-head\\:mint-opacity-100 {\n opacity: 1\n}\n.mint-group\\/link:focus .group-focus\\/link\\:mint-border-2 {\n border-width: 2px\n}\n.dark\\:mint-border-gray-800:is(.dark *) {\n --tw-border-opacity: 1;\n border-color: rgb(31 41 55 / var(--tw-border-opacity, 1))\n}\n.dark\\:mint-bg-white\\/5:is(.dark *) {\n background-color: rgb(255 255 255 / 0.05)\n}\n.dark\\:mint-text-gray-200:is(.dark *) {\n --tw-text-opacity: 1;\n color: rgb(229 231 235 / var(--tw-text-opacity, 1))\n}\n.dark\\:mint-text-white\\/50:is(.dark *) {\n color: rgb(255 255 255 / 0.5)\n}\n.dark\\:mint-ring-1:is(.dark *) {\n --tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);\n --tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);\n box-shadow: var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow, 0 0 #0000)\n}\n.dark\\:mint-ring-gray-700\\/25:is(.dark *) {\n --tw-ring-color: rgb(55 65 81 / 0.25)\n}\n.dark\\:mint-brightness-\\[1\\.35\\]:is(.dark *) {\n --tw-brightness: brightness(1.35);\n filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)\n}\n.dark\\:hover\\:mint-ring-white\\/20:hover:is(.dark *) {\n --tw-ring-color: rgb(255 255 255 / 0.2)\n}\n.dark\\:hover\\:mint-brightness-150:hover:is(.dark *) {\n --tw-brightness: brightness(1.5);\n filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)\n}\n.expandable-content .\\[\\.expandable-content_\\\u0026\\]\\:mint--ml-\\[2\\.1rem\\] {\n margin-left: -2.1rem\n}","openApiReferenceData":{"operation":{"summary":"Subscribe to events via Server-Sent Events (SSE)","description":"Subscribe to events via Server-Sent Events (SSE)","tags":["events"],"parameters":["3cd77d6c-8321-4e17-b029-fb24a5fa537b","9f35bb0e-af6d-472c-a81e-3355299df93f","9a45e500-a704-457a-8e27-9e758c5fd320"],"responses":{"200":"2a9941df-dfc3-4f4c-932a-f6e18bc9c60d","400":"834dee43-b3c0-42b0-b7d8-6e16cb44e467","401":"c15751c7-6087-418a-86d2-240791d3da4a","403":"ae2fe183-f275-413f-8036-decd38cd8a7b","404":"c492146d-591c-4954-a7fa-41ec8c954c53","410":"5f23643c-e040-4623-be9f-919367e3459e","429":"7647a12a-9fd9-4abd-bb59-94cb74a5fb02"},"operationId":"subscribe_events","x-release-lifecycle":"GA","x-operation-name":"subscribe","x-operation-request-parameters-name":"SubscribeEventsRequestParameters","x-operation-group":"events","security":["2626536f-7648-4d1f-9fa5-3cb499b09ba5","834b514d-f499-45dd-beef-599663c97f8b"],"x-codeSamples":[{"lang":"csharp","label":"Subscribe to events via Server-Sent Events (SSE)","source":"using Auth0.ManagementApi;\nusing System.Threading.Tasks;\nusing System.Collections.Generic;\n\npublic partial class Examples\n{\n public async Task Example() {\n var client = new ManagementApiClient(\n token: \"\u003ctoken>\",\n clientOptions: new ClientOptions { BaseUrl = \"https://{YOUR_DOMAIN}/api/v2\" }\n );\n\n await foreach (var item in client.Events.SubscribeAsync(\n new SubscribeEventsRequestParameters {\n From = \"from\",\n FromTimestamp = \"from_timestamp\",\n EventType = new List\u003cEventStreamSubscribeEventsEventTypeEnum>(){\n EventStreamSubscribeEventsEventTypeEnum.ConnectionCreated,\n }\n\n }\n ))\n {\n /* consume each item */\n }\n ;\n }\n\n}\n"},{"lang":"java","label":"Subscribe to events via Server-Sent Events (SSE)","source":"package com.example.usage;\n\nimport com.auth0.client.mgmt.ManagementApi;\nimport com.auth0.client.mgmt.types.EventStreamSubscribeEventsEventTypeEnum;\nimport com.auth0.client.mgmt.types.SubscribeEventsRequestParameters;\nimport java.util.Arrays;\n\npublic class Example {\n public static void main(String[] args) {\n ManagementApi client = ManagementApi\n .builder()\n .domain(\"{YOUR_DOMAIN}\")\n .token(\"\u003ctoken>\")\n .build();\n\n client.events().subscribe(\n SubscribeEventsRequestParameters\n .builder()\n .eventType(\n Arrays.asList(EventStreamSubscribeEventsEventTypeEnum.CONNECTION_CREATED)\n )\n .from(\"from\")\n .fromTimestamp(\"from_timestamp\")\n .build()\n );\n }\n}"},{"lang":"php","label":"Subscribe to events via Server-Sent Events (SSE)","source":"\u003c?php\n\nnamespace Example;\n\nuse Auth0\\SDK\\API\\Management\\Wrapper\\ManagementClient;\nuse Auth0\\SDK\\API\\Management\\Wrapper\\ManagementClientOptions;\nuse Auth0\\SDK\\API\\Management\\Events\\Requests\\SubscribeEventsRequestParameters;\nuse Auth0\\SDK\\API\\Management\\Types\\EventStreamSubscribeEventsEventTypeEnum;\n\n$client = new ManagementClient(new ManagementClientOptions(\n domain: '{YOUR_DOMAIN}',\n token: '\u003ctoken>',\n));\n$client->events->subscribe(\n new SubscribeEventsRequestParameters([\n 'from' => 'from',\n 'fromTimestamp' => 'from_timestamp',\n 'eventType' => [\n EventStreamSubscribeEventsEventTypeEnum::ConnectionCreated->value,\n ],\n ]),\n);\n"},{"lang":"python","label":"Subscribe to events via Server-Sent Events (SSE)","source":"from auth0.management import ManagementClient\n\nclient = ManagementClient(\n domain=\"{YOUR_DOMAIN}\",\n token=\"\u003ctoken>\",\n)\n\nclient.events.subscribe(\n from=\"from\",\n from_timestamp=\"from_timestamp\",\n event_type=[\n \"connection.created\"\n ],\n)\n"},{"lang":"ruby","label":"Subscribe to events via Server-Sent Events (SSE)","source":"require \"auth0\"\n\nclient = Auth0::Management.new(token: \"\u003ctoken>\", base_url: \"https://{YOUR_DOMAIN}/api/v2\")\n\nclient.events.subscribe(\n from: \"from\",\n from_timestamp: \"from_timestamp\",\n event_type: [\"connection.created\"]\n)\n"}],"method":"get","type":"path","servers":["b2b1a7fc-9688-4dde-b7d3-813d0407078c"],"path":"/events","baseUrlOptions":["https://{tenantDomain}/api/v2"],"title":"Subscribe to events via Server-Sent Events (SSE)","codeSamples":[{"label":"Subscribe to events via Server-Sent Events (SSE)","lang":"csharp","source":"using Auth0.ManagementApi;\nusing System.Threading.Tasks;\nusing System.Collections.Generic;\n\npublic partial class Examples\n{\n public async Task Example() {\n var client = new ManagementApiClient(\n token: \"\u003ctoken>\",\n clientOptions: new ClientOptions { BaseUrl = \"https://{YOUR_DOMAIN}/api/v2\" }\n );\n\n await foreach (var item in client.Events.SubscribeAsync(\n new SubscribeEventsRequestParameters {\n From = \"from\",\n FromTimestamp = \"from_timestamp\",\n EventType = new List\u003cEventStreamSubscribeEventsEventTypeEnum>(){\n EventStreamSubscribeEventsEventTypeEnum.ConnectionCreated,\n }\n\n }\n ))\n {\n /* consume each item */\n }\n ;\n }\n\n}\n"},{"label":"Subscribe to events via Server-Sent Events (SSE)","lang":"java","source":"package com.example.usage;\n\nimport com.auth0.client.mgmt.ManagementApi;\nimport com.auth0.client.mgmt.types.EventStreamSubscribeEventsEventTypeEnum;\nimport com.auth0.client.mgmt.types.SubscribeEventsRequestParameters;\nimport java.util.Arrays;\n\npublic class Example {\n public static void main(String[] args) {\n ManagementApi client = ManagementApi\n .builder()\n .domain(\"{YOUR_DOMAIN}\")\n .token(\"\u003ctoken>\")\n .build();\n\n client.events().subscribe(\n SubscribeEventsRequestParameters\n .builder()\n .eventType(\n Arrays.asList(EventStreamSubscribeEventsEventTypeEnum.CONNECTION_CREATED)\n )\n .from(\"from\")\n .fromTimestamp(\"from_timestamp\")\n .build()\n );\n }\n}"},{"label":"Subscribe to events via Server-Sent Events (SSE)","lang":"php","source":"\u003c?php\n\nnamespace Example;\n\nuse Auth0\\SDK\\API\\Management\\Wrapper\\ManagementClient;\nuse Auth0\\SDK\\API\\Management\\Wrapper\\ManagementClientOptions;\nuse Auth0\\SDK\\API\\Management\\Events\\Requests\\SubscribeEventsRequestParameters;\nuse Auth0\\SDK\\API\\Management\\Types\\EventStreamSubscribeEventsEventTypeEnum;\n\n$client = new ManagementClient(new ManagementClientOptions(\n domain: '{YOUR_DOMAIN}',\n token: '\u003ctoken>',\n));\n$client->events->subscribe(\n new SubscribeEventsRequestParameters([\n 'from' => 'from',\n 'fromTimestamp' => 'from_timestamp',\n 'eventType' => [\n EventStreamSubscribeEventsEventTypeEnum::ConnectionCreated->value,\n ],\n ]),\n);\n"},{"label":"Subscribe to events via Server-Sent Events (SSE)","lang":"python","source":"from auth0.management import ManagementClient\n\nclient = ManagementClient(\n domain=\"{YOUR_DOMAIN}\",\n token=\"\u003ctoken>\",\n)\n\nclient.events.subscribe(\n from=\"from\",\n from_timestamp=\"from_timestamp\",\n event_type=[\n \"connection.created\"\n ],\n)\n"},{"label":"Subscribe to events via Server-Sent Events (SSE)","lang":"ruby","source":"require \"auth0\"\n\nclient = Auth0::Management.new(token: \"\u003ctoken>\", base_url: \"https://{YOUR_DOMAIN}/api/v2\")\n\nclient.events.subscribe(\n from: \"from\",\n from_timestamp: \"from_timestamp\",\n event_type: [\"connection.created\"]\n)\n"}],"requiredOnlyExamples":false,"requestExampleType":"codeSamples","responseExampleType":"generated","disableProxy":true,"urlDisplay":"full"},"dependencies":{"parameters":{"3cd77d6c-8321-4e17-b029-fb24a5fa537b":{"name":"from","in":"query","description":"Opaque token representing position in the stream. If not provided, stream will start from the latest events.","schema":{"type":"string","maxLength":1024,"description":"Opaque token representing position in the stream. If not provided, stream will start from the latest events.","uniqueKey":"","typeLabel":"string"}},"9f35bb0e-af6d-472c-a81e-3355299df93f":{"name":"from_timestamp","in":"query","description":"RFC-3339 timestamp indicating where to start streaming events from. This should only be used on the initial query when a cursor may not be available. Subsequent requests should use the cursor (from) as it will be more accurate.","schema":{"type":"string","maxLength":20,"description":"RFC-3339 timestamp indicating where to start streaming events from. This should only be used on the initial query when a cursor may not be available. Subsequent requests should use the cursor (from) as it will be more accurate.","uniqueKey":"","typeLabel":"string"}},"9a45e500-a704-457a-8e27-9e758c5fd320":{"name":"event_type","in":"query","description":"Event type(s) to listen for. Specify multiple times for multiple types (e.g., ?event_type=user.created\u0026event_type=user.updated). If not provided, all event types will be streamed.","style":"form","explode":true,"schema":{"type":"array","items":{"type":"string","enum":["connection.created","connection.deleted","connection.updated","group.created","group.deleted","group.member.added","group.member.deleted","group.role.assigned","group.role.deleted","group.updated","organization.connection.added","organization.connection.removed","organization.connection.updated","organization.created","organization.deleted","organization.group.role.assigned","organization.group.role.deleted","organization.member.added","organization.member.deleted","organization.member.role.assigned","organization.member.role.deleted","organization.updated","user.created","user.deleted","user.updated"],"uniqueKey":"items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"Event type(s) to listen for. Specify multiple times for multiple types (e.g., ?event_type=user.created\u0026event_type=user.updated). If not provided, all event types will be streamed.","uniqueKey":"","typeLabel":"enum\u003cstring>[]"}}},"responses":{"2a9941df-dfc3-4f4c-932a-f6e18bc9c60d":{"description":"Event stream successfully established.","content":{"text/event-stream":{"schema":{"oneOf":[{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["connection.created"],"isRequired":true,"uniqueKey":"oneOf.0.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.0.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a connection is created.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.0.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["connection.created"],"isRequired":true,"uniqueKey":"oneOf.0.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.0.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.0.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.0.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.0.event.data.object.oneOf.7","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.0.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.0.event.data.previous_object.oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.0.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.0.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.0.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.0.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.0.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.0.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.0.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.0.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.0.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.0.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.0.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.0.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.0.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.0.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.0.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.0.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.0.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.0.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.0.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.0.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.0","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["connection.deleted"],"isRequired":true,"uniqueKey":"oneOf.1.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.1.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a connection is deleted.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.1.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["connection.deleted"],"isRequired":true,"uniqueKey":"oneOf.1.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.1.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.1.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.1.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.1.event.data.object.oneOf.7","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.1.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.1.event.data.previous_object.oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.1.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.1.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.1.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.1.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.1.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.1.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.1.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.1.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.1.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.1.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.1.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.1.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.1.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.1.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.1.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.1.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.1.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.1.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.1.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.1.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.1","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["connection.updated"],"isRequired":true,"uniqueKey":"oneOf.2.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.2.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a connection is updated.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.2.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["connection.updated"],"isRequired":true,"uniqueKey":"oneOf.2.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.2.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.2.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.2.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.2.event.data.object.oneOf.7","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.2.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["oidc"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"type":"object","description":"Options for the 'oidc' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=oidc.","enum":["bind_all","use_map"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"type":"string","description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","enum":["back_channel","front_channel"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["okta"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'okta' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":255,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"type":"object","description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","additionalProperties":false,"properties":{"pkce":{"type":"string","description":"PKCE configuration.","enum":["auto","S256","plain","disabled"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"type":"string","description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","items":{"type":"string","description":"Algorithm allowed to verify the ID tokens.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"type":"string","description":"The internal schema version of the connection options.","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","minLength":6,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"type":"string","description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"type":"string","description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"type":"string","description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","enum":["issuer","token_endpoint"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"type":"object","description":"Mapping of claims received from the identity provider (IdP)","additionalProperties":false,"properties":{"attributes":{"type":"object","description":"Object containing mapping details for incoming claims","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","description":"Scopes to send to the IdP's Userinfo endpoint","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"type":"string","description":"Method used to map incoming claims when strategy=okta.","enum":["basic_profile","use_map"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","minLength":4,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.domain","typeLabel":"string"},"type":{"type":"string","description":"Connection type","enum":["back_channel"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["samlp"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'samlp' connection","additionalProperties":false,"properties":{"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"type":"object","description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","minLength":0,"maxLength":8192,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"type":"object","description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","additionalProperties":false,"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"properties":{"authorization_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","minItems":1,"items":{"type":"string","description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"type":"string","description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"type":"string","description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","description":"A list of the Authentication Context Class References that this OP supports","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","minItems":0,"items":{"type":"string","maxLength":25,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","minItems":0,"items":{"type":"string","maxLength":14,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":28,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","minItems":0,"items":{"type":"string","maxLength":20,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","minItems":1,"items":{"type":"string","maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","minItems":0,"items":{"type":"string","maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"type":"string","description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","minItems":0,"items":{"type":"string","maxLength":60,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","minItems":0,"items":{"type":"string","maxLength":50,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","minItems":0,"items":{"type":"string","maxLength":26,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"type":"string","description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","minItems":0,"items":{"type":"string","maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","type":"string","minLength":1,"maxLength":2396,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["pingfederate"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'pingfederate' connection","additionalProperties":false,"required":["pingFederateBaseUrl"],"properties":{"pingFederateBaseUrl":{"type":"string","description":"URL provided by PingFederate which returns information used for creating the connection","minLength":8,"maxLength":256,"format":"uri","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"type":"object","description":"Settings for SAML assertion decryption.","additionalProperties":false,"required":["algorithm_profile"],"properties":{"algorithm_profile":{"type":"string","description":"The algorithm profile to use for decrypting SAML assertions.","enum":["v2026-1"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","description":"A list of insecure algorithms to allow for SAML assertion decryption.","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"type":"string","description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","enum":["sha1","sha256"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","description":"Domain aliases for the connection","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"type":"object","description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","additionalProperties":false,"properties":{"client_authorizequery":{"description":"The query string sent to the default application","type":"string","minLength":1,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"description":"The client ID to use for IdP-initiated login requests.","type":"string","minLength":1,"maxLength":256,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"type":"string","description":"The response protocol used to communicate with the default application.","enum":["oidc","samlp","wsfed"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"type":"string","description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"type":"string","description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","minLength":1,"maxLength":10240,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"type":"object","description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"type":"string","description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["adfs"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'adfs' connection","additionalProperties":false,"properties":{"adfs_server":{"type":"string","description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","minLength":0,"maxLength":2048,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","minLength":1,"maxLength":102400,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","type":"string","minLength":1,"maxLength":128,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["ad"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'ad' connection","additionalProperties":false,"properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","type":"boolean","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","type":"string","minLength":5,"maxLength":12,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","minItems":0,"items":{"type":"string","minLength":256,"maxLength":3072,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"type":"string","description":"https url of the icon to be shown","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","minItems":0,"items":{"type":"string","minLength":2,"maxLength":39,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Primary AD domain hint used for HRD and discovery.","type":"string","format":"hostname","minLength":1,"maxLength":512,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","minItems":0,"items":{"type":"string","minLength":40,"maxLength":40,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5.options","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["google-apps"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'google-apps' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","type":"string","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"description":"Primary Google Workspace domain name that users must belong to.","type":"string","minLength":1,"maxLength":1024,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","minItems":0,"items":{"type":"string","description":"A domain alias used for Home Realm Discovery.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","minItems":1,"items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"type":"string","description":"The Google Workspace primary domain used to identify the organization during authentication.","minLength":1,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options.upstream_params","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The connection's identifier","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","minLength":1,"maxLength":128,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","description":"The connection strategy.","enum":["waad"],"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.strategy","typeLabel":"enum\u003cstring>"},"authentication":{"type":"object","description":"Configure the purpose of a connection to be used for authentication during login.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.authentication.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"type":"object","description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","description":"Connection name used in the new universal login experience","maxLength":128,"minLength":1,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"type":"object","description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","additionalProperties":false,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","minItems":0,"items":{"type":"string","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.realms","typeLabel":"string[]"},"options":{"type":"object","description":"Options for the 'waad' connection","additionalProperties":false,"required":["client_id"],"properties":{"client_id":{"type":"string","description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","minLength":0,"maxLength":100,"isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","minLength":0,"maxLength":500,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","description":"Timestamp of the last certificate expiring soon notification.","format":"date-time","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","minLength":0,"maxLength":512,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"type":"object","description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","additionalProperties":false,"required":["active"],"properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"type":"string","description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","minLength":8,"maxLength":255,"format":"uri","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"type":"string","description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","minLength":0,"maxLength":10,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","minItems":0,"items":{"type":"string","description":"A user field name that should not be stored in the Auth0 database.","minLength":0,"maxLength":255,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","minItems":0,"items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"type":"string","description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"type":"string","description":"Choose how Auth0 sets the email_verified field in the user profile.","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","type":"string","format":"uuid","minLength":36,"maxLength":36,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","minItems":0,"items":{"type":"string","description":"Certificate thumbprints for ADFS and Azure AD connections.","minLength":0,"maxLength":64,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"type":"object","description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"type":"string","description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","enum":["oid","sub"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"type":"string","description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","enum":["ws-federation","openid-connect"],"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7.show_as_button","typeLabel":"boolean"}},"additionalProperties":false,"uniqueKey":"oneOf.2.event.data.previous_object.oneOf.7","typeLabel":"object"}],"uniqueKey":"oneOf.2.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.2.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.2.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.2.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.2.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.2.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.2.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.2.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.2.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.2.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.2.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.2.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.2.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.2.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.2.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.2.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.2.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.2.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.2.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.2.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.2.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.2.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.2","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.created"],"isRequired":true,"uniqueKey":"oneOf.3.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.3.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a group is created.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.3.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.created"],"isRequired":true,"uniqueKey":"oneOf.3.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.3.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.3.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","created_at","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.3.event.data.object.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.3.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.3.event.data.previous_object.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.3.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.3.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.3.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.3.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.3.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.3.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.3.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.3.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.3.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.3.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.3.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.3.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.3.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.3.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.3.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.3.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.3.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.3.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.3.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.3.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.3.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.3.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.3.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.3.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.3","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.deleted"],"isRequired":true,"uniqueKey":"oneOf.4.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.4.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a group is deleted.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.4.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.deleted"],"isRequired":true,"uniqueKey":"oneOf.4.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.4.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.4.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","created_at","type","connection_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.connection_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type","organization_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.organization_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.4.event.data.object.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.4.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","connection_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.connection_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","organization_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.organization_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.4.event.data.previous_object.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.4.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.4.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.4.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.4.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.4.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.4.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.4.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.4.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.4.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.4.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.4.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.4.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.4.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.4.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.4.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.4.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.4.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.4.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.4.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.4.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.4.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.4.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.4.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.4.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.4","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.member.added"],"isRequired":true,"uniqueKey":"oneOf.5.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.5.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is added to a group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.5.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.member.added"],"isRequired":true,"uniqueKey":"oneOf.5.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.5.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.5.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.5.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["group","member"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the member belongs to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.group","typeLabel":"object"},"member":{"oneOf":[{"type":"object","description":"The member that is a part of the group.","required":["member_type","id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for user members","enum":["user"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.0.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The user's unique identifier","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.0.id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.0","typeLabel":"object"},{"type":"object","description":"The member that is a part of the group.","required":["member_type","id","type","connection_id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for connection members","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.1.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The connection member's unique identifier","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the connection","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.1.type","typeLabel":"string"},"connection_id":{"type":"string","description":"Connection ID associated with the member","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.1.connection_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member.oneOf.1","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.5.event.data.object.member","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.5.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["group","member"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the member belongs to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.group","typeLabel":"object"},"member":{"oneOf":[{"type":"object","description":"The member that is a part of the group.","required":["member_type","id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for user members","enum":["user"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.0.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The user's unique identifier","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.0.id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.0","typeLabel":"object"},{"type":"object","description":"The member that is a part of the group.","required":["member_type","id","type","connection_id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for connection members","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.1.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The connection member's unique identifier","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the connection","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.1.type","typeLabel":"string"},"connection_id":{"type":"string","description":"Connection ID associated with the member","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.1.connection_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member.oneOf.1","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.5.event.data.previous_object.member","typeLabel":"object"}},"uniqueKey":"oneOf.5.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.5.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.5.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.5.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.5.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.5.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.5.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.5.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.5.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.5.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.5.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.5.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.5.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.5.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.5.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.5.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.5.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.5.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.5.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.5.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.5.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.5.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.5.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.5.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.5","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.member.deleted"],"isRequired":true,"uniqueKey":"oneOf.6.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.6.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is removed from a group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.6.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.member.deleted"],"isRequired":true,"uniqueKey":"oneOf.6.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.6.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.6.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.6.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["group","member"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the member belongs to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.group","typeLabel":"object"},"member":{"oneOf":[{"type":"object","description":"The member that is a part of the group.","required":["member_type","id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for user members","enum":["user"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.0.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The user's unique identifier","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.0.id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.0","typeLabel":"object"},{"type":"object","description":"The member that is a part of the group.","required":["member_type","id","type","connection_id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for connection members","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.1.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The connection member's unique identifier","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the connection","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.1.type","typeLabel":"string"},"connection_id":{"type":"string","description":"Connection ID associated with the member","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.1.connection_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member.oneOf.1","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.6.event.data.object.member","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.6.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["group","member"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the member belongs to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the member belongs to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.group","typeLabel":"object"},"member":{"oneOf":[{"type":"object","description":"The member that is a part of the group.","required":["member_type","id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for user members","enum":["user"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.0.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The user's unique identifier","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.0.id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.0","typeLabel":"object"},{"type":"object","description":"The member that is a part of the group.","required":["member_type","id","type","connection_id"],"properties":{"member_type":{"type":"string","description":"Type discriminator for connection members","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.1.member_type","typeLabel":"enum\u003cstring>"},"id":{"type":"string","description":"The connection member's unique identifier","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the connection","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.1.type","typeLabel":"string"},"connection_id":{"type":"string","description":"Connection ID associated with the member","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.1.connection_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member.oneOf.1","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.6.event.data.previous_object.member","typeLabel":"object"}},"uniqueKey":"oneOf.6.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.6.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.6.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.6.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.6.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.6.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.6.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.6.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.6.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.6.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.6.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.6.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.6.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.6.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.6.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.6.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.6.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.6.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.6.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.6.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.6.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.6.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.6.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.6.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.6","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.7.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.7.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a role is assigned to a group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.7.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.7.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.7.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.7.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.7.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["group","role","created_at"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.group","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data.object.role","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.7.event.data.object.created_at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["group","role","created_at"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.group","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.role","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.7.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"oneOf.7.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.7.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.7.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.7.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.7.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.7.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.7.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.7.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.7.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.7.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.7.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.7.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.7.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.7.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.7.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.7.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.7.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.7.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.7.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.7.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.7.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.7.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.7","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.8.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.8.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a role is removed from a group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.8.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.8.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.8.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.8.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.8.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["group","role","deleted_at"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the role is removed from.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is removed from.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is removed from.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.group","typeLabel":"object"},"role":{"type":"object","description":"The role removed from the group.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.role.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data.object.role","typeLabel":"object"},"deleted_at":{"type":"string","description":"The time at which the role was removed from the group.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.8.event.data.object.deleted_at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["group","role","created_at"],"properties":{"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.group","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.role","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.8.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"oneOf.8.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.8.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.8.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.8.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.8.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.8.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.8.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.8.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.8.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.8.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.8.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.8.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.8.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.8.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.8.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.8.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.8.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.8.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.8.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.8.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.8.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.8.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.8","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["group.updated"],"isRequired":true,"uniqueKey":"oneOf.9.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.9.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a group is updated.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.9.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["group.updated"],"isRequired":true,"uniqueKey":"oneOf.9.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.9.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.9.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","created_at","type","connection_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.connection_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type","organization_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.organization_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","created_at","type","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.9.event.data.object.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.9.event.data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","connection_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.connection_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","organization_id","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.organization_id","typeLabel":"string"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","created_at","type","updated_at"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the group.","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.name","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.created_at","typeLabel":"string\u003cdate-time>"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.type","typeLabel":"enum\u003cstring>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.updated_at","typeLabel":"string\u003cdate-time>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.9.event.data.previous_object.oneOf.2","typeLabel":"object"}],"uniqueKey":"oneOf.9.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.9.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.9.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.9.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.9.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.9.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.9.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.9.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.9.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.9.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.9.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.9.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.9.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.9.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.9.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.9.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.9.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.9.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.9.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.9.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.9.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.9.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.9.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.9.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.9","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.connection.added"],"isRequired":true,"uniqueKey":"oneOf.10.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.10.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a connection is added to an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.10.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.connection.added"],"isRequired":true,"uniqueKey":"oneOf.10.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.10.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.10.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.10.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.10.event.data.object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.10.event.data.object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.10.event.data.object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.object.connection","typeLabel":"object"},"assign_membership_on_login":{"type":"boolean","description":"When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection.","uniqueKey":"oneOf.10.event.data.object.assign_membership_on_login","typeLabel":"boolean"},"show_as_button":{"type":"boolean","description":"Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections.","uniqueKey":"oneOf.10.event.data.object.show_as_button","typeLabel":"boolean"},"is_signup_enabled":{"type":"boolean","description":"Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections.","uniqueKey":"oneOf.10.event.data.object.is_signup_enabled","typeLabel":"boolean"},"is_enabled":{"type":"boolean","description":"Determines whether the connection is enabled for the organization.","uniqueKey":"oneOf.10.event.data.object.is_enabled","typeLabel":"boolean"},"organization_access_level":{"oneOf":[{"type":"string","description":"The access level granted to the connection for an organization.","enum":["none"],"uniqueKey":"oneOf.10.event.data.object.organization_access_level.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["readonly"],"uniqueKey":"oneOf.10.event.data.object.organization_access_level.oneOf.1","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["limited"],"uniqueKey":"oneOf.10.event.data.object.organization_access_level.oneOf.2","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["full"],"uniqueKey":"oneOf.10.event.data.object.organization_access_level.oneOf.3","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.10.event.data.object.organization_access_level","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.10.event.data.previous_object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.10.event.data.previous_object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.previous_object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.10.event.data.previous_object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.previous_object.connection","typeLabel":"object"},"assign_membership_on_login":{"type":"boolean","description":"When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection.","uniqueKey":"oneOf.10.event.data.previous_object.assign_membership_on_login","typeLabel":"boolean"},"show_as_button":{"type":"boolean","description":"Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections.","uniqueKey":"oneOf.10.event.data.previous_object.show_as_button","typeLabel":"boolean"},"is_signup_enabled":{"type":"boolean","description":"Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections.","uniqueKey":"oneOf.10.event.data.previous_object.is_signup_enabled","typeLabel":"boolean"},"is_enabled":{"type":"boolean","description":"Determines whether the connection is enabled for the organization.","uniqueKey":"oneOf.10.event.data.previous_object.is_enabled","typeLabel":"boolean"},"organization_access_level":{"oneOf":[{"type":"string","description":"The access level granted to the connection for an organization.","enum":["none"],"uniqueKey":"oneOf.10.event.data.previous_object.organization_access_level.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["readonly"],"uniqueKey":"oneOf.10.event.data.previous_object.organization_access_level.oneOf.1","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["limited"],"uniqueKey":"oneOf.10.event.data.previous_object.organization_access_level.oneOf.2","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["full"],"uniqueKey":"oneOf.10.event.data.previous_object.organization_access_level.oneOf.3","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.10.event.data.previous_object.organization_access_level","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.10.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.10.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.10.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.10.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.10.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.10.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.10.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.10.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.10.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.10.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.10.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.10.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.10.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.10.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.10.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.10.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.10.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.10.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.10.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.10.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.10.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.10.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.10","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.connection.removed"],"isRequired":true,"uniqueKey":"oneOf.11.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.11.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a connection is removed from an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.11.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.connection.removed"],"isRequired":true,"uniqueKey":"oneOf.11.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.11.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.11.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.11.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.11.event.data.object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.11.event.data.object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.11.event.data.object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.object.connection","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.11.event.data.previous_object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.11.event.data.previous_object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.previous_object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.11.event.data.previous_object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.previous_object.connection","typeLabel":"object"}},"uniqueKey":"oneOf.11.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.11.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.11.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.11.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.11.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.11.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.11.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.11.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.11.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.11.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.11.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.11.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.11.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.11.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.11.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.11.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.11.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.11.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.11.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.11.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.11.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.11.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.11","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.connection.updated"],"isRequired":true,"uniqueKey":"oneOf.12.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.12.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a organization connection is updated.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.12.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.connection.updated"],"isRequired":true,"uniqueKey":"oneOf.12.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.12.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.12.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.12.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.12.event.data.object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.12.event.data.object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.12.event.data.object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.object.connection","typeLabel":"object"},"assign_membership_on_login":{"type":"boolean","description":"When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection.","uniqueKey":"oneOf.12.event.data.object.assign_membership_on_login","typeLabel":"boolean"},"show_as_button":{"type":"boolean","description":"Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections.","uniqueKey":"oneOf.12.event.data.object.show_as_button","typeLabel":"boolean"},"is_signup_enabled":{"type":"boolean","description":"Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections.","uniqueKey":"oneOf.12.event.data.object.is_signup_enabled","typeLabel":"boolean"},"is_enabled":{"type":"boolean","description":"Determines whether the connection is enabled for the organization.","uniqueKey":"oneOf.12.event.data.object.is_enabled","typeLabel":"boolean"},"organization_access_level":{"oneOf":[{"type":"string","description":"The access level granted to the connection for an organization.","enum":["none"],"uniqueKey":"oneOf.12.event.data.object.organization_access_level.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["readonly"],"uniqueKey":"oneOf.12.event.data.object.organization_access_level.oneOf.1","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["limited"],"uniqueKey":"oneOf.12.event.data.object.organization_access_level.oneOf.2","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["full"],"uniqueKey":"oneOf.12.event.data.object.organization_access_level.oneOf.3","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.12.event.data.object.organization_access_level","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","connection"],"properties":{"organization":{"type":"object","description":"Information about an Auth0 Organization.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.12.event.data.previous_object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.12.event.data.previous_object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.previous_object.organization","typeLabel":"object"},"connection":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.12.event.data.previous_object.connection.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.previous_object.connection","typeLabel":"object"},"assign_membership_on_login":{"type":"boolean","description":"When true, all users that log in with this connection will be automatically granted membership\nin the organization. When false, users must be granted membership in the organization before\nlogging in with this connection.","uniqueKey":"oneOf.12.event.data.previous_object.assign_membership_on_login","typeLabel":"boolean"},"show_as_button":{"type":"boolean","description":"Determines whether a connection should be displayed on this organization’s login prompt.\nOnly applicable for enterprise connections.","uniqueKey":"oneOf.12.event.data.previous_object.show_as_button","typeLabel":"boolean"},"is_signup_enabled":{"type":"boolean","description":"Determines whether organization signup should be enabled for this organization connection.\nOnly applicable for database connections.","uniqueKey":"oneOf.12.event.data.previous_object.is_signup_enabled","typeLabel":"boolean"},"is_enabled":{"type":"boolean","description":"Determines whether the connection is enabled for the organization.","uniqueKey":"oneOf.12.event.data.previous_object.is_enabled","typeLabel":"boolean"},"organization_access_level":{"oneOf":[{"type":"string","description":"The access level granted to the connection for an organization.","enum":["none"],"uniqueKey":"oneOf.12.event.data.previous_object.organization_access_level.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["readonly"],"uniqueKey":"oneOf.12.event.data.previous_object.organization_access_level.oneOf.1","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["limited"],"uniqueKey":"oneOf.12.event.data.previous_object.organization_access_level.oneOf.2","typeLabel":"enum\u003cstring>"},{"type":"string","description":"The access level granted to the connection for an organization.","enum":["full"],"uniqueKey":"oneOf.12.event.data.previous_object.organization_access_level.oneOf.3","typeLabel":"enum\u003cstring>"}],"uniqueKey":"oneOf.12.event.data.previous_object.organization_access_level","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.12.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.12.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.12.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.12.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.12.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.12.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.12.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.12.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.12.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.12.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.12.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.12.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.12.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.12.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.12.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.12.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.12.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.12.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.12.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.12.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.12.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.12.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.12","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.created"],"isRequired":true,"uniqueKey":"oneOf.13.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.13.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when an organization is created.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.13.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.created"],"isRequired":true,"uniqueKey":"oneOf.13.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.13.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.13.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.13.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.13.event.data.object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.13.event.data.object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.13.event.data.object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.13.event.data.object.metadata","typeLabel":"object"},"branding":{"type":"object","description":"The branding associated with the organization.","additionalProperties":false,"properties":{"logo_url":{"type":"string","description":"URL of logo to display on login page.","format":"uri","uniqueKey":"oneOf.13.event.data.object.branding.logo_url","typeLabel":"string\u003curi>"},"colors":{"type":"object","description":"Color scheme used to customize the login pages.","additionalProperties":false,"properties":{"primary":{"type":"string","description":"HEX Color for primary elements.","uniqueKey":"oneOf.13.event.data.object.branding.colors.primary","typeLabel":"string"},"page_background":{"type":"string","description":"HEX Color for background.","uniqueKey":"oneOf.13.event.data.object.branding.colors.page_background","typeLabel":"string"}},"uniqueKey":"oneOf.13.event.data.object.branding.colors","typeLabel":"object"}},"uniqueKey":"oneOf.13.event.data.object.branding","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.13.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.13.event.data.previous_object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.13.event.data.previous_object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.13.event.data.previous_object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.13.event.data.previous_object.metadata","typeLabel":"object"},"branding":{"type":"object","description":"The branding associated with the organization.","additionalProperties":false,"properties":{"logo_url":{"type":"string","description":"URL of logo to display on login page.","format":"uri","uniqueKey":"oneOf.13.event.data.previous_object.branding.logo_url","typeLabel":"string\u003curi>"},"colors":{"type":"object","description":"Color scheme used to customize the login pages.","additionalProperties":false,"properties":{"primary":{"type":"string","description":"HEX Color for primary elements.","uniqueKey":"oneOf.13.event.data.previous_object.branding.colors.primary","typeLabel":"string"},"page_background":{"type":"string","description":"HEX Color for background.","uniqueKey":"oneOf.13.event.data.previous_object.branding.colors.page_background","typeLabel":"string"}},"uniqueKey":"oneOf.13.event.data.previous_object.branding.colors","typeLabel":"object"}},"uniqueKey":"oneOf.13.event.data.previous_object.branding","typeLabel":"object"}},"uniqueKey":"oneOf.13.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.13.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.13.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.13.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.13.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.13.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.13.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.13.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.13.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.13.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.13.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.13.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.13.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.13.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.13.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.13.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.13.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.13.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.13.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.13.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.13.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.13.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.13.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.13.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.13","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.deleted"],"isRequired":true,"uniqueKey":"oneOf.14.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.14.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when an organization is deleted.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.14.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.deleted"],"isRequired":true,"uniqueKey":"oneOf.14.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.14.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.14.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.14.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.14.event.data.object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.14.event.data.object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.14.event.data.object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.14.event.data.object.metadata","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.14.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.14.event.data.previous_object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.14.event.data.previous_object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.14.event.data.previous_object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.14.event.data.previous_object.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.14.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.14.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.14.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.14.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.14.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.14.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.14.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.14.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.14.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.14.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.14.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.14.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.14.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.14.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.14.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.14.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.14.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.14.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.14.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.14.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.14.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.14.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.14.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.14.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.14","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.group.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.15.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.15.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a role is assigned to an organization group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.15.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.group.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.15.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.15.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.15.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.15.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","role","group","created_at"],"properties":{"organization":{"type":"object","description":"The organization the group role is assigned in.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.organization","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.role","typeLabel":"object"},"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.15.event.data.object.group","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group in the organization.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.15.event.data.object.created_at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","role","group","created_at"],"properties":{"organization":{"type":"object","description":"The organization the group role is assigned in.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.organization","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.role","typeLabel":"object"},"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.group","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group in the organization.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.15.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"oneOf.15.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.15.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.15.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.15.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.15.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.15.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.15.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.15.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.15.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.15.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.15.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.15.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.15.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.15.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.15.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.15.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.15.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.15.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.15.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.15.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.15.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.15.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.15","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.group.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.16.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.16.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a role is removed from an organization group.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.16.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.group.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.16.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.16.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.16.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.16.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","role","group","deleted_at"],"properties":{"organization":{"type":"object","description":"The organization the group role is removed from.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.organization","typeLabel":"object"},"role":{"type":"object","description":"The role removed from the group.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.role.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.role","typeLabel":"object"},"group":{"oneOf":[{"type":"object","description":"The group the role is removed from.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is removed from.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is removed from.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.16.event.data.object.group","typeLabel":"object"},"deleted_at":{"type":"string","description":"The time at which the role was removed from the group in the organization.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.16.event.data.object.deleted_at","typeLabel":"string\u003cdate-time>"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","role","group","created_at"],"properties":{"organization":{"type":"object","description":"The organization the group role is assigned in.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.organization","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the group in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.role","typeLabel":"object"},"group":{"oneOf":[{"type":"object","description":"The group the role is assigned to.","required":["id","type","connection_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.0.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["connection"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.0.type","typeLabel":"enum\u003cstring>"},"connection_id":{"type":"string","description":"The connection ID associated with the group.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.0.connection_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.0.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.0","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type","organization_id"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.1.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["organization"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.1.type","typeLabel":"enum\u003cstring>"},"organization_id":{"type":"string","description":"The organization ID associated with the group.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.1.organization_id","typeLabel":"string"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.1.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.1","typeLabel":"object"},{"type":"object","description":"The group the role is assigned to.","required":["id","type"],"properties":{"id":{"type":"string","description":"The unique identifier for the group.","pattern":"grp_[1-9a-km-zA-HJ-NP-Z]{14,22}","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.2.id","typeLabel":"string"},"type":{"type":"string","description":"The type of the group.","enum":["tenant"],"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.2.type","typeLabel":"enum\u003cstring>"},"external_id":{"type":"string","description":"The external identifier for the group.","uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.2.external_id","typeLabel":"string"}},"additionalProperties":false,"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group.oneOf.2","typeLabel":"object"}],"isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.group","typeLabel":"object"},"created_at":{"type":"string","description":"The time at which the role was assigned to the group in the organization.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.16.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"}},"uniqueKey":"oneOf.16.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.16.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.16.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.16.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.16.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.16.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.16.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.16.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.16.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.16.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.16.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.16.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.16.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.16.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.16.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.16.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.16.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.16.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.16.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.16.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.16.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.16.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.16","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.member.added"],"isRequired":true,"uniqueKey":"oneOf.17.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.17.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is added to an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.17.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.member.added"],"isRequired":true,"uniqueKey":"oneOf.17.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.17.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.17.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.17.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","user"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.17.event.data.object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.17.event.data.object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.17.event.data.object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.object.user","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","user"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.17.event.data.previous_object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.17.event.data.previous_object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.previous_object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.17.event.data.previous_object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.previous_object.user","typeLabel":"object"}},"uniqueKey":"oneOf.17.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.17.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.17.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.17.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.17.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.17.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.17.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.17.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.17.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.17.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.17.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.17.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.17.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.17.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.17.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.17.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.17.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.17.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.17.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.17.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.17.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.17.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.17","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.member.deleted"],"isRequired":true,"uniqueKey":"oneOf.18.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.18.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is removed from an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.18.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.member.deleted"],"isRequired":true,"uniqueKey":"oneOf.18.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.18.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.18.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.18.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","user"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.18.event.data.object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.18.event.data.object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.18.event.data.object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.object.user","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","user"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.18.event.data.previous_object.organization.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.18.event.data.previous_object.organization.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.previous_object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.18.event.data.previous_object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.previous_object.user","typeLabel":"object"}},"uniqueKey":"oneOf.18.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.18.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.18.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.18.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.18.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.18.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.18.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.18.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.18.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.18.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.18.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.18.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.18.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.18.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.18.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.18.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.18.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.18.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.18.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.18.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.18.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.18.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.18","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.member.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.19.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.19.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is added to an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.19.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.member.role.assigned"],"isRequired":true,"uniqueKey":"oneOf.19.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.19.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.19.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.19.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","user","role"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.19.event.data.object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.19.event.data.object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.object.user","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the user in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.19.event.data.object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.19.event.data.object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.object.role","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","user","role"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.user","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the user in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.previous_object.role","typeLabel":"object"}},"uniqueKey":"oneOf.19.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.19.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.19.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.19.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.19.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.19.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.19.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.19.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.19.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.19.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.19.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.19.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.19.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.19.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.19.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.19.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.19.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.19.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.19.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.19.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.19.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.19.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.19","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.member.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.20.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.20.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a member is removed from an organization.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.20.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.member.role.deleted"],"isRequired":true,"uniqueKey":"oneOf.20.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.20.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.20.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.20.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["organization","user","role"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.20.event.data.object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.20.event.data.object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.object.user","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the user in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.20.event.data.object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.20.event.data.object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.object.role","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["organization","user","role"],"properties":{"organization":{"type":"object","description":"The organization the member belongs to.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.organization.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.organization","typeLabel":"object"},"user":{"type":"object","description":"The user that is a member of the organization.","additionalProperties":true,"required":["user_id"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.user.user_id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.user","typeLabel":"object"},"role":{"type":"object","description":"The role assigned to the user in the organization.","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","description":"The ID of the role.","pattern":"rol_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.role.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the role.","isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.role.name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.previous_object.role","typeLabel":"object"}},"uniqueKey":"oneOf.20.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.20.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.20.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.20.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.20.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.20.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.20.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.20.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.20.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.20.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.20.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.20.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.20.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.20.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.20.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.20.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.20.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.20.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.20.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.20.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.20.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.20.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.20","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["organization.updated"],"isRequired":true,"uniqueKey":"oneOf.21.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.21.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when an organization is updated.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.21.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["organization.updated"],"isRequired":true,"uniqueKey":"oneOf.21.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.21.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.21.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.21.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.21.event.data.object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.21.event.data.object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.21.event.data.object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.21.event.data.object.metadata","typeLabel":"object"},"branding":{"type":"object","description":"The branding associated with the organization.","additionalProperties":false,"properties":{"logo_url":{"type":"string","description":"URL of logo to display on login page.","format":"uri","uniqueKey":"oneOf.21.event.data.object.branding.logo_url","typeLabel":"string\u003curi>"},"colors":{"type":"object","description":"Color scheme used to customize the login pages.","additionalProperties":false,"properties":{"primary":{"type":"string","description":"HEX Color for primary elements.","uniqueKey":"oneOf.21.event.data.object.branding.colors.primary","typeLabel":"string"},"page_background":{"type":"string","description":"HEX Color for background.","uniqueKey":"oneOf.21.event.data.object.branding.colors.page_background","typeLabel":"string"}},"uniqueKey":"oneOf.21.event.data.object.branding.colors","typeLabel":"object"}},"uniqueKey":"oneOf.21.event.data.object.branding","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.21.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"ID of the organization.","pattern":"org_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.21.event.data.previous_object.id","typeLabel":"string"},"name":{"type":"string","description":"The human-readable identifier for the organization that will be used by end-users to direct them to their organization in your application..","pattern":"^(?:(?!org_))[a-z0-9]([a-z0-9-_]*[a-z0-9])?$","uniqueKey":"oneOf.21.event.data.previous_object.name","typeLabel":"string"},"display_name":{"type":"string","description":"If set, the name that will be displayed to end-users for this organization in any interaction with them.","uniqueKey":"oneOf.21.event.data.previous_object.display_name","typeLabel":"string"},"metadata":{"type":"object","description":"The metadata associated with the organization.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.21.event.data.previous_object.metadata","typeLabel":"object"},"branding":{"type":"object","description":"The branding associated with the organization.","additionalProperties":false,"properties":{"logo_url":{"type":"string","description":"URL of logo to display on login page.","format":"uri","uniqueKey":"oneOf.21.event.data.previous_object.branding.logo_url","typeLabel":"string\u003curi>"},"colors":{"type":"object","description":"Color scheme used to customize the login pages.","additionalProperties":false,"properties":{"primary":{"type":"string","description":"HEX Color for primary elements.","uniqueKey":"oneOf.21.event.data.previous_object.branding.colors.primary","typeLabel":"string"},"page_background":{"type":"string","description":"HEX Color for background.","uniqueKey":"oneOf.21.event.data.previous_object.branding.colors.page_background","typeLabel":"string"}},"uniqueKey":"oneOf.21.event.data.previous_object.branding.colors","typeLabel":"object"}},"uniqueKey":"oneOf.21.event.data.previous_object.branding","typeLabel":"object"}},"uniqueKey":"oneOf.21.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.21.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.21.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.21.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.21.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.21.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.21.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.21.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.21.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.21.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.21.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.21.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.21.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.21.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.21.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.21.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.21.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.21.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.21.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.21.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.21.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.21.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.21.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.21.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.21","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["user.created"],"isRequired":true,"uniqueKey":"oneOf.22.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.22.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a user is created.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.22.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["user.created"],"isRequired":true,"uniqueKey":"oneOf.22.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.22.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.22.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.22.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.22.event.data.object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.22.event.data.object.identities","typeLabel":"object[]"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.22.event.data.object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.22.event.data.object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.22.event.data.object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.22.event.data.object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.22.event.data.object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.22.event.data.object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.22.event.data.object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.22.event.data.object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.22.event.data.object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.object.family_name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.22.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.22.event.data.previous_object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.22.event.data.previous_object.identities","typeLabel":"object[]"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.22.event.data.previous_object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.22.event.data.previous_object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.22.event.data.previous_object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.22.event.data.previous_object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.22.event.data.previous_object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.22.event.data.previous_object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.22.event.data.previous_object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.22.event.data.previous_object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.22.event.data.previous_object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.22.event.data.previous_object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.22.event.data.previous_object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.22.event.data.previous_object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.22.event.data.previous_object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.22.event.data.previous_object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.22.event.data.previous_object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.22.event.data.previous_object.family_name","typeLabel":"string"}},"uniqueKey":"oneOf.22.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.22.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.22.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.22.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.22.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.22.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.22.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.22.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.22.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.22.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.22.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.22.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.22.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.22.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.22.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.22.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.22.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.22.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.22.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.22.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.22.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.22.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.22.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.22.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.22","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["user.deleted"],"isRequired":true,"uniqueKey":"oneOf.23.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.23.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a user is deleted.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.23.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["user.deleted"],"isRequired":true,"uniqueKey":"oneOf.23.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.23.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.23.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities","deleted_at"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.23.event.data.object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.23.event.data.object.identities","typeLabel":"object[]"},"deleted_at":{"type":"string","description":"Date and time when this entity was deleted (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.data.object.deleted_at","typeLabel":"string\u003cdate-time>"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.23.event.data.object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.23.event.data.object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.23.event.data.object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.23.event.data.object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.23.event.data.object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.23.event.data.object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.23.event.data.object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.23.event.data.object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.23.event.data.object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.object.family_name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.23.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.23.event.data.previous_object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.23.event.data.previous_object.identities","typeLabel":"object[]"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.23.event.data.previous_object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.23.event.data.previous_object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.23.event.data.previous_object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.23.event.data.previous_object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.23.event.data.previous_object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.23.event.data.previous_object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.23.event.data.previous_object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.23.event.data.previous_object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.23.event.data.previous_object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.23.event.data.previous_object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.23.event.data.previous_object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.23.event.data.previous_object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.23.event.data.previous_object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.23.event.data.previous_object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.23.event.data.previous_object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.23.event.data.previous_object.family_name","typeLabel":"string"}},"uniqueKey":"oneOf.23.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.23.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.23.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.23.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.23.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.23.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.23.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.23.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.23.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.23.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.23.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.23.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.23.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.23.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.23.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.23.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.23.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.23.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.23.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.23.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.23.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.23.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.23.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.23.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.23","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset","event"],"properties":{"type":{"type":"string","description":"The event type (injected from the SSE event field).","enum":["user.updated"],"isRequired":true,"uniqueKey":"oneOf.24.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.24.offset","typeLabel":"string"},"event":{"type":"object","description":"Represents an event that occurs when a user is updated.","additionalProperties":false,"required":["specversion","type","source","id","time","data","a0tenant","a0stream"],"properties":{"specversion":{"type":"string","description":"The version of the CloudEvents specification which the event uses.","enum":["1.0"],"isRequired":true,"uniqueKey":"oneOf.24.event.specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","description":"The type of the event which has happened.","enum":["user.updated"],"isRequired":true,"uniqueKey":"oneOf.24.event.type","typeLabel":"enum\u003cstring>"},"source":{"type":"string","description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"oneOf.24.event.source","typeLabel":"string"},"id":{"type":"string","description":"A unique identifier for the event.","pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.24.event.id","typeLabel":"string"},"time":{"type":"string","description":"An ISO-8601 timestamp indicating when the event physically occurred.","format":"date-time","isRequired":true,"uniqueKey":"oneOf.24.event.time","typeLabel":"string\u003cdate-time>"},"data":{"type":"object","description":"The event payload.","additionalProperties":false,"required":["object"],"properties":{"object":{"type":"object","description":"The event content.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.24.event.data.object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.24.event.data.object.identities","typeLabel":"object[]"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.24.event.data.object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.24.event.data.object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.24.event.data.object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.24.event.data.object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.24.event.data.object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.24.event.data.object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.24.event.data.object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.24.event.data.object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.24.event.data.object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.object.family_name","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.24.event.data.object","typeLabel":"object"},"previous_object":{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","additionalProperties":true,"required":["user_id","created_at","updated_at","identities"],"properties":{"user_id":{"type":"string","description":"ID of the user which can be used when interacting with other APIs.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.user_id","typeLabel":"string"},"created_at":{"type":"string","description":"Date and time when this entity was created (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"type":"string","description":"Date and time when this entity was last updated/modified (ISO_8601 format).","format":"date-time","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.updated_at","typeLabel":"string\u003cdate-time>"},"identities":{"type":"array","description":"Array of user identity objects when accounts are linked.","items":{"oneOf":[{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of custom identity providers.","enum":["custom"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.0","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of database identity providers.","enum":["auth0"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.1","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of enterprise identity providers.","enum":["ad","adfs","google-apps","ip","office365","oidc","okta","pingfederate","samlp","sharepoint","waad"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.2","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of passwordless identity providers.","enum":["email","sms"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[false],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.3","typeLabel":"object"},{"type":"object","description":"Identity object when accounts are linked.","required":["connection","user_id","provider","isSocial"],"properties":{"connection":{"type":"string","description":"Name of the connection containing this identity.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.connection","typeLabel":"string"},"user_id":{"oneOf":[{"type":"string","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.0","typeLabel":"string"},{"type":"integer","description":"The IDP-specific identifer for the user.","isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id.oneOf.1","typeLabel":"integer"}],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.user_id","typeLabel":"string | integer"},"provider":{"type":"string","description":"List of social identity providers.","enum":["amazon","apple","dropbox","bitbucket","auth0-oidc","baidu","bitly","box","daccount","dwolla","evernote-sandbox","evernote","exact","facebook","fitbit","github","google-oauth2","instagram","line","linkedin","oauth1","oauth2","paypal","paypal-sandbox","planningcenter","salesforce-community","salesforce-sandbox","salesforce","shopify","soundcloud","thirtysevensignals","twitter","untapped","vkontakte","weibo","windowslive","wordpress","yahoo","yandex"],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.provider","typeLabel":"enum\u003cstring>"},"isSocial":{"type":"boolean","enum":[true],"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.isSocial","typeLabel":"enum\u003cboolean>"},"profileData":{"type":"object","description":"Profile data for the user.","additionalProperties":true,"properties":{"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.email_verified","typeLabel":"boolean"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.name","typeLabel":"string"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.username","typeLabel":"string"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.family_name","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData.phone_verified","typeLabel":"boolean"}},"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4.profileData","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX].oneOf.4","typeLabel":"object"}],"uniqueKey":"oneOf.24.event.data.previous_object.identities.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.24.event.data.previous_object.identities","typeLabel":"object[]"},"email":{"type":"string","description":"Email address of this user.","format":"email","uniqueKey":"oneOf.24.event.data.previous_object.email","typeLabel":"string\u003cemail>"},"email_verified":{"type":"boolean","description":"Whether this email address is verified (true) or unverified (false).","uniqueKey":"oneOf.24.event.data.previous_object.email_verified","typeLabel":"boolean"},"username":{"type":"string","description":"Username of this user.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9_+\\-.!#\\$\\^`~@']*$","uniqueKey":"oneOf.24.event.data.previous_object.username","typeLabel":"string"},"phone_number":{"type":"string","description":"Phone number of this user.","pattern":"^\\+[0-9]{1,15}$","uniqueKey":"oneOf.24.event.data.previous_object.phone_number","typeLabel":"string"},"phone_verified":{"type":"boolean","description":"Whether this phone number has been verified (true) or not (false).","uniqueKey":"oneOf.24.event.data.previous_object.phone_verified","typeLabel":"boolean"},"app_metadata":{"type":"object","description":"User metadata to which this user has read-only access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.24.event.data.previous_object.app_metadata","typeLabel":"object"},"user_metadata":{"type":"object","description":"User metadata to which this user has read/write access.","additionalProperties":true,"properties":{},"uniqueKey":"oneOf.24.event.data.previous_object.user_metadata","typeLabel":"object"},"picture":{"type":"string","description":"URL to picture, photo, or avatar of this user.","format":"uri","uniqueKey":"oneOf.24.event.data.previous_object.picture","typeLabel":"string\u003curi>"},"name":{"type":"string","description":"Name of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.name","typeLabel":"string"},"nickname":{"type":"string","description":"Preferred nickname or alias of this user.","minLength":1,"maxLength":300,"uniqueKey":"oneOf.24.event.data.previous_object.nickname","typeLabel":"string"},"multifactor":{"type":"array","description":"List of multi-factor authentication providers with which this user has enrolled.","items":{"type":"string","uniqueKey":"oneOf.24.event.data.previous_object.multifactor.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.24.event.data.previous_object.multifactor","typeLabel":"string[]"},"last_ip":{"type":"string","description":"Last IP address from which this user logged in.","uniqueKey":"oneOf.24.event.data.previous_object.last_ip","typeLabel":"string"},"last_login":{"type":"string","description":"Last date and time this user logged in (ISO_8601 format).","format":"date-time","uniqueKey":"oneOf.24.event.data.previous_object.last_login","typeLabel":"string\u003cdate-time>"},"logins_count":{"type":"integer","description":"Total number of logins this user has performed.","uniqueKey":"oneOf.24.event.data.previous_object.logins_count","typeLabel":"integer"},"blocked":{"type":"boolean","description":"Whether this user was blocked by an administrator (true) or is not (false).","uniqueKey":"oneOf.24.event.data.previous_object.blocked","typeLabel":"boolean"},"given_name":{"type":"string","description":"Given name/first name/forename of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.given_name","typeLabel":"string"},"family_name":{"type":"string","description":"Family name/last name/surname of this user.","minLength":1,"maxLength":150,"uniqueKey":"oneOf.24.event.data.previous_object.family_name","typeLabel":"string"}},"uniqueKey":"oneOf.24.event.data.previous_object","typeLabel":"object"},"context":{"type":"object","description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","additionalProperties":false,"required":["tenant"],"properties":{"tenant":{"type":"object","description":"Reference to a tenant in event context","additionalProperties":false,"required":["id"],"properties":{"id":{"type":"string","description":"User-provided tenant identifier.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.tenant.id","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.24.event.data.context.tenant","typeLabel":"object"},"client":{"type":"object","description":"The OAuth Client requesting or presenting an access token.","additionalProperties":false,"required":["id","name","metadata"],"properties":{"id":{"type":"string","description":"The client identifier.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.client.name","typeLabel":"string"},"metadata":{"type":"object","description":"Client metadata.","additionalProperties":true,"properties":{},"isRequired":true,"uniqueKey":"oneOf.24.event.data.context.client.metadata","typeLabel":"object"}},"uniqueKey":"oneOf.24.event.data.context.client","typeLabel":"object"},"connection":{"type":"object","description":"The Auth0 Connection used for the authentication transaction that generated the event.","additionalProperties":false,"required":["id","name","strategy"],"properties":{"id":{"type":"string","description":"The ID of the connection.","pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.connection.id","typeLabel":"string"},"name":{"type":"string","description":"The name of the connection.","minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.connection.strategy","typeLabel":"string"}},"uniqueKey":"oneOf.24.event.data.context.connection","typeLabel":"object"},"request":{"type":"object","description":"An HTTP request.","additionalProperties":false,"required":["geo","hostname","ip","method","user_agent"],"properties":{"geo":{"type":"object","description":"Geographic information about the request origin.","additionalProperties":false,"properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"oneOf.24.event.data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"oneOf.24.event.data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"oneOf.24.event.data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"oneOf.24.event.data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"oneOf.24.event.data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"oneOf.24.event.data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"oneOf.24.event.data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"oneOf.24.event.data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"oneOf.24.event.data.context.request.geo.time_zone","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.24.event.data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"oneOf.24.event.data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"oneOf.24.event.data.context.request.custom_domain","typeLabel":"string"}},"uniqueKey":"oneOf.24.event.data.context.request","typeLabel":"object"}},"uniqueKey":"oneOf.24.event.data.context","typeLabel":"object"}},"isRequired":true,"uniqueKey":"oneOf.24.event.data","typeLabel":"object"},"a0tenant":{"type":"string","description":"The auth0 tenant ID to which the event is associated.","minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"oneOf.24.event.a0tenant","typeLabel":"string"},"a0stream":{"type":"string","description":"The auth0 event stream ID of the stream the event was delivered on.","pattern":"est_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"oneOf.24.event.a0stream","typeLabel":"string"},"a0purpose":{"type":"string","description":"The purpose of this event. This field will typically appear only in special cases\nsuch as sending a test event. For normal events, this field will be omitted.","enum":["test"],"uniqueKey":"oneOf.24.event.a0purpose","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.24.event","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.24","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","error"],"properties":{"type":{"type":"string","description":"Identifies this as an error message (injected from the SSE event field).","enum":["error"],"isRequired":true,"uniqueKey":"oneOf.25.type","typeLabel":"enum\u003cstring>"},"error":{"type":"object","description":"Error details.","additionalProperties":false,"required":["code","message"],"properties":{"code":{"type":"string","description":"Machine-readable error code.","enum":["invalid_cursor","cursor_expired","timeout","payload_too_large","processing_error","connection_timeout"],"isRequired":true,"uniqueKey":"oneOf.25.error.code","typeLabel":"enum\u003cstring>"},"message":{"type":"string","description":"Human-readable error message.","isRequired":true,"uniqueKey":"oneOf.25.error.message","typeLabel":"string"},"offset":{"type":"string","description":"The cursor at the time of the error (when available). Can be used to resume from this position.","uniqueKey":"oneOf.25.error.offset","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.25.error","typeLabel":"object"}},"additionalProperties":false,"uniqueKey":"oneOf.25","typeLabel":"object"},{"type":"object","description":"The JSON payload delivered in each SSE data line. The type field is injected from the SSE event field by the SDK. Discriminated by type: an event type name for events, \"error\" for errors, and \"offset-only\" for cursor-only heartbeats.","required":["type","offset"],"properties":{"type":{"type":"string","description":"Identifies this as an offset-only heartbeat message (injected from the SSE event field).","enum":["offset-only"],"isRequired":true,"uniqueKey":"oneOf.26.type","typeLabel":"enum\u003cstring>"},"offset":{"type":"string","description":"Opaque cursor representing the latest position in the stream. Pass as the `from` query parameter to resume.","isRequired":true,"uniqueKey":"oneOf.26.offset","typeLabel":"string"}},"additionalProperties":false,"uniqueKey":"oneOf.26","typeLabel":"object"}],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"type":"connection.created","offset":"\u003cstring>","event":{"specversion":"1.0","type":"connection.created","source":"\u003cstring>","id":"\u003cstring>","time":"2023-11-07T05:31:56Z","data":{"object":{"id":"\u003cstring>","name":"\u003cstring>","strategy":"oidc","authentication":{"active":true},"display_name":"\u003cstring>","enabled_clients":["\u003cstring>"],"is_domain_connection":true,"metadata":{},"realms":["\u003cstring>"],"connected_accounts":{"active":true,"cross_app_access":true},"options":{"client_id":"\u003cstring>","authorization_endpoint":"\u003cstring>","connection_settings":{"pkce":"auto"},"domain_aliases":["\u003cstring>"],"dpop_signing_alg":"ES256","federated_connections_access_tokens":{"active":true},"icon_url":"\u003cstring>","id_token_session_expiry_supported":true,"id_token_signed_response_algs":["ES256"],"issuer":"\u003cstring>","jwks_uri":"\u003cstring>","non_persistent_attrs":["\u003cstring>"],"oidc_metadata":{"authorization_endpoint":"\u003cstring>","id_token_signing_alg_values_supported":["\u003cstring>"],"issuer":"\u003cstring>","jwks_uri":"\u003cstring>","acr_values_supported":["\u003cstring>"],"claim_types_supported":["\u003cstring>"],"claims_locales_supported":["\u003cstring>"],"claims_parameter_supported":true,"claims_supported":["\u003cstring>"],"code_challenge_methods_supported":["\u003cstring>"],"display_values_supported":["\u003cstring>"],"dpop_signing_alg_values_supported":["\u003cstring>"],"end_session_endpoint":"\u003cstring>","grant_types_supported":["\u003cstring>"],"id_token_encryption_alg_values_supported":["\u003cstring>"],"id_token_encryption_enc_values_supported":["\u003cstring>"],"op_policy_uri":"\u003cstring>","op_tos_uri":"\u003cstring>","registration_endpoint":"\u003cstring>","request_object_encryption_alg_values_supported":["\u003cstring>"],"request_object_encryption_enc_values_supported":["\u003cstring>"],"request_object_signing_alg_values_supported":["\u003cstring>"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"response_modes_supported":["\u003cstring>"],"response_types_supported":["\u003cstring>"],"scopes_supported":["\u003cstring>"],"service_documentation":"\u003cstring>","subject_types_supported":["\u003cstring>"],"token_endpoint":"\u003cstring>","token_endpoint_auth_methods_supported":["\u003cstring>"],"token_endpoint_auth_signing_alg_values_supported":["\u003cstring>"],"ui_locales_supported":["\u003cstring>"],"userinfo_encryption_alg_values_supported":["\u003cstring>"],"userinfo_encryption_enc_values_supported":["\u003cstring>"],"userinfo_endpoint":"\u003cstring>","userinfo_signing_alg_values_supported":["\u003cstring>"]},"schema_version":"openid-1.0.0","scope":"\u003cstring>","send_back_channel_nonce":true,"set_user_root_attributes":"on_each_login","tenant_domain":"\u003cstring>","token_endpoint":"\u003cstring>","token_endpoint_auth_method":"client_secret_post","token_endpoint_auth_signing_alg":"ES256","token_endpoint_jwtca_aud_format":"issuer","upstream_params":{},"useOauthSpecScope":true,"userinfo_endpoint":"\u003cstring>","attribute_map":{"attributes":{},"userinfo_scope":"\u003cstring>","mapping_mode":"bind_all"},"discovery_url":"\u003cstring>","type":"back_channel"},"show_as_button":true},"previous_object":{"id":"\u003cstring>","name":"\u003cstring>","strategy":"oidc","authentication":{"active":true},"display_name":"\u003cstring>","enabled_clients":["\u003cstring>"],"is_domain_connection":true,"metadata":{},"realms":["\u003cstring>"],"connected_accounts":{"active":true,"cross_app_access":true},"options":{"client_id":"\u003cstring>","authorization_endpoint":"\u003cstring>","connection_settings":{"pkce":"auto"},"domain_aliases":["\u003cstring>"],"dpop_signing_alg":"ES256","federated_connections_access_tokens":{"active":true},"icon_url":"\u003cstring>","id_token_session_expiry_supported":true,"id_token_signed_response_algs":["ES256"],"issuer":"\u003cstring>","jwks_uri":"\u003cstring>","non_persistent_attrs":["\u003cstring>"],"oidc_metadata":{"authorization_endpoint":"\u003cstring>","id_token_signing_alg_values_supported":["\u003cstring>"],"issuer":"\u003cstring>","jwks_uri":"\u003cstring>","acr_values_supported":["\u003cstring>"],"claim_types_supported":["\u003cstring>"],"claims_locales_supported":["\u003cstring>"],"claims_parameter_supported":true,"claims_supported":["\u003cstring>"],"code_challenge_methods_supported":["\u003cstring>"],"display_values_supported":["\u003cstring>"],"dpop_signing_alg_values_supported":["\u003cstring>"],"end_session_endpoint":"\u003cstring>","grant_types_supported":["\u003cstring>"],"id_token_encryption_alg_values_supported":["\u003cstring>"],"id_token_encryption_enc_values_supported":["\u003cstring>"],"op_policy_uri":"\u003cstring>","op_tos_uri":"\u003cstring>","registration_endpoint":"\u003cstring>","request_object_encryption_alg_values_supported":["\u003cstring>"],"request_object_encryption_enc_values_supported":["\u003cstring>"],"request_object_signing_alg_values_supported":["\u003cstring>"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"response_modes_supported":["\u003cstring>"],"response_types_supported":["\u003cstring>"],"scopes_supported":["\u003cstring>"],"service_documentation":"\u003cstring>","subject_types_supported":["\u003cstring>"],"token_endpoint":"\u003cstring>","token_endpoint_auth_methods_supported":["\u003cstring>"],"token_endpoint_auth_signing_alg_values_supported":["\u003cstring>"],"ui_locales_supported":["\u003cstring>"],"userinfo_encryption_alg_values_supported":["\u003cstring>"],"userinfo_encryption_enc_values_supported":["\u003cstring>"],"userinfo_endpoint":"\u003cstring>","userinfo_signing_alg_values_supported":["\u003cstring>"]},"schema_version":"openid-1.0.0","scope":"\u003cstring>","send_back_channel_nonce":true,"set_user_root_attributes":"on_each_login","tenant_domain":"\u003cstring>","token_endpoint":"\u003cstring>","token_endpoint_auth_method":"client_secret_post","token_endpoint_auth_signing_alg":"ES256","token_endpoint_jwtca_aud_format":"issuer","upstream_params":{},"useOauthSpecScope":true,"userinfo_endpoint":"\u003cstring>","attribute_map":{"attributes":{},"userinfo_scope":"\u003cstring>","mapping_mode":"bind_all"},"discovery_url":"\u003cstring>","type":"back_channel"},"show_as_button":true},"context":{"tenant":{"id":"\u003cstring>"},"client":{"id":"\u003cstring>","name":"\u003cstring>","metadata":{}},"connection":{"id":"\u003cstring>","name":"\u003cstring>","strategy":"\u003cstring>"},"request":{"geo":{"continent_code":"\u003cstring>","country_code":"\u003cstring>","country_name":"\u003cstring>","latitude":123,"longitude":123,"subdivision_code":"\u003cstring>","subdivision_name":"\u003cstring>","city_name":"\u003cstring>","time_zone":"\u003cstring>"},"hostname":"\u003cstring>","ip":"\u003cstring>","method":"\u003cstring>","user_agent":"\u003cstring>","custom_domain":"\u003cstring>"}}},"a0tenant":"\u003cstring>","a0stream":"\u003cstring>","a0purpose":"test"}}}},"exampleType":"generated"}},"exampleType":"generated"},"834dee43-b3c0-42b0-b7d8-6e16cb44e467":{"description":"Invalid cursor format.","x-description-1":"Unsupported event type.","x-description-2":"Invalid request query string. The message will vary depending on the cause.","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"c15751c7-6087-418a-86d2-240791d3da4a":{"description":"Invalid token.","x-description-1":"Invalid signature received for JSON Web Token validation.","x-description-2":"Client is not global.","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"ae2fe183-f275-413f-8036-decd38cd8a7b":{"description":"Maximum concurrent event stream connections reached. Please close existing connections.","x-description-1":"Insufficient scope; expected any of: read:events.","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"c492146d-591c-4954-a7fa-41ec8c954c53":{"description":"Not found","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"5f23643c-e040-4623-be9f-919367e3459e":{"description":"Cursor points to data no longer available in the stream.","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"7647a12a-9fd9-4abd-bb59-94cb74a5fb02":{"description":"Too many requests. Check the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers.","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}}},"security":{"2626536f-7648-4d1f-9fa5-3cb499b09ba5":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"jwt","scopes":[]}},"834b514d-f499-45dd-beef-599663c97f8b":{"oAuth2ClientCredentials":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"/oauth/token/","x-form-parameters":{"audience":"/api/v2/"},"scopes":{"create:actions":"Create Actions","read:actions":"Read Actions","update:actions":"Update Actions","delete:actions":"Delete Actions","create:agents":"Create Agents","read:agents":"Read Agents","update:agents":"Update Agents","delete:agents":"Delete Agents","read:anomaly_blocks":"Read Anomaly Blocks","delete:anomaly_blocks":"Delete Anomaly Blocks","read:attack_protection":"Read Attack Protection","update:attack_protection":"Update Attack Protection","create:authentication_methods":"Create Authentication Methods","read:authentication_methods":"Read Authentication Methods","update:authentication_methods":"Update Authentication Methods","delete:authentication_methods":"Delete Authentication Methods","read:branding":"Read Branding","update:branding":"Update Branding","delete:branding":"Delete Branding","create:client_credentials":"Create Client Credentials","read:client_credentials":"Read Client Credentials","update:client_credentials":"Update Client Credentials","delete:client_credentials":"Delete Client Credentials","create:client_grants":"Create Client Grants","read:client_grants":"Read Client Grants","update:client_grants":"Update Client Grants","delete:client_grants":"Delete Client Grants","read:client_keys":"Read Client Keys","update:client_keys":"Update Client Keys","read:client_summary":"Read Client Summary","update:client_token_vault_privileged_access":"Update Client Token Vault Privileged Access","create:clients":"Create Clients","read:clients":"Read Clients","update:clients":"Update Clients","delete:clients":"Delete Clients","create:connection_profiles":"Create Connection Profiles","read:connection_profiles":"Read Connection Profiles","update:connection_profiles":"Update Connection Profiles","delete:connection_profiles":"Delete Connection Profiles","create:connections":"Create Connections","read:connections":"Read Connections","update:connections":"Update Connections","delete:connections":"Delete Connections","create:connections_keys":"Create Connections Keys","read:connections_keys":"Read Connections Keys","update:connections_keys":"Update Connections Keys","read:current_user":"Read Current User","delete:current_user":"Delete Current User","create:current_user_device_credentials":"Create Current User Device Credentials","delete:current_user_device_credentials":"Delete Current User Device Credentials","update:current_user_identities":"Update Current User Identities","update:current_user_metadata":"Update Current User Metadata","create:custom_domains":"Create Custom Domains","read:custom_domains":"Read Custom Domains","update:custom_domains":"Update Custom Domains","delete:custom_domains":"Delete Custom Domains","create:custom_signing_keys":"Create Custom Signing Keys","read:custom_signing_keys":"Read Custom Signing Keys","update:custom_signing_keys":"Update Custom Signing Keys","delete:custom_signing_keys":"Delete Custom Signing Keys","read:device_credentials":"Read Device Credentials","delete:device_credentials":"Delete Device Credentials","create:directory_provisionings":"Create Directory Provisionings","read:directory_provisionings":"Read Directory Provisionings","update:directory_provisionings":"Update Directory Provisionings","delete:directory_provisionings":"Delete Directory Provisionings","create:email_provider":"Create Email Provider","read:email_provider":"Read Email Provider","update:email_provider":"Update Email Provider","delete:email_provider":"Delete Email Provider","create:email_templates":"Create Email Templates","read:email_templates":"Read Email Templates","update:email_templates":"Update Email Templates","create:encryption_keys":"Create Encryption Keys","read:encryption_keys":"Read Encryption Keys","update:encryption_keys":"Update Encryption Keys","delete:encryption_keys":"Delete Encryption Keys","read:event_deliveries":"Read Event Deliveries","update:event_deliveries":"Update Event Deliveries","create:event_streams":"Create Event Streams","read:event_streams":"Read Event Streams","update:event_streams":"Update Event Streams","delete:event_streams":"Delete Event Streams","read:events":"Read Events","create:experimentation":"Create Experimentation","read:experimentation":"Read Experimentation","update:experimentation":"Update Experimentation","delete:experimentation":"Delete Experimentation","create:flows":"Create Flows","read:flows":"Read Flows","update:flows":"Update Flows","delete:flows":"Delete Flows","read:flows_executions":"Read Flows Executions","delete:flows_executions":"Delete Flows Executions","create:flows_vault_connections":"Create Flows Vault Connections","read:flows_vault_connections":"Read Flows Vault Connections","update:flows_vault_connections":"Update Flows Vault Connections","delete:flows_vault_connections":"Delete Flows Vault Connections","create:forms":"Create Forms","read:forms":"Read Forms","update:forms":"Update Forms","delete:forms":"Delete Forms","read:grants":"Read Grants","delete:grants":"Delete Grants","read:group_members":"Read Group Members","create:group_roles":"Create Group Roles","read:group_roles":"Read Group Roles","delete:group_roles":"Delete Group Roles","read:groups":"Read Groups","delete:groups":"Delete Groups","create:guardian_enrollment_tickets":"Create Guardian Enrollment Tickets","read:guardian_enrollments":"Read Guardian Enrollments","delete:guardian_enrollments":"Delete Guardian Enrollments","read:guardian_factors":"Read Guardian Factors","update:guardian_factors":"Update Guardian Factors","create:hooks":"Create Hooks","read:hooks":"Read Hooks","update:hooks":"Update Hooks","delete:hooks":"Delete Hooks","create:log_streams":"Create Log Streams","read:log_streams":"Read Log Streams","update:log_streams":"Update Log Streams","delete:log_streams":"Delete Log Streams","read:logs":"Read Logs","read:logs_users":"Read Logs Users","read:mfa_policies":"Read Mfa Policies","update:mfa_policies":"Update Mfa Policies","create:network_acls":"Create Network Acls","read:network_acls":"Read Network Acls","update:network_acls":"Update Network Acls","delete:network_acls":"Delete Network Acls","create:organization_client_grants":"Create Organization Client Grants","read:organization_client_grants":"Read Organization Client Grants","delete:organization_client_grants":"Delete Organization Client Grants","create:organization_connections":"Create Organization Connections","read:organization_connections":"Read Organization Connections","update:organization_connections":"Update Organization Connections","delete:organization_connections":"Delete Organization Connections","create:organization_discovery_domains":"Create Organization Discovery Domains","read:organization_discovery_domains":"Read Organization Discovery Domains","update:organization_discovery_domains":"Update Organization Discovery Domains","delete:organization_discovery_domains":"Delete Organization Discovery Domains","create:organization_group_roles":"Create Organization Group Roles","read:organization_group_roles":"Read Organization Group Roles","delete:organization_group_roles":"Delete Organization Group Roles","read:organization_groups":"Read Organization Groups","create:organization_invitations":"Create Organization Invitations","read:organization_invitations":"Read Organization Invitations","delete:organization_invitations":"Delete Organization Invitations","read:organization_member_effective_roles":"Read Organization Member Effective Roles","read:organization_member_role_source_groups":"Read Organization Member Role Source Groups","create:organization_member_roles":"Create Organization Member Roles","read:organization_member_roles":"Read Organization Member Roles","delete:organization_member_roles":"Delete Organization Member Roles","create:organization_members":"Create Organization Members","read:organization_members":"Read Organization Members","delete:organization_members":"Delete Organization Members","create:organizations":"Create Organizations","read:organizations":"Read Organizations","update:organizations":"Update Organizations","delete:organizations":"Delete Organizations","read:organizations_summary":"Read Organizations Summary","create:phone_providers":"Create Phone Providers","read:phone_providers":"Read Phone Providers","update:phone_providers":"Update Phone Providers","delete:phone_providers":"Delete Phone Providers","create:phone_templates":"Create Phone Templates","read:phone_templates":"Read Phone Templates","update:phone_templates":"Update Phone Templates","delete:phone_templates":"Delete Phone Templates","read:prompts":"Read Prompts","update:prompts":"Update Prompts","create:rate_limit_policies":"Create Rate Limit Policies","read:rate_limit_policies":"Read Rate Limit Policies","update:rate_limit_policies":"Update Rate Limit Policies","delete:rate_limit_policies":"Delete Rate Limit Policies","read:refresh_tokens":"Read Refresh Tokens","update:refresh_tokens":"Update Refresh Tokens","delete:refresh_tokens":"Delete Refresh Tokens","create:resource_servers":"Create Resource Servers","read:resource_servers":"Read Resource Servers","update:resource_servers":"Update Resource Servers","delete:resource_servers":"Delete Resource Servers","create:role_members":"Create Role Members","read:role_members":"Read Role Members","delete:role_members":"Delete Role Members","create:roles":"Create Roles","read:roles":"Read Roles","update:roles":"Update Roles","delete:roles":"Delete Roles","create:rules":"Create Rules","read:rules":"Read Rules","update:rules":"Update Rules","delete:rules":"Delete Rules","read:rules_configs":"Read Rules Configs","update:rules_configs":"Update Rules Configs","delete:rules_configs":"Delete Rules Configs","create:scim_config":"Create Scim Config","read:scim_config":"Read Scim Config","update:scim_config":"Update Scim Config","delete:scim_config":"Delete Scim Config","create:scim_token":"Create Scim Token","read:scim_token":"Read Scim Token","delete:scim_token":"Delete Scim Token","read:self_service_profile_custom_texts":"Read Self Service Profile Custom Texts","update:self_service_profile_custom_texts":"Update Self Service Profile Custom Texts","create:self_service_profiles":"Create Self Service Profiles","read:self_service_profiles":"Read Self Service Profiles","update:self_service_profiles":"Update Self Service Profiles","delete:self_service_profiles":"Delete Self Service Profiles","read:sessions":"Read Sessions","update:sessions":"Update Sessions","delete:sessions":"Delete Sessions","create:signing_keys":"Create Signing Keys","read:signing_keys":"Read Signing Keys","update:signing_keys":"Update Signing Keys","create:sso_access_tickets":"Create Sso Access Tickets","delete:sso_access_tickets":"Delete Sso Access Tickets","read:stats":"Read Stats","read:tenant_settings":"Read Tenant Settings","update:tenant_settings":"Update Tenant Settings","create:token_exchange_profiles":"Create Token Exchange Profiles","read:token_exchange_profiles":"Read Token Exchange Profiles","update:token_exchange_profiles":"Update Token Exchange Profiles","delete:token_exchange_profiles":"Delete Token Exchange Profiles","create:user_attribute_profiles":"Create User Attribute Profiles","read:user_attribute_profiles":"Read User Attribute Profiles","update:user_attribute_profiles":"Update User Attribute Profiles","delete:user_attribute_profiles":"Delete User Attribute Profiles","read:user_effective_permissions":"Read User Effective Permissions","read:user_effective_roles":"Read User Effective Roles","read:user_idp_tokens":"Read User Idp Tokens","read:user_permission_source_roles":"Read User Permission Source Roles","read:user_role_source_groups":"Read User Role Source Groups","create:user_tickets":"Create User Tickets","create:users":"Create Users","read:users":"Read Users","update:users":"Update Users","delete:users":"Delete Users","update:users_app_metadata":"Update Users App Metadata","create:vdcs_templates":"Create Vdcs Templates","read:vdcs_templates":"Read Vdcs Templates","update:vdcs_templates":"Update Vdcs Templates","delete:vdcs_templates":"Delete Vdcs Templates","create:organization_clients":"Create Organization Client Associations","read:organization_clients":"Read Organization Client Associations","update:organization_clients":"Update Organization Client Associations","delete:organization_clients":"Delete Organization Client Associations","read:organization_templates":"Read Organization Templates","create:network_acl_keys":"Create Network ACL Keys","read:network_acl_keys":"Read Network ACL Keys","delete:network_acl_keys":"Delete Network ACL Keys"}}},"scopes":["read:events"]}}},"servers":{"b2b1a7fc-9688-4dde-b7d3-813d0407078c":{"url":"https://{tenantDomain}/api/v2","variables":{"tenantDomain":{"default":"{TENANT}.auth0.com","description":"Auth0 Tenant Domain"}}}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","bearerFormat":"jwt","scopes":[]},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"Bearer authentication header of the form `Bearer \u003ctoken>`, where `\u003ctoken>` is your auth token.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"bearerAuth","name":"Authorization"}],"title":"bearerAuth"},{"schemes":[{"scheme":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"/oauth/token/","x-form-parameters":{"audience":"/api/v2/"},"scopes":{"create:actions":"Create Actions","read:actions":"Read Actions","update:actions":"Update Actions","delete:actions":"Delete Actions","create:agents":"Create Agents","read:agents":"Read Agents","update:agents":"Update Agents","delete:agents":"Delete Agents","read:anomaly_blocks":"Read Anomaly Blocks","delete:anomaly_blocks":"Delete Anomaly Blocks","read:attack_protection":"Read Attack Protection","update:attack_protection":"Update Attack Protection","create:authentication_methods":"Create Authentication Methods","read:authentication_methods":"Read Authentication Methods","update:authentication_methods":"Update Authentication Methods","delete:authentication_methods":"Delete Authentication Methods","read:branding":"Read Branding","update:branding":"Update Branding","delete:branding":"Delete Branding","create:client_credentials":"Create Client Credentials","read:client_credentials":"Read Client Credentials","update:client_credentials":"Update Client Credentials","delete:client_credentials":"Delete Client Credentials","create:client_grants":"Create Client Grants","read:client_grants":"Read Client Grants","update:client_grants":"Update Client Grants","delete:client_grants":"Delete Client Grants","read:client_keys":"Read Client Keys","update:client_keys":"Update Client Keys","read:client_summary":"Read Client Summary","update:client_token_vault_privileged_access":"Update Client Token Vault Privileged Access","create:clients":"Create Clients","read:clients":"Read Clients","update:clients":"Update Clients","delete:clients":"Delete Clients","create:connection_profiles":"Create Connection Profiles","read:connection_profiles":"Read Connection Profiles","update:connection_profiles":"Update Connection Profiles","delete:connection_profiles":"Delete Connection Profiles","create:connections":"Create Connections","read:connections":"Read Connections","update:connections":"Update Connections","delete:connections":"Delete Connections","create:connections_keys":"Create Connections Keys","read:connections_keys":"Read Connections Keys","update:connections_keys":"Update Connections Keys","read:current_user":"Read Current User","delete:current_user":"Delete Current User","create:current_user_device_credentials":"Create Current User Device Credentials","delete:current_user_device_credentials":"Delete Current User Device Credentials","update:current_user_identities":"Update Current User Identities","update:current_user_metadata":"Update Current User Metadata","create:custom_domains":"Create Custom Domains","read:custom_domains":"Read Custom Domains","update:custom_domains":"Update Custom Domains","delete:custom_domains":"Delete Custom Domains","create:custom_signing_keys":"Create Custom Signing Keys","read:custom_signing_keys":"Read Custom Signing Keys","update:custom_signing_keys":"Update Custom Signing Keys","delete:custom_signing_keys":"Delete Custom Signing Keys","read:device_credentials":"Read Device Credentials","delete:device_credentials":"Delete Device Credentials","create:directory_provisionings":"Create Directory Provisionings","read:directory_provisionings":"Read Directory Provisionings","update:directory_provisionings":"Update Directory Provisionings","delete:directory_provisionings":"Delete Directory Provisionings","create:email_provider":"Create Email Provider","read:email_provider":"Read Email Provider","update:email_provider":"Update Email Provider","delete:email_provider":"Delete Email Provider","create:email_templates":"Create Email Templates","read:email_templates":"Read Email Templates","update:email_templates":"Update Email Templates","create:encryption_keys":"Create Encryption Keys","read:encryption_keys":"Read Encryption Keys","update:encryption_keys":"Update Encryption Keys","delete:encryption_keys":"Delete Encryption Keys","read:event_deliveries":"Read Event Deliveries","update:event_deliveries":"Update Event Deliveries","create:event_streams":"Create Event Streams","read:event_streams":"Read Event Streams","update:event_streams":"Update Event Streams","delete:event_streams":"Delete Event Streams","read:events":"Read Events","create:experimentation":"Create Experimentation","read:experimentation":"Read Experimentation","update:experimentation":"Update Experimentation","delete:experimentation":"Delete Experimentation","create:flows":"Create Flows","read:flows":"Read Flows","update:flows":"Update Flows","delete:flows":"Delete Flows","read:flows_executions":"Read Flows Executions","delete:flows_executions":"Delete Flows Executions","create:flows_vault_connections":"Create Flows Vault Connections","read:flows_vault_connections":"Read Flows Vault Connections","update:flows_vault_connections":"Update Flows Vault Connections","delete:flows_vault_connections":"Delete Flows Vault Connections","create:forms":"Create Forms","read:forms":"Read Forms","update:forms":"Update Forms","delete:forms":"Delete Forms","read:grants":"Read Grants","delete:grants":"Delete Grants","read:group_members":"Read Group Members","create:group_roles":"Create Group Roles","read:group_roles":"Read Group Roles","delete:group_roles":"Delete Group Roles","read:groups":"Read Groups","delete:groups":"Delete Groups","create:guardian_enrollment_tickets":"Create Guardian Enrollment Tickets","read:guardian_enrollments":"Read Guardian Enrollments","delete:guardian_enrollments":"Delete Guardian Enrollments","read:guardian_factors":"Read Guardian Factors","update:guardian_factors":"Update Guardian Factors","create:hooks":"Create Hooks","read:hooks":"Read Hooks","update:hooks":"Update Hooks","delete:hooks":"Delete Hooks","create:log_streams":"Create Log Streams","read:log_streams":"Read Log Streams","update:log_streams":"Update Log Streams","delete:log_streams":"Delete Log Streams","read:logs":"Read Logs","read:logs_users":"Read Logs Users","read:mfa_policies":"Read Mfa Policies","update:mfa_policies":"Update Mfa Policies","create:network_acls":"Create Network Acls","read:network_acls":"Read Network Acls","update:network_acls":"Update Network Acls","delete:network_acls":"Delete Network Acls","create:organization_client_grants":"Create Organization Client Grants","read:organization_client_grants":"Read Organization Client Grants","delete:organization_client_grants":"Delete Organization Client Grants","create:organization_connections":"Create Organization Connections","read:organization_connections":"Read Organization Connections","update:organization_connections":"Update Organization Connections","delete:organization_connections":"Delete Organization Connections","create:organization_discovery_domains":"Create Organization Discovery Domains","read:organization_discovery_domains":"Read Organization Discovery Domains","update:organization_discovery_domains":"Update Organization Discovery Domains","delete:organization_discovery_domains":"Delete Organization Discovery Domains","create:organization_group_roles":"Create Organization Group Roles","read:organization_group_roles":"Read Organization Group Roles","delete:organization_group_roles":"Delete Organization Group Roles","read:organization_groups":"Read Organization Groups","create:organization_invitations":"Create Organization Invitations","read:organization_invitations":"Read Organization Invitations","delete:organization_invitations":"Delete Organization Invitations","read:organization_member_effective_roles":"Read Organization Member Effective Roles","read:organization_member_role_source_groups":"Read Organization Member Role Source Groups","create:organization_member_roles":"Create Organization Member Roles","read:organization_member_roles":"Read Organization Member Roles","delete:organization_member_roles":"Delete Organization Member Roles","create:organization_members":"Create Organization Members","read:organization_members":"Read Organization Members","delete:organization_members":"Delete Organization Members","create:organizations":"Create Organizations","read:organizations":"Read Organizations","update:organizations":"Update Organizations","delete:organizations":"Delete Organizations","read:organizations_summary":"Read Organizations Summary","create:phone_providers":"Create Phone Providers","read:phone_providers":"Read Phone Providers","update:phone_providers":"Update Phone Providers","delete:phone_providers":"Delete Phone Providers","create:phone_templates":"Create Phone Templates","read:phone_templates":"Read Phone Templates","update:phone_templates":"Update Phone Templates","delete:phone_templates":"Delete Phone Templates","read:prompts":"Read Prompts","update:prompts":"Update Prompts","create:rate_limit_policies":"Create Rate Limit Policies","read:rate_limit_policies":"Read Rate Limit Policies","update:rate_limit_policies":"Update Rate Limit Policies","delete:rate_limit_policies":"Delete Rate Limit Policies","read:refresh_tokens":"Read Refresh Tokens","update:refresh_tokens":"Update Refresh Tokens","delete:refresh_tokens":"Delete Refresh Tokens","create:resource_servers":"Create Resource Servers","read:resource_servers":"Read Resource Servers","update:resource_servers":"Update Resource Servers","delete:resource_servers":"Delete Resource Servers","create:role_members":"Create Role Members","read:role_members":"Read Role Members","delete:role_members":"Delete Role Members","create:roles":"Create Roles","read:roles":"Read Roles","update:roles":"Update Roles","delete:roles":"Delete Roles","create:rules":"Create Rules","read:rules":"Read Rules","update:rules":"Update Rules","delete:rules":"Delete Rules","read:rules_configs":"Read Rules Configs","update:rules_configs":"Update Rules Configs","delete:rules_configs":"Delete Rules Configs","create:scim_config":"Create Scim Config","read:scim_config":"Read Scim Config","update:scim_config":"Update Scim Config","delete:scim_config":"Delete Scim Config","create:scim_token":"Create Scim Token","read:scim_token":"Read Scim Token","delete:scim_token":"Delete Scim Token","read:self_service_profile_custom_texts":"Read Self Service Profile Custom Texts","update:self_service_profile_custom_texts":"Update Self Service Profile Custom Texts","create:self_service_profiles":"Create Self Service Profiles","read:self_service_profiles":"Read Self Service Profiles","update:self_service_profiles":"Update Self Service Profiles","delete:self_service_profiles":"Delete Self Service Profiles","read:sessions":"Read Sessions","update:sessions":"Update Sessions","delete:sessions":"Delete Sessions","create:signing_keys":"Create Signing Keys","read:signing_keys":"Read Signing Keys","update:signing_keys":"Update Signing Keys","create:sso_access_tickets":"Create Sso Access Tickets","delete:sso_access_tickets":"Delete Sso Access Tickets","read:stats":"Read Stats","read:tenant_settings":"Read Tenant Settings","update:tenant_settings":"Update Tenant Settings","create:token_exchange_profiles":"Create Token Exchange Profiles","read:token_exchange_profiles":"Read Token Exchange Profiles","update:token_exchange_profiles":"Update Token Exchange Profiles","delete:token_exchange_profiles":"Delete Token Exchange Profiles","create:user_attribute_profiles":"Create User Attribute Profiles","read:user_attribute_profiles":"Read User Attribute Profiles","update:user_attribute_profiles":"Update User Attribute Profiles","delete:user_attribute_profiles":"Delete User Attribute Profiles","read:user_effective_permissions":"Read User Effective Permissions","read:user_effective_roles":"Read User Effective Roles","read:user_idp_tokens":"Read User Idp Tokens","read:user_permission_source_roles":"Read User Permission Source Roles","read:user_role_source_groups":"Read User Role Source Groups","create:user_tickets":"Create User Tickets","create:users":"Create Users","read:users":"Read Users","update:users":"Update Users","delete:users":"Delete Users","update:users_app_metadata":"Update Users App Metadata","create:vdcs_templates":"Create Vdcs Templates","read:vdcs_templates":"Read Vdcs Templates","update:vdcs_templates":"Update Vdcs Templates","delete:vdcs_templates":"Delete Vdcs Templates","create:organization_clients":"Create Organization Client Associations","read:organization_clients":"Read Organization Client Associations","update:organization_clients":"Update Organization Client Associations","delete:organization_clients":"Delete Organization Client Associations","read:organization_templates":"Read Organization Templates","create:network_acl_keys":"Create Network ACL Keys","read:network_acl_keys":"Read Network ACL Keys","delete:network_acl_keys":"Delete Network ACL Keys"}}},"scopes":["read:events"]},"schema":{"title":"OAuth2 Auth","type":"string","isRequired":true,"description":"The access token received from the authorization server in the OAuth 2.0 flow.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"oAuth2ClientCredentials","name":"Authorization"}],"title":"oAuth2ClientCredentials"}]},"originalFileLocation":"docs/oas/management/v2/management-api-oas.json"},"subdomain":"docs-staging","siteName":"Auth0 Docs","title":"Subscribe to events via Server-Sent Events (SSE) - Auth0 Docs","relatedPagesConfig":{"enabled":true,"limit":5,"mode":"manual"},"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{"en":{"href":"/docs/api/management/v2/events/subscribe-events","matchLevel":0},"fr":{"href":"/docs/fr-ca/api/management/v2/events/subscribe-events","matchLevel":1},"ja":{"href":"/docs/ja-jp/api/management/v2/events/subscribe-events","matchLevel":1}}},"lastModified":"2026-05-07T20:56:02.228Z","originalFileLocation":"docs/api/management/v2/events/subscribe-events.mdx","locale":"en"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Subscribe to events via Server-Sent Events (SSE)\">\u003cmeta data-mint-head name=\"application-name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/svg+xml\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"icon\" type=\"image/svg+xml\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"icon\" type=\"image/svg+xml\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/svg+xml\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/favicon.svg\">\u003cmeta data-mint-head property=\"og:title\" content=\"Subscribe to events via Server-Sent Events (SSE) - Auth0 Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Subscribe to events via Server-Sent Events (SSE)\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://auth0.com/docs/api/management/v2/events/subscribe-events\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://docs-staging.mintlify.app/docs/images/share-image.png\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Subscribe to events via Server-Sent Events (SSE) - Auth0 Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Subscribe to events via Server-Sent Events (SSE)\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://docs-staging.mintlify.app/docs/images/share-image.png\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#9921FE\">\u003clink data-mint-head rel=\"canonical\" href=\"https://auth0.com/docs/api/management/v2/events/subscribe-events\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/api/management/v2/events/subscribe-events.md\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"en\" href=\"https://auth0.com/docs/api/management/v2/events/subscribe-events\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"fr\" href=\"https://auth0.com/docs/fr-ca/api/management/v2/events/subscribe-events\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"ja\" href=\"https://auth0.com/docs/ja-jp/api/management/v2/events/subscribe-events\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"x-default\" href=\"https://auth0.com/docs/api/management/v2/events/subscribe-events\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://auth0.com/#organization\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://auth0.com#website\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0.com\",\"publisher\":{\"@id\":\"https://auth0.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events#webpage\",\"url\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events\",\"name\":\"Subscribe to events via Server-Sent Events (SSE)\",\"description\":\"Subscribe to events via Server-Sent Events (SSE)\",\"dateModified\":\"2026-05-07T20:56:02.228Z\",\"isPartOf\":{\"@id\":\"https://auth0.com#website\"},\"breadcrumb\":{\"@id\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Management API\",\"item\":\"https://auth0.com/docs/api/management/v2\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Subscribe to events via Server-Sent Events (SSE)\",\"item\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events#apireference\",\"headline\":\"Subscribe to events via Server-Sent Events (SSE)\",\"name\":\"Subscribe to events via Server-Sent Events (SSE)\",\"description\":\"Subscribe to events via Server-Sent Events (SSE)\",\"url\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events\",\"mainEntityOfPage\":{\"@id\":\"https://auth0.com/docs/api/management/v2/events/subscribe-events#webpage\"},\"image\":\"https://auth0.com/docs/images/share-image.png\",\"dateModified\":\"2026-05-07T20:56:02.228Z\",\"publisher\":{\"@id\":\"https://auth0.com/#organization\"},\"isPartOf\":{\"@id\":\"https://auth0.com#website\"}}]}\u003c/script>","siteName":"Auth0 Docs","nav":{"global":null,"languages":[{"language":"en","tabs":[{"tab":"Home","pages":[{"title":"Home","href":"/docs"}]},{"tab":"Get Started","icon":"play","directory":"accordion","pages":[{"title":"Get Started","href":"/docs/get-started"}]},{"tab":"Authenticate","icon":"lock-keyhole","pages":[{"title":"Authenticate","href":"/docs/authenticate"}]},{"tab":"Manage Users","icon":"user-group","pages":[{"title":"Manage Users","href":"/docs/manage-users"}]},{"tab":"Customize","icon":"layer-group","pages":[{"title":"Customize","href":"/docs/customize"}]},{"tab":"Secure","icon":"shield-check","pages":[{"title":"Secure","href":"/docs/secure"}]},{"tab":"Deploy \u0026 Monitor","icon":"chart-simple","pages":[{"title":"Deploy \u0026 Monitor","href":"/docs/deploy-monitor"}]},{"tab":"AI Agents \u0026 MCP","icon":"robot","menu":[{"item":"Agent as Principal","icon":"address-card","pages":[{"title":"Agent as Principal","href":"/docs/ai-agents-mcp/agent-as-principal"}]},{"item":"Cross App Access (XAA)","icon":"arrows-cross","pages":[{"title":"Cross App Access (XAA)","href":"/docs/ai-agents-mcp/cross-app-access"}]}],"pages":[{"title":"AI Agents \u0026 MCP","href":"/docs/ai-agents-mcp/agent-as-principal"}]},{"tab":"Platform","icon":"credit-card","pages":[{"title":"Platform","href":"/docs/troubleshoot"}]},{"tab":"Dev Tools","icon":"code-simple","menu":[{"item":"APIs","icon":"code-pull-request","groups":[{"group":" ","pages":[{"title":"Auth0 APIs","mode":"wide","href":"/docs/api"}]},{"group":"My Account API","icon":"list","root":{"title":"My Account API Reference","href":"/docs/api/myaccount"},"pages":[{"group":"Factors","pages":[{"openapi":"docs/oas/myaccount/myaccount-api-oas.json GET /factors","playground":"simple","deprecated":false,"title":"Get the status of all factors","href":"/docs/api/myaccount/factors/get-factors"}]},{"group":"Authentication Methods","pages":[{"openapi":"docs/oas/myaccount/myaccount-api-oas.json GET /authentication-methods","playground":"simple","deprecated":false,"title":"Get a list of authentication methods","href":"/docs/api/myaccount/authentication-methods/get-authentication-methods"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json POST /authentication-methods","playground":"simple","deprecated":false,"title":"Start the enrollment of a supported authentication method.","href":"/docs/api/myaccount/authentication-methods/create-authentication-method"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json GET /authentication-methods/{authentication_method_id}","playground":"simple","deprecated":false,"title":"Get an authentication method by ID","href":"/docs/api/myaccount/authentication-methods/get-authentication-method"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json DELETE /authentication-methods/{authentication_method_id}","playground":"simple","deprecated":false,"title":"Delete an authentication method by ID","href":"/docs/api/myaccount/authentication-methods/delete-authentication-method"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json PATCH /authentication-methods/{authentication_method_id}","playground":"simple","deprecated":false,"title":"Update details of an authentication method by ID","href":"/docs/api/myaccount/authentication-methods/update-authentication-method"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json POST /authentication-methods/{authentication_method_id}/verify","playground":"simple","deprecated":false,"title":"Confirm the enrollment of a supported authentication method.","href":"/docs/api/myaccount/authentication-methods/confirm-authentication-method"}]},{"group":"Connected Accounts","pages":[{"openapi":"docs/oas/myaccount/myaccount-api-oas.json POST /connected-accounts/connect","playground":"simple","deprecated":false,"title":"Create a connected account request","href":"/docs/api/myaccount/connected-accounts/create-connected-account-request"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json POST /connected-accounts/complete","playground":"simple","deprecated":false,"title":"Complete a connected account request","href":"/docs/api/myaccount/connected-accounts/complete-connected-account-request"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json GET /connected-accounts/accounts","playground":"simple","deprecated":false,"title":"Get a list of connected accounts","href":"/docs/api/myaccount/connected-accounts/get-connected-accounts"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json GET /connected-accounts/connections","playground":"simple","deprecated":false,"title":"Get a list of available connections for connected accounts","href":"/docs/api/myaccount/connected-accounts/get-connected-accounts-connections"},{"openapi":"docs/oas/myaccount/myaccount-api-oas.json DELETE /connected-accounts/accounts/{id}","playground":"simple","deprecated":false,"title":"Delete a connected account by ID","href":"/docs/api/myaccount/connected-accounts/delete-connected-account"}]}]},{"group":"My Organization API","icon":"list","root":{"title":"My Organization API Reference","href":"/docs/api/myorganization"},"pages":[{"group":"Organization Details Management","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /","playground":"simple","deprecated":false,"title":"Delete this Organization","href":"/docs/api/myorganization/org-details/delete-my-organization"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /details","playground":"simple","deprecated":false,"title":"Get Organization details","href":"/docs/api/myorganization/org-details/get-organization-details"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json PATCH /details","playground":"simple","deprecated":false,"title":"Update Organization details","href":"/docs/api/myorganization/org-details/update-organization-details"}]},{"group":"Configuration","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /config","playground":"simple","deprecated":false,"title":"Get My Organization API configuration","href":"/docs/api/myorganization/config/get-org-configuration"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /config/identity-providers","playground":"simple","deprecated":false,"title":"Get Identity Provider configuration","href":"/docs/api/myorganization/config/get-idp-configuration"}]},{"group":"Domain Management","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /domains","playground":"simple","deprecated":false,"title":"List domains","href":"/docs/api/myorganization/org-domain-management/list-organization-domains"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /domains","playground":"simple","deprecated":false,"title":"Create a domain","href":"/docs/api/myorganization/org-domain-management/create-organization-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /domains/{domain_id}","playground":"simple","deprecated":false,"title":"Get a domain","href":"/docs/api/myorganization/org-domain-management/get-organization-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /domains/{domain_id}","playground":"simple","deprecated":false,"title":"Delete a domain","href":"/docs/api/myorganization/org-domain-management/delete-organization-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /domains/{domain_id}/verify","playground":"simple","deprecated":false,"title":"Start domain verification","href":"/docs/api/myorganization/org-domain-management/create-organization-domain-verification"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /domains/{domain_id}/identity-providers","playground":"simple","deprecated":false,"title":"List Identity Providers for a domain","href":"/docs/api/myorganization/org-domain-management/get-organization-domain-identity-providers"}]},{"group":"Identity Provider Management","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /identity-providers","playground":"simple","deprecated":false,"title":"List Identity Providers","href":"/docs/api/myorganization/idp-management/list-organization-identity-providers"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /identity-providers","playground":"simple","deprecated":false,"title":"Create an Identity Provider","href":"/docs/api/myorganization/idp-management/create-organization-identity-provider"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /identity-providers/{idp_id}","playground":"simple","deprecated":false,"title":"Get an Identity Provider","href":"/docs/api/myorganization/idp-management/get-organization-identity-provider"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json PATCH /identity-providers/{idp_id}","playground":"simple","deprecated":false,"title":"Update an Identity Provider","href":"/docs/api/myorganization/idp-management/update-organization-identity-provider"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /identity-providers/{idp_id}","playground":"simple","deprecated":false,"title":"Delete an Identity Provider","href":"/docs/api/myorganization/idp-management/delete-organization-identity-provider"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json PUT /identity-providers/{idp_id}/update-attributes","playground":"simple","deprecated":false,"title":"Refresh Identity Provider attribute mapping","href":"/docs/api/myorganization/idp-management/update-organization-identity-provider-attributes"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /identity-providers/{idp_id}/detach","playground":"simple","deprecated":false,"title":"Detach Identity Provider","href":"/docs/api/myorganization/idp-management/detach-organization-identity-provider-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /identity-providers/{idp_id}/domains","playground":"simple","deprecated":false,"title":"Associate a domain with an Identity Provider","href":"/docs/api/myorganization/idp-management/create-organization-identity-provider-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /identity-providers/{idp_id}/domains/{domain}","playground":"simple","deprecated":false,"title":"Remove a domain from an Identity Provider","href":"/docs/api/myorganization/idp-management/delete-organization-identity-provider-domain"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /identity-providers/{idp_id}/provisioning","playground":"simple","deprecated":false,"title":"Get a Provisioning Configuration","href":"/docs/api/myorganization/idp-management/get-idp-provisioning-configuration"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /identity-providers/{idp_id}/provisioning","playground":"simple","deprecated":false,"title":"Create a Provisioning Configuration","href":"/docs/api/myorganization/idp-management/create-idp-provisioning-configuration"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /identity-providers/{idp_id}/provisioning","playground":"simple","deprecated":false,"title":"Delete a Provisioning Configuration","href":"/docs/api/myorganization/idp-management/delete-provisioning-configuration"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json PUT /identity-providers/{idp_id}/provisioning/update-attributes","playground":"simple","deprecated":false,"title":"Refresh Provisioning Configuration attribute mapping","href":"/docs/api/myorganization/idp-management/update-idp-provisioning-configuration-attributes"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /identity-providers/{idp_id}/provisioning/scim-tokens","playground":"simple","deprecated":false,"title":"List Provisioning SCIM tokens","href":"/docs/api/myorganization/idp-management/list-idp-provisioning-scim-tokens"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /identity-providers/{idp_id}/provisioning/scim-tokens","playground":"simple","deprecated":false,"title":"Create a Provisioning SCIM token","href":"/docs/api/myorganization/idp-management/create-idp-provisioning-scim-token"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /identity-providers/{idp_id}/provisioning/scim-tokens/{idp_scim_token_id}","playground":"simple","deprecated":false,"title":"Revoke a Provisioning SCIM token","href":"/docs/api/myorganization/idp-management/delete-idp-provisioning-scim-token"}]},{"group":"Member Management","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /members","playground":"simple","deprecated":false,"title":"List members","href":"/docs/api/myorganization/org-member-management/list-organization-members"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /members/{user_id}","playground":"simple","deprecated":false,"title":"Get a member","href":"/docs/api/myorganization/org-member-management/get-organization-member"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /delete-memberships","playground":"simple","deprecated":false,"title":"Delete memberships","href":"/docs/api/myorganization/org-member-management/delete-organization-memberships"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /member-invitations","playground":"simple","deprecated":false,"title":"List member invitations","href":"/docs/api/myorganization/org-member-management/list-invitations"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /member-invitations","playground":"simple","deprecated":false,"title":"Create member invitations","href":"/docs/api/myorganization/org-member-management/create-invitations"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /delete-member-invitations","playground":"simple","deprecated":false,"title":"Revoke member invitations","href":"/docs/api/myorganization/org-member-management/delete-invitations"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /member-invitations/{invitation_id}","playground":"simple","deprecated":false,"title":"Get a member invitation","href":"/docs/api/myorganization/org-member-management/get-invitation"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /member-invitations/{invitation_id}","playground":"simple","deprecated":false,"title":"Revoke a member invitation","href":"/docs/api/myorganization/org-member-management/delete-invitation"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /members/{user_id}/roles","playground":"simple","deprecated":false,"title":"List member roles","href":"/docs/api/myorganization/org-member-management/list-org-member-roles"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /members/{user_id}/roles","playground":"simple","deprecated":false,"title":"Assign roles to a member","href":"/docs/api/myorganization/org-member-management/assign-organization-member-roles"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json DELETE /members/{user_id}/roles","playground":"simple","deprecated":false,"title":"Remove roles from a member","href":"/docs/api/myorganization/org-member-management/unassign-organization-member-roles-legacy"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json POST /members/{user_id}/unassign-roles","playground":"simple","deprecated":false,"title":"Remove roles from a member","href":"/docs/api/myorganization/org-member-management/unassign-organization-member-roles"},{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /member-invitations/{invitation_id}/roles","playground":"simple","deprecated":false,"title":"List roles for a member invitation","href":"/docs/api/myorganization/org-member-management/list-member-invitation-roles"}]},{"group":"Roles","pages":[{"openapi":"docs/oas/myorganization/myorganization-api-oas.json GET /roles","playground":"simple","deprecated":false,"title":"List roles","href":"/docs/api/myorganization/roles/list-roles"}]}]},{"group":"Management API","icon":"list","root":{"title":"Management API Reference","href":"/docs/api/management/v2"},"pages":[{"group":"Actions","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/actions","playground":"interactive","deprecated":false,"title":"Get actions","href":"/docs/api/management/v2/actions/get-actions"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/actions","playground":"interactive","deprecated":false,"title":"Create an action","href":"/docs/api/management/v2/actions/post-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/actions/{actionId}/versions","playground":"interactive","deprecated":false,"title":"Get an action's versions","href":"/docs/api/management/v2/actions/get-action-versions"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/actions/{actionId}/versions/{id}","playground":"interactive","deprecated":false,"title":"Get a specific version of an action","href":"/docs/api/management/v2/actions/get-action-version"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/actions/{actionId}/versions/{id}/deploy","playground":"interactive","deprecated":false,"title":"Roll back to a previous action version","href":"/docs/api/management/v2/actions/post-deploy-draft-version"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/actions/{id}","playground":"interactive","deprecated":false,"title":"Get an action","href":"/docs/api/management/v2/actions/get-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /actions/actions/{id}","playground":"interactive","deprecated":false,"title":"Delete an action","href":"/docs/api/management/v2/actions/delete-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /actions/actions/{id}","playground":"interactive","deprecated":false,"title":"Update an action","href":"/docs/api/management/v2/actions/patch-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/actions/{id}/deploy","playground":"interactive","deprecated":false,"title":"Deploy an action","href":"/docs/api/management/v2/actions/post-deploy-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/actions/{id}/test","playground":"interactive","deprecated":false,"title":"Test an Action","href":"/docs/api/management/v2/actions/post-test-action"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/executions/{id}","playground":"interactive","deprecated":false,"title":"Get an execution","href":"/docs/api/management/v2/actions/get-execution"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/modules","playground":"interactive","deprecated":false,"title":"List Actions Modules","href":"/docs/api/management/v2/actions/get-action-modules"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/modules","playground":"interactive","deprecated":false,"title":"Create a new Actions Module","href":"/docs/api/management/v2/actions/post-action-module"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/modules/{id}","playground":"interactive","deprecated":false,"title":"Get a specific Actions Module by ID","href":"/docs/api/management/v2/actions/get-action-module"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /actions/modules/{id}","playground":"interactive","deprecated":false,"title":"Delete a specific Actions Module by ID","href":"/docs/api/management/v2/actions/delete-action-module"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /actions/modules/{id}","playground":"interactive","deprecated":false,"title":"Update a specific Actions Module","href":"/docs/api/management/v2/actions/patch-action-module"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/modules/{id}/actions","playground":"interactive","deprecated":false,"title":"List all actions using an Actions Module","href":"/docs/api/management/v2/actions/get-action-module-actions"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/modules/{id}/rollback","playground":"interactive","deprecated":false,"title":"Rollback an Actions Module to a previous version","href":"/docs/api/management/v2/actions/post-action-module-rollback"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/modules/{id}/versions","playground":"interactive","deprecated":false,"title":"List all versions of an Actions Module","href":"/docs/api/management/v2/actions/get-action-module-versions"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /actions/modules/{id}/versions","playground":"interactive","deprecated":false,"title":"Create a new version of an Actions Module","href":"/docs/api/management/v2/actions/post-action-module-version"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/modules/{id}/versions/{versionId}","playground":"interactive","deprecated":false,"title":"Get a specific version of an Actions Module","href":"/docs/api/management/v2/actions/get-action-module-version"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/triggers","playground":"interactive","deprecated":false,"title":"Get triggers","href":"/docs/api/management/v2/actions/get-triggers"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /actions/triggers/{triggerId}/bindings","playground":"interactive","deprecated":false,"title":"Get trigger bindings","href":"/docs/api/management/v2/actions/get-bindings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /actions/triggers/{triggerId}/bindings","playground":"interactive","deprecated":false,"title":"Update trigger bindings","href":"/docs/api/management/v2/actions/patch-bindings"}]},{"group":"Agents","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /agents","playground":"interactive","deprecated":false,"title":"Get agents","href":"/docs/api/management/v2/agents/get-agents"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /agents","playground":"interactive","deprecated":false,"title":"Create an agent","href":"/docs/api/management/v2/agents/post-agent"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /agents/{id}","playground":"interactive","deprecated":false,"title":"Get an agent","href":"/docs/api/management/v2/agents/get-agent"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /agents/{id}","playground":"interactive","deprecated":false,"title":"Delete an agent","href":"/docs/api/management/v2/agents/delete-agent"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /agents/{id}","playground":"interactive","deprecated":false,"title":"Update an agent","href":"/docs/api/management/v2/agents/patch-agent"}]},{"group":"Anomaly","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /anomaly/blocks/ips/{id}","playground":"interactive","deprecated":false,"title":"Check if an IP address is blocked","href":"/docs/api/management/v2/anomaly/get-ips-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /anomaly/blocks/ips/{id}","playground":"interactive","deprecated":false,"title":"Remove the blocked IP address","href":"/docs/api/management/v2/anomaly/delete-ips-by-id"}]},{"group":"Attack Protection","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/bot-detection","playground":"interactive","deprecated":false,"title":"Get Bot Detection settings","href":"/docs/api/management/v2/attack-protection/get-bot-detection"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/bot-detection","playground":"interactive","deprecated":false,"title":"Update Bot Detection settings","href":"/docs/api/management/v2/attack-protection/patch-bot-detection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/breached-password-detection","playground":"interactive","deprecated":false,"title":"Get Breached Password Detection settings","href":"/docs/api/management/v2/attack-protection/get-breached-password-detection"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/breached-password-detection","playground":"interactive","deprecated":false,"title":"Update Breached Password Detection settings","href":"/docs/api/management/v2/attack-protection/patch-breached-password-detection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/brute-force-protection","playground":"interactive","deprecated":false,"title":"Get Brute-force settings","href":"/docs/api/management/v2/attack-protection/get-brute-force-protection"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/brute-force-protection","playground":"interactive","deprecated":false,"title":"Update Brute-force settings","href":"/docs/api/management/v2/attack-protection/patch-brute-force-protection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/captcha","playground":"interactive","deprecated":false,"title":"Get the CAPTCHA configuration for a tenant","href":"/docs/api/management/v2/attack-protection/get-captcha"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/captcha","playground":"interactive","deprecated":false,"title":"Partial Update for CAPTCHA Configuration","href":"/docs/api/management/v2/attack-protection/patch-captcha"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/phone-provider-protection","playground":"interactive","deprecated":false,"title":"Get Phone Provider Protection settings","href":"/docs/api/management/v2/attack-protection/get-phone-provider-protection"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/phone-provider-protection","playground":"interactive","deprecated":false,"title":"Update Phone Provider Protection settings","href":"/docs/api/management/v2/attack-protection/patch-phone-provider-protection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /attack-protection/suspicious-ip-throttling","playground":"interactive","deprecated":false,"title":"Get Suspicious IP Throttling settings","href":"/docs/api/management/v2/attack-protection/get-suspicious-ip-throttling"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /attack-protection/suspicious-ip-throttling","playground":"interactive","deprecated":false,"title":"Update Suspicious IP Throttling settings","href":"/docs/api/management/v2/attack-protection/patch-suspicious-ip-throttling"}]},{"group":"Branding","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding","playground":"interactive","deprecated":false,"title":"Get branding settings","href":"/docs/api/management/v2/branding/get-branding"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /branding","playground":"interactive","deprecated":false,"title":"Update branding settings","href":"/docs/api/management/v2/branding/patch-branding"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/phone/providers","playground":"interactive","deprecated":false,"title":"Get a list of phone providers","href":"/docs/api/management/v2/branding/get-branding-phone-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /branding/phone/providers","playground":"interactive","deprecated":false,"title":"Configure the phone provider","href":"/docs/api/management/v2/branding/create-phone-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/phone/providers/{id}","playground":"interactive","deprecated":false,"title":"Get a phone provider","href":"/docs/api/management/v2/branding/get-phone-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /branding/phone/providers/{id}","playground":"interactive","deprecated":false,"title":"Deletes a Phone Provider","href":"/docs/api/management/v2/branding/delete-phone-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /branding/phone/providers/{id}","playground":"interactive","deprecated":false,"title":"Update the phone provider","href":"/docs/api/management/v2/branding/update-phone-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /branding/phone/providers/{id}/try","playground":"interactive","deprecated":false,"title":"Send a test phone notification for the configured provider","href":"/docs/api/management/v2/branding/try-phone-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/phone/templates","playground":"interactive","deprecated":false,"title":"Get a list of phone notification templates","href":"/docs/api/management/v2/branding/get-phone-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /branding/phone/templates","playground":"interactive","deprecated":false,"title":"Create a phone notification template","href":"/docs/api/management/v2/branding/create-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/phone/templates/{id}","playground":"interactive","deprecated":false,"title":"Get a phone notification template","href":"/docs/api/management/v2/branding/get-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /branding/phone/templates/{id}","playground":"interactive","deprecated":false,"title":"Delete a phone notification template","href":"/docs/api/management/v2/branding/delete-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /branding/phone/templates/{id}","playground":"interactive","deprecated":false,"title":"Update a phone notification template","href":"/docs/api/management/v2/branding/update-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /branding/phone/templates/{id}/reset","playground":"interactive","deprecated":false,"title":"Resets a phone notification template values","href":"/docs/api/management/v2/branding/reset-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /branding/phone/templates/{id}/try","playground":"interactive","deprecated":false,"title":"Send a test phone notification for the configured template","href":"/docs/api/management/v2/branding/try-phone-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/templates/universal-login","playground":"interactive","deprecated":false,"title":"Get template for New Universal Login Experience","href":"/docs/api/management/v2/branding/get-universal-login"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /branding/templates/universal-login","playground":"interactive","deprecated":false,"title":"Delete template for New Universal Login Experience","href":"/docs/api/management/v2/branding/delete-universal-login"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /branding/templates/universal-login","playground":"interactive","deprecated":false,"title":"Set template for New Universal Login Experience","href":"/docs/api/management/v2/branding/put-universal-login"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /branding/themes","playground":"interactive","deprecated":false,"title":"Create branding theme","href":"/docs/api/management/v2/branding/post-branding-theme"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/themes/default","playground":"interactive","deprecated":false,"title":"Get default branding theme","href":"/docs/api/management/v2/branding/get-default-branding-theme"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /branding/themes/{themeId}","playground":"interactive","deprecated":false,"title":"Get branding theme","href":"/docs/api/management/v2/branding/get-branding-theme"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /branding/themes/{themeId}","playground":"interactive","deprecated":false,"title":"Delete branding theme","href":"/docs/api/management/v2/branding/delete-branding-theme"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /branding/themes/{themeId}","playground":"interactive","deprecated":false,"title":"Update branding theme","href":"/docs/api/management/v2/branding/patch-branding-theme"}]},{"group":"Client Grants","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /client-grants","playground":"interactive","deprecated":false,"title":"Get client grants","href":"/docs/api/management/v2/client-grants/get-client-grants"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /client-grants","playground":"interactive","deprecated":false,"title":"Create client grant","href":"/docs/api/management/v2/client-grants/post-client-grants"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /client-grants/{id}","playground":"interactive","deprecated":false,"title":"Get client grant","href":"/docs/api/management/v2/client-grants/get-client-grant"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /client-grants/{id}","playground":"interactive","deprecated":false,"title":"Delete client grant","href":"/docs/api/management/v2/client-grants/delete-client-grants-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /client-grants/{id}","playground":"interactive","deprecated":false,"title":"Update client grant","href":"/docs/api/management/v2/client-grants/patch-client-grants-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /client-grants/{id}/organizations","playground":"interactive","deprecated":false,"title":"Get the organizations associated to a client grant","href":"/docs/api/management/v2/client-grants/get-client-grant-organizations"}]},{"group":"Clients","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients","playground":"interactive","deprecated":false,"title":"Get clients","href":"/docs/api/management/v2/clients/get-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /clients","playground":"interactive","deprecated":false,"title":"Create a client","href":"/docs/api/management/v2/clients/post-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /clients/cimd/preview","playground":"interactive","deprecated":false,"title":"Preview and validate Client ID Metadata Document","href":"/docs/api/management/v2/clients/post-clients-cimd-preview"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /clients/cimd/register","playground":"interactive","deprecated":false,"title":"Register or update a CIMD client via metadata URI","href":"/docs/api/management/v2/clients/post-clients-cimd-register"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients/search","playground":"interactive","deprecated":false,"title":"Search clients using SCIM or Lucene filter syntax","href":"/docs/api/management/v2/clients/get-clients-search"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients/{client_id}/credentials","playground":"interactive","deprecated":false,"title":"Get client credentials","href":"/docs/api/management/v2/clients/get-credentials"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /clients/{client_id}/credentials","playground":"interactive","deprecated":false,"title":"Create a client credential","href":"/docs/api/management/v2/clients/post-credentials"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients/{client_id}/credentials/{credential_id}","playground":"interactive","deprecated":false,"title":"Get client credential details","href":"/docs/api/management/v2/clients/get-credentials-by-credential-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /clients/{client_id}/credentials/{credential_id}","playground":"interactive","deprecated":false,"title":"Delete a client credential","href":"/docs/api/management/v2/clients/delete-credentials-by-credential-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /clients/{client_id}/credentials/{credential_id}","playground":"interactive","deprecated":false,"title":"Update a client credential","href":"/docs/api/management/v2/clients/patch-credentials-by-credential-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients/{id}","playground":"interactive","deprecated":false,"title":"Get client by ID","href":"/docs/api/management/v2/clients/get-clients-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /clients/{id}","playground":"interactive","deprecated":false,"title":"Delete a client","href":"/docs/api/management/v2/clients/delete-clients-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /clients/{id}","playground":"interactive","deprecated":false,"title":"Update a client","href":"/docs/api/management/v2/clients/patch-clients-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /clients/{id}/connections","playground":"interactive","deprecated":false,"title":"Get enabled connections for a client","href":"/docs/api/management/v2/clients/get-client-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /clients/{id}/rotate-secret","playground":"interactive","deprecated":false,"title":"Rotate a client secret","href":"/docs/api/management/v2/clients/post-rotate-secret"}]},{"group":"Connection Profiles","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connection-profiles","playground":"interactive","deprecated":false,"title":"Get Connection Profiles","href":"/docs/api/management/v2/connection-profiles/get-connection-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connection-profiles","playground":"interactive","deprecated":false,"title":"Create a connection profile","href":"/docs/api/management/v2/connection-profiles/post-connection-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connection-profiles/templates","playground":"interactive","deprecated":false,"title":"Get Connection Profile Templates","href":"/docs/api/management/v2/connection-profiles/get-connection-profile-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connection-profiles/templates/{id}","playground":"interactive","deprecated":false,"title":"Get Connection Profile Template","href":"/docs/api/management/v2/connection-profiles/get-connection-profile-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connection-profiles/{id}","playground":"interactive","deprecated":false,"title":"Get Connection Profile","href":"/docs/api/management/v2/connection-profiles/get-connection-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connection-profiles/{id}","playground":"interactive","deprecated":false,"title":"Delete Connection Profile","href":"/docs/api/management/v2/connection-profiles/delete-connection-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /connection-profiles/{id}","playground":"interactive","deprecated":false,"title":"Modify a Connection Profile","href":"/docs/api/management/v2/connection-profiles/patch-connection-profiles-by-id"}]},{"group":"Connections","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections","playground":"interactive","deprecated":false,"title":"Get all connections","href":"/docs/api/management/v2/connections/get-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections","playground":"interactive","deprecated":false,"title":"Create a connection","href":"/docs/api/management/v2/connections/post-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}","playground":"interactive","deprecated":false,"title":"Get a connection","href":"/docs/api/management/v2/connections/get-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}","playground":"interactive","deprecated":false,"title":"Delete a connection","href":"/docs/api/management/v2/connections/delete-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /connections/{id}","playground":"interactive","deprecated":false,"title":"Update a connection","href":"/docs/api/management/v2/connections/patch-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/clients","playground":"interactive","deprecated":false,"title":"Get enabled clients for a connection","href":"/docs/api/management/v2/connections/get-connection-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /connections/{id}/clients","playground":"interactive","deprecated":false,"title":"Update enabled clients for a connection","href":"/docs/api/management/v2/connections/patch-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/directory-provisioning","playground":"interactive","deprecated":false,"title":"Get a directory provisioning configuration","href":"/docs/api/management/v2/connections/get-directory-provisioning"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}/directory-provisioning","playground":"interactive","deprecated":false,"title":"Delete a directory provisioning configuration","href":"/docs/api/management/v2/connections/delete-directory-provisioning"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /connections/{id}/directory-provisioning","playground":"interactive","deprecated":false,"title":"Patch a directory provisioning configuration","href":"/docs/api/management/v2/connections/patch-directory-provisioning"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/directory-provisioning","playground":"interactive","deprecated":false,"title":"Create a directory provisioning configuration","href":"/docs/api/management/v2/connections/post-directory-provisioning"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/directory-provisioning/default-mapping","playground":"interactive","deprecated":false,"title":"Get a connection's default directory provisioning attribute mapping","href":"/docs/api/management/v2/connections/get-directory-provisioning-default-mapping"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/directory-provisioning/synchronizations","playground":"interactive","deprecated":false,"title":"Request an on-demand synchronization of the directory","href":"/docs/api/management/v2/connections/post-synchronizations"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/directory-provisioning/synchronized-groups","playground":"interactive","deprecated":false,"title":"Get synchronized groups for a directory provisioning configuration","href":"/docs/api/management/v2/connections/get-synchronized-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}/directory-provisioning/synchronized-groups","playground":"interactive","deprecated":false,"title":"Delete synchronized group selections for a directory provisioning configuration","href":"/docs/api/management/v2/connections/delete-synchronized-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/directory-provisioning/synchronized-groups","playground":"interactive","deprecated":false,"title":"Add synchronized group selections to a directory provisioning configuration","href":"/docs/api/management/v2/connections/post-synchronized-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /connections/{id}/directory-provisioning/synchronized-groups","playground":"interactive","deprecated":false,"title":"Create or replace synchronized group selections for a directory provisioning configuration","href":"/docs/api/management/v2/connections/put-synchronized-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/keys","playground":"interactive","deprecated":false,"title":"Get connection keys","href":"/docs/api/management/v2/connections/get-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/keys","playground":"interactive","deprecated":false,"title":"Create connection keys","href":"/docs/api/management/v2/connections/post-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/keys/rotate","playground":"interactive","deprecated":false,"title":"Rotate connection keys","href":"/docs/api/management/v2/connections/post-rotate"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/scim-configuration","playground":"interactive","deprecated":false,"title":"Get a connection's SCIM configuration","href":"/docs/api/management/v2/connections/get-scim-configuration"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}/scim-configuration","playground":"interactive","deprecated":false,"title":"Delete a connection's SCIM configuration","href":"/docs/api/management/v2/connections/delete-scim-configuration"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /connections/{id}/scim-configuration","playground":"interactive","deprecated":false,"title":"Patch a connection's SCIM configuration","href":"/docs/api/management/v2/connections/patch-scim-configuration"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/scim-configuration","playground":"interactive","deprecated":false,"title":"Create a SCIM configuration","href":"/docs/api/management/v2/connections/post-scim-configuration"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/scim-configuration/default-mapping","playground":"interactive","deprecated":false,"title":"Get a connection's default SCIM mapping","href":"/docs/api/management/v2/connections/get-default-mapping"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/scim-configuration/tokens","playground":"interactive","deprecated":false,"title":"Get a connection's SCIM tokens","href":"/docs/api/management/v2/connections/get-scim-tokens"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /connections/{id}/scim-configuration/tokens","playground":"interactive","deprecated":false,"title":"Create a SCIM Token","href":"/docs/api/management/v2/connections/post-scim-token"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}/scim-configuration/tokens/{tokenId}","playground":"interactive","deprecated":false,"title":"Delete a connection's SCIM token","href":"/docs/api/management/v2/connections/delete-tokens-by-token-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections/{id}/status","playground":"interactive","deprecated":false,"title":"Check connection status","href":"/docs/api/management/v2/connections/get-status"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /connections/{id}/users","playground":"interactive","deprecated":false,"title":"Delete a connection user","href":"/docs/api/management/v2/connections/delete-users-by-email"}]},{"group":"Connections Directory Provisionings","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections-directory-provisionings","playground":"interactive","deprecated":false,"title":"Get a list of directory provisioning configurations","href":"/docs/api/management/v2/connections-directory-provisionings/get-connections-directory-provisionings"}]},{"group":"Connections Scim Configurations","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /connections-scim-configurations","playground":"interactive","deprecated":false,"title":"Get a list of SCIM configurations","href":"/docs/api/management/v2/connections-scim-configurations/get-connections-scim-configurations"}]},{"group":"Custom Domains","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /custom-domains","playground":"interactive","deprecated":false,"title":"Get custom domains configurations","href":"/docs/api/management/v2/custom-domains/get-custom-domains"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /custom-domains","playground":"interactive","deprecated":false,"title":"Configure a new custom domain","href":"/docs/api/management/v2/custom-domains/post-custom-domains"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /custom-domains/default","playground":"interactive","deprecated":false,"title":"Get the default domain","href":"/docs/api/management/v2/custom-domains/get-default"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /custom-domains/default","playground":"interactive","deprecated":false,"title":"Update the default custom domain for the tenant","href":"/docs/api/management/v2/custom-domains/patch-default"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /custom-domains/{id}","playground":"interactive","deprecated":false,"title":"Get custom domain configuration","href":"/docs/api/management/v2/custom-domains/get-custom-domains-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /custom-domains/{id}","playground":"interactive","deprecated":false,"title":"Delete custom domain configuration","href":"/docs/api/management/v2/custom-domains/delete-custom-domains-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /custom-domains/{id}","playground":"interactive","deprecated":false,"title":"Update custom domain configuration","href":"/docs/api/management/v2/custom-domains/patch-custom-domains-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /custom-domains/{id}/test","playground":"interactive","deprecated":false,"title":"Test a custom domain","href":"/docs/api/management/v2/custom-domains/post-test-domain"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /custom-domains/{id}/verify","playground":"interactive","deprecated":false,"title":"Verify a custom domain","href":"/docs/api/management/v2/custom-domains/post-verify"}]},{"group":"Device Credentials","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /device-credentials","playground":"interactive","deprecated":false,"title":"Retrieve device credentials","href":"/docs/api/management/v2/device-credentials/get-device-credentials"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /device-credentials","playground":"interactive","deprecated":false,"title":"Create a device public key credential","href":"/docs/api/management/v2/device-credentials/post-device-credentials"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /device-credentials/{id}","playground":"interactive","deprecated":false,"title":"Delete a device credential","href":"/docs/api/management/v2/device-credentials/delete-device-credentials-by-id"}]},{"group":"Email Templates","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json POST /email-templates","playground":"interactive","deprecated":false,"title":"Create an email template","href":"/docs/api/management/v2/email-templates/post-email-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /email-templates/{templateName}","playground":"interactive","deprecated":false,"title":"Get an email template","href":"/docs/api/management/v2/email-templates/get-email-templates-by-template-name"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /email-templates/{templateName}","playground":"interactive","deprecated":false,"title":"Patch an email template","href":"/docs/api/management/v2/email-templates/patch-email-templates-by-template-name"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /email-templates/{templateName}","playground":"interactive","deprecated":false,"title":"Update an email template","href":"/docs/api/management/v2/email-templates/put-email-templates-by-template-name"}]},{"group":"Emails","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /emails/provider","playground":"interactive","deprecated":false,"title":"Get email provider","href":"/docs/api/management/v2/emails/get-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /emails/provider","playground":"interactive","deprecated":false,"title":"Delete email provider","href":"/docs/api/management/v2/emails/delete-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /emails/provider","playground":"interactive","deprecated":false,"title":"Update email provider","href":"/docs/api/management/v2/emails/patch-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /emails/provider","playground":"interactive","deprecated":false,"title":"Configure email provider","href":"/docs/api/management/v2/emails/post-provider"}]},{"group":"Event Streams","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /event-streams","playground":"interactive","deprecated":false,"title":"Get event streams","href":"/docs/api/management/v2/event-streams/get-event-streams"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /event-streams","playground":"interactive","deprecated":false,"title":"Create an event stream","href":"/docs/api/management/v2/event-streams/post-event-streams"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /event-streams/{id}","playground":"interactive","deprecated":false,"title":"Get an event stream by ID","href":"/docs/api/management/v2/event-streams/get-event-streams-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /event-streams/{id}","playground":"interactive","deprecated":false,"title":"Delete an event stream","href":"/docs/api/management/v2/event-streams/delete-event-streams-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /event-streams/{id}","playground":"interactive","deprecated":false,"title":"Update an event stream","href":"/docs/api/management/v2/event-streams/patch-event-streams-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /event-streams/{id}/deliveries","playground":"interactive","deprecated":false,"title":"Get this event stream's delivery history","href":"/docs/api/management/v2/event-streams/get-event-deliveries"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /event-streams/{id}/deliveries/{event_id}","playground":"interactive","deprecated":false,"title":"Get a specific event's delivery history","href":"/docs/api/management/v2/event-streams/get-deliveries-by-event-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /event-streams/{id}/redeliver","playground":"interactive","deprecated":false,"title":"Redeliver failed events","href":"/docs/api/management/v2/event-streams/post-redeliver"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /event-streams/{id}/redeliver/{event_id}","playground":"interactive","deprecated":false,"title":"Redeliver a single failed event by ID","href":"/docs/api/management/v2/event-streams/post-redeliver-by-event-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /event-streams/{id}/test","playground":"interactive","deprecated":false,"title":"Send a test event to an event stream","description":null,"href":"/docs/api/management/v2/event-streams/post-test-event"}]},{"group":"Events","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /events","playground":"interactive","deprecated":false,"title":"Subscribe to events via Server-Sent Events (SSE)","href":"/docs/api/management/v2/events/subscribe-events"}]},{"group":"Experimentation","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/experiments","playground":"interactive","deprecated":false,"title":"List experiments for the tenant.","description":"Retrieve a paginated list of experiments for the tenant, with optional filters.","href":"/docs/api/management/v2/experimentation/get-experiments"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/experiments","playground":"interactive","deprecated":false,"title":"Create an experiment for the Experiment Center.","href":"/docs/api/management/v2/experimentation/create-experiment"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/experiments/{id}","playground":"interactive","deprecated":false,"title":"Get an experiment by ID.","href":"/docs/api/management/v2/experimentation/get-experiment"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /experimentation/experiments/{id}","playground":"interactive","deprecated":false,"title":"Delete an experiment.","href":"/docs/api/management/v2/experimentation/delete-experiment"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /experimentation/experiments/{id}","playground":"interactive","deprecated":false,"title":"Update an experiment.","href":"/docs/api/management/v2/experimentation/update-experiment"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/experiments/{id}/advance-ramp","playground":"interactive","deprecated":false,"title":"Advance the rollout level of a ramp experiment.","href":"/docs/api/management/v2/experimentation/advance-experiment-ramp"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/experiments/{id}/status","playground":"interactive","deprecated":false,"title":"Transition an experiment to a new status.","href":"/docs/api/management/v2/experimentation/update-experiment-status"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/experiments/{id}/validate","playground":"interactive","deprecated":false,"title":"Validate an experiment.","href":"/docs/api/management/v2/experimentation/validate-experiment"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/feature-flags","playground":"interactive","deprecated":false,"title":"List feature flags for the tenant.","href":"/docs/api/management/v2/experimentation/get-feature-flags"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/feature-flags","playground":"interactive","deprecated":false,"title":"Create a feature flag for the Experiment Center.","href":"/docs/api/management/v2/experimentation/create-feature-flag"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/feature-flags/{id}","playground":"interactive","deprecated":false,"title":"Get a feature flag by ID.","href":"/docs/api/management/v2/experimentation/get-feature-flag"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /experimentation/feature-flags/{id}","playground":"interactive","deprecated":false,"title":"Delete a feature flag.","href":"/docs/api/management/v2/experimentation/delete-feature-flag"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /experimentation/feature-flags/{id}","playground":"interactive","deprecated":false,"title":"Update a feature flag.","href":"/docs/api/management/v2/experimentation/update-feature-flag"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/feature-flags/{id}/status","playground":"interactive","deprecated":false,"title":"Transition a feature flag to a new status.","href":"/docs/api/management/v2/experimentation/update-feature-flag-status"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/feature-flags/{id}/variations","playground":"interactive","deprecated":false,"title":"List all variations for a feature flag.","href":"/docs/api/management/v2/experimentation/get-variations"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/feature-flags/{id}/variations","playground":"interactive","deprecated":false,"title":"Create a variation for a feature flag.","href":"/docs/api/management/v2/experimentation/create-variation"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/feature-flags/{id}/variations/{vid}","playground":"interactive","deprecated":false,"title":"Get a variation by ID.","href":"/docs/api/management/v2/experimentation/get-variation"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /experimentation/feature-flags/{id}/variations/{vid}","playground":"interactive","deprecated":false,"title":"Delete a variation.","href":"/docs/api/management/v2/experimentation/delete-variation"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /experimentation/feature-flags/{id}/variations/{vid}","playground":"interactive","deprecated":false,"title":"Update a variation.","href":"/docs/api/management/v2/experimentation/update-variation"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/segments","playground":"interactive","deprecated":false,"title":"List segments for the tenant.","href":"/docs/api/management/v2/experimentation/get-segments"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /experimentation/segments","playground":"interactive","deprecated":false,"title":"Create a segment for the Experiment Center.","href":"/docs/api/management/v2/experimentation/create-segment"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /experimentation/segments/{id}","playground":"interactive","deprecated":false,"title":"Get a segment by ID.","href":"/docs/api/management/v2/experimentation/get-segment"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /experimentation/segments/{id}","playground":"interactive","deprecated":false,"title":"Delete a segment.","href":"/docs/api/management/v2/experimentation/delete-segment"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /experimentation/segments/{id}","playground":"interactive","deprecated":false,"title":"Update a segment.","href":"/docs/api/management/v2/experimentation/update-segment"}]},{"group":"Flows","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows","playground":"interactive","deprecated":false,"title":"Get flows","href":"/docs/api/management/v2/flows/get-flows"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /flows","playground":"interactive","deprecated":false,"title":"Create a flow","href":"/docs/api/management/v2/flows/post-flows"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows/vault/connections","playground":"interactive","deprecated":false,"title":"Get Flows Vault connection list","href":"/docs/api/management/v2/flows/get-flows-vault-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /flows/vault/connections","playground":"interactive","deprecated":false,"title":"Create a Flows Vault connection","href":"/docs/api/management/v2/flows/post-flows-vault-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows/vault/connections/{id}","playground":"interactive","deprecated":false,"title":"Get a Flows Vault connection","href":"/docs/api/management/v2/flows/get-flows-vault-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /flows/vault/connections/{id}","playground":"interactive","deprecated":false,"title":"Delete a Flows Vault connection","href":"/docs/api/management/v2/flows/delete-flows-vault-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /flows/vault/connections/{id}","playground":"interactive","deprecated":false,"title":"Update a Flows Vault connection","href":"/docs/api/management/v2/flows/patch-flows-vault-connections-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows/{flow_id}/executions","playground":"interactive","deprecated":false,"title":"Get flow executions","href":"/docs/api/management/v2/flows/get-flows-executions"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows/{flow_id}/executions/{execution_id}","playground":"interactive","deprecated":false,"title":"Get a flow execution","href":"/docs/api/management/v2/flows/get-flows-executions-by-execution-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /flows/{flow_id}/executions/{execution_id}","playground":"interactive","deprecated":false,"title":"Delete a flow execution","href":"/docs/api/management/v2/flows/delete-flows-executions-by-execution-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /flows/{id}","playground":"interactive","deprecated":false,"title":"Get a flow","href":"/docs/api/management/v2/flows/get-flows-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /flows/{id}","playground":"interactive","deprecated":false,"title":"Delete a flow","href":"/docs/api/management/v2/flows/delete-flows-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /flows/{id}","playground":"interactive","deprecated":false,"title":"Update a flow","href":"/docs/api/management/v2/flows/patch-flows-by-id"}]},{"group":"Forms","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /forms","playground":"interactive","deprecated":false,"title":"Get forms","href":"/docs/api/management/v2/forms/get-forms"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /forms","playground":"interactive","deprecated":false,"title":"Create a form","href":"/docs/api/management/v2/forms/create-form"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /forms/{id}","playground":"interactive","deprecated":false,"title":"Get a form","href":"/docs/api/management/v2/forms/get-form"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /forms/{id}","playground":"interactive","deprecated":false,"title":"Delete a form","href":"/docs/api/management/v2/forms/delete-form"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /forms/{id}","playground":"interactive","deprecated":false,"title":"Update a form","href":"/docs/api/management/v2/forms/patch-form"}]},{"group":"Grants","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /grants","playground":"interactive","deprecated":false,"title":"Get grants","href":"/docs/api/management/v2/grants/get-grants"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /grants","playground":"interactive","deprecated":false,"title":"Delete a grant by user_id","href":"/docs/api/management/v2/grants/delete-grants-by-user-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /grants/{id}","playground":"interactive","deprecated":false,"title":"Delete a grant by id","href":"/docs/api/management/v2/grants/delete-grants-by-id"}]},{"group":"Groups","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /groups","playground":"interactive","deprecated":false,"title":"Get all Groups","href":"/docs/api/management/v2/groups/get-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /groups/{id}","playground":"interactive","deprecated":false,"title":"Get a Group","href":"/docs/api/management/v2/groups/get-group"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /groups/{id}","playground":"interactive","deprecated":false,"title":"Delete a Group","href":"/docs/api/management/v2/groups/delete-group"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /groups/{id}/members","playground":"interactive","deprecated":false,"title":"Get Group Members","href":"/docs/api/management/v2/groups/get-group-members"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /groups/{id}/roles","playground":"interactive","deprecated":false,"title":"Get a group's roles","href":"/docs/api/management/v2/groups/get-group-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /groups/{id}/roles","playground":"interactive","deprecated":false,"title":"Remove roles from a group","href":"/docs/api/management/v2/groups/delete-group-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /groups/{id}/roles","playground":"interactive","deprecated":false,"title":"Assign roles to a group","href":"/docs/api/management/v2/groups/post-group-roles"}]},{"group":"Guardian","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json POST /guardian/enrollments/ticket","playground":"interactive","deprecated":false,"title":"Create a multi-factor authentication enrollment ticket","href":"/docs/api/management/v2/guardian/post-ticket"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/enrollments/{id}","playground":"interactive","deprecated":false,"title":"Get a multi-factor authentication enrollment","href":"/docs/api/management/v2/guardian/get-enrollments-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /guardian/enrollments/{id}","playground":"interactive","deprecated":false,"title":"Delete a multi-factor authentication enrollment","href":"/docs/api/management/v2/guardian/delete-enrollments-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors","playground":"interactive","deprecated":false,"title":"Get Factors and multi-factor authentication details","href":"/docs/api/management/v2/guardian/get-factors"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/duo/settings","playground":"interactive","deprecated":false,"title":"Get DUO Configuration","href":"/docs/api/management/v2/guardian/get-factor-duo-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /guardian/factors/duo/settings","playground":"interactive","deprecated":false,"title":"Update the DUO Configuration","href":"/docs/api/management/v2/guardian/patch-factor-duo-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/duo/settings","playground":"interactive","deprecated":false,"title":"Set the DUO Configuration","href":"/docs/api/management/v2/guardian/put-factor-duo-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/email/settings","playground":"interactive","deprecated":false,"title":"Get Email Factor Settings","href":"/docs/api/management/v2/guardian/get-email-factor-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/email/settings","playground":"interactive","deprecated":false,"title":"Set the Email Factor Settings","href":"/docs/api/management/v2/guardian/set-email-factor-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/phone/message-types","playground":"interactive","deprecated":false,"title":"Get Enabled Phone Factors","href":"/docs/api/management/v2/guardian/get-message-types"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/phone/message-types","playground":"interactive","deprecated":false,"title":"Update the Enabled Phone Factors","href":"/docs/api/management/v2/guardian/put-message-types"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/phone/providers/twilio","playground":"interactive","deprecated":false,"title":"Get Twilio configuration","href":"/docs/api/management/v2/guardian/get-phone-twilio-factor-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/phone/providers/twilio","playground":"interactive","deprecated":false,"title":"Update Twilio configuration","href":"/docs/api/management/v2/guardian/put-twilio"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/phone/selected-provider","playground":"interactive","deprecated":false,"title":"Get phone provider configuration","href":"/docs/api/management/v2/guardian/get-guardian-phone-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/phone/selected-provider","playground":"interactive","deprecated":false,"title":"Update phone provider configuration","href":"/docs/api/management/v2/guardian/put-phone-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/phone/settings","playground":"interactive","deprecated":false,"title":"Get Phone Factor Settings","href":"/docs/api/management/v2/guardian/get-phone-factor-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/phone/settings","playground":"interactive","deprecated":false,"title":"Set the Phone Factor Settings","href":"/docs/api/management/v2/guardian/set-phone-factor-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/phone/templates","playground":"interactive","deprecated":false,"title":"Get Enrollment and Verification Phone Templates","href":"/docs/api/management/v2/guardian/get-factor-phone-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/phone/templates","playground":"interactive","deprecated":false,"title":"Update Enrollment and Verification Phone Templates","href":"/docs/api/management/v2/guardian/put-factor-phone-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/push-notification/providers/apns","playground":"interactive","deprecated":false,"title":"Get APNS push notification configuration","href":"/docs/api/management/v2/guardian/get-apns"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /guardian/factors/push-notification/providers/apns","playground":"interactive","deprecated":false,"title":"Update APNs provider configuration","href":"/docs/api/management/v2/guardian/patch-apns"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/push-notification/providers/apns","playground":"interactive","deprecated":false,"title":"Update APNS configuration","href":"/docs/api/management/v2/guardian/put-apns"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /guardian/factors/push-notification/providers/fcm","playground":"interactive","deprecated":false,"title":"Updates FCM configuration","href":"/docs/api/management/v2/guardian/patch-fcm"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/push-notification/providers/fcm","playground":"interactive","deprecated":false,"title":"Overwrite FCM configuration","href":"/docs/api/management/v2/guardian/put-fcm"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /guardian/factors/push-notification/providers/fcmv1","playground":"interactive","deprecated":false,"title":"Updates FCMV1 configuration","href":"/docs/api/management/v2/guardian/patch-fcmv-1"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/push-notification/providers/fcmv1","playground":"interactive","deprecated":false,"title":"Overwrite FCMV1 configuration","href":"/docs/api/management/v2/guardian/put-fcmv-1"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/push-notification/providers/sns","playground":"interactive","deprecated":false,"title":"Get AWS SNS configuration","href":"/docs/api/management/v2/guardian/get-sns"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /guardian/factors/push-notification/providers/sns","playground":"interactive","deprecated":false,"title":"Update AWS SNS configuration","href":"/docs/api/management/v2/guardian/patch-sns"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/push-notification/providers/sns","playground":"interactive","deprecated":false,"title":"Configure AWS SNS configuration","href":"/docs/api/management/v2/guardian/put-sns"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/push-notification/selected-provider","playground":"interactive","deprecated":false,"title":"Get push notification provider","href":"/docs/api/management/v2/guardian/get-pn-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/push-notification/selected-provider","playground":"interactive","deprecated":false,"title":"Update Push Notification configuration","href":"/docs/api/management/v2/guardian/put-pn-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/sms/providers/twilio","playground":"interactive","deprecated":false,"title":"Get Twilio SMS configuration","href":"/docs/api/management/v2/guardian/get-sms-twilio-factor-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/sms/providers/twilio","playground":"interactive","deprecated":false,"title":"Update Twilio SMS configuration","href":"/docs/api/management/v2/guardian/put-sms-twilio-factor-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/sms/selected-provider","playground":"interactive","deprecated":false,"title":"Get SMS configuration","href":"/docs/api/management/v2/guardian/get-sms-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/sms/selected-provider","playground":"interactive","deprecated":false,"title":"Update SMS configuration","href":"/docs/api/management/v2/guardian/put-sms-providers"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/factors/sms/templates","playground":"interactive","deprecated":false,"title":"Get SMS enrollment and verification templates","href":"/docs/api/management/v2/guardian/get-factor-sms-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/sms/templates","playground":"interactive","deprecated":false,"title":"Update SMS enrollment and verification templates","href":"/docs/api/management/v2/guardian/put-factor-sms-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/factors/{name}","playground":"interactive","deprecated":false,"title":"Update multi-factor authentication type","href":"/docs/api/management/v2/guardian/put-factors-by-name"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/policies","playground":"interactive","deprecated":false,"title":"Get multi-factor authentication policies","href":"/docs/api/management/v2/guardian/get-policies"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/policies","playground":"interactive","deprecated":false,"title":"Update multi-factor authentication policies","href":"/docs/api/management/v2/guardian/put-policies"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /guardian/settings","playground":"interactive","deprecated":false,"title":"Get Guardian Settings","href":"/docs/api/management/v2/guardian/get-guardian-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /guardian/settings","playground":"interactive","deprecated":false,"title":"Set the Guardian Settings","href":"/docs/api/management/v2/guardian/set-guardian-settings"}]},{"group":"Hooks","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /hooks","playground":"interactive","deprecated":false,"title":"Get hooks","href":"/docs/api/management/v2/hooks/get-hooks"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /hooks","playground":"interactive","deprecated":false,"title":"Create a hook","href":"/docs/api/management/v2/hooks/post-hooks"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /hooks/{id}","playground":"interactive","deprecated":false,"title":"Get a hook","href":"/docs/api/management/v2/hooks/get-hooks-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /hooks/{id}","playground":"interactive","deprecated":false,"title":"Delete a hook","href":"/docs/api/management/v2/hooks/delete-hooks-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /hooks/{id}","playground":"interactive","deprecated":false,"title":"Update a hook","href":"/docs/api/management/v2/hooks/patch-hooks-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /hooks/{id}/secrets","playground":"interactive","deprecated":false,"title":"Get hook secrets","href":"/docs/api/management/v2/hooks/get-secrets"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /hooks/{id}/secrets","playground":"interactive","deprecated":false,"title":"Delete hook secrets","href":"/docs/api/management/v2/hooks/delete-secrets"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /hooks/{id}/secrets","playground":"interactive","deprecated":false,"title":"Update hook secrets","href":"/docs/api/management/v2/hooks/patch-secrets"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /hooks/{id}/secrets","playground":"interactive","deprecated":false,"title":"Add hook secrets","href":"/docs/api/management/v2/hooks/post-secrets"}]},{"group":"Jobs","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json POST /jobs/users-exports","playground":"interactive","deprecated":false,"title":"Create export users job","href":"/docs/api/management/v2/jobs/post-users-exports"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /jobs/users-imports","playground":"interactive","deprecated":false,"title":"Create import users job","href":"/docs/api/management/v2/jobs/post-users-imports"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /jobs/verification-email","playground":"interactive","deprecated":false,"title":"Send an email address verification email","href":"/docs/api/management/v2/jobs/post-verification-email"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /jobs/{id}","playground":"interactive","deprecated":false,"title":"Get a job","href":"/docs/api/management/v2/jobs/get-jobs-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /jobs/{id}/errors","playground":"interactive","deprecated":false,"title":"Get job error details","href":"/docs/api/management/v2/jobs/get-errors"}]},{"group":"Keys","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/custom-signing","playground":"interactive","deprecated":false,"title":"Get custom signing keys","href":"/docs/api/management/v2/keys/get-custom-signing-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /keys/custom-signing","playground":"interactive","deprecated":false,"title":"Delete custom signing keys","href":"/docs/api/management/v2/keys/delete-custom-signing-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /keys/custom-signing","playground":"interactive","deprecated":false,"title":"Create or replace custom signing keys","href":"/docs/api/management/v2/keys/put-custom-signing-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/encryption","playground":"interactive","deprecated":false,"title":"Get all encryption keys","href":"/docs/api/management/v2/keys/get-encryption-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/encryption","playground":"interactive","deprecated":false,"title":"Create the new encryption key","href":"/docs/api/management/v2/keys/post-encryption"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/encryption/rekey","playground":"interactive","deprecated":false,"title":"Rekey the key hierarchy","href":"/docs/api/management/v2/keys/post-encryption-rekey"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/encryption/{kid}","playground":"interactive","deprecated":false,"title":"Get the encryption key by its key id","href":"/docs/api/management/v2/keys/get-encryption-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /keys/encryption/{kid}","playground":"interactive","deprecated":false,"title":"Delete the encryption key by its key id","href":"/docs/api/management/v2/keys/delete-encryption-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/encryption/{kid}","playground":"interactive","deprecated":false,"title":"Import the encryption key","href":"/docs/api/management/v2/keys/post-encryption-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/encryption/{kid}/wrapping-key","playground":"interactive","deprecated":false,"title":"Create the public wrapping key","href":"/docs/api/management/v2/keys/post-encryption-wrapping-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/network-acls","playground":"interactive","deprecated":false,"title":"Get all Network ACL keys","href":"/docs/api/management/v2/keys/get-all-keys-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/network-acls","playground":"interactive","deprecated":false,"title":"Create a Network ACL key","href":"/docs/api/management/v2/keys/create-keys-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/network-acls/{id}","playground":"interactive","deprecated":false,"title":"Get a Network ACL Key","href":"/docs/api/management/v2/keys/get-keys-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /keys/network-acls/{id}","playground":"interactive","deprecated":false,"title":"Delete a Network ACL key","href":"/docs/api/management/v2/keys/delete-keys-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/signing","playground":"interactive","deprecated":false,"title":"Get all Application Signing Keys","href":"/docs/api/management/v2/keys/get-signing-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /keys/signing/rotate","playground":"interactive","deprecated":false,"title":"Rotate the Application Signing Key","href":"/docs/api/management/v2/keys/post-signing-keys"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /keys/signing/{kid}","playground":"interactive","deprecated":false,"title":"Get an Application Signing Key by its key id","href":"/docs/api/management/v2/keys/get-signing-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /keys/signing/{kid}/revoke","playground":"interactive","deprecated":false,"title":"Revoke an Application Signing Key by its key id","href":"/docs/api/management/v2/keys/put-signing-keys"}]},{"group":"Log Streams","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /log-streams","playground":"interactive","deprecated":false,"title":"Get log streams","href":"/docs/api/management/v2/log-streams/get-log-streams"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /log-streams","playground":"interactive","deprecated":false,"title":"Create a log stream","href":"/docs/api/management/v2/log-streams/post-log-streams"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /log-streams/{id}","playground":"interactive","deprecated":false,"title":"Get log stream by ID","href":"/docs/api/management/v2/log-streams/get-log-streams-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /log-streams/{id}","playground":"interactive","deprecated":false,"title":"Delete log stream","href":"/docs/api/management/v2/log-streams/delete-log-streams-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /log-streams/{id}","playground":"interactive","deprecated":false,"title":"Update a log stream","href":"/docs/api/management/v2/log-streams/patch-log-streams-by-id"}]},{"group":"Logs","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /logs","playground":"interactive","deprecated":false,"title":"Search log events","href":"/docs/api/management/v2/logs/get-logs"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /logs/{id}","playground":"interactive","deprecated":false,"title":"Get a log event by id","href":"/docs/api/management/v2/logs/get-logs-by-id"}]},{"group":"Network Acls","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /network-acls","playground":"interactive","deprecated":false,"title":"Get all access control list entries for a tenant","href":"/docs/api/management/v2/network-acls/get-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /network-acls","playground":"interactive","deprecated":false,"title":"Create Access Control List","href":"/docs/api/management/v2/network-acls/post-network-acls"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /network-acls/{id}","playground":"interactive","deprecated":false,"title":"Get a specific access control list entry for a tenant","href":"/docs/api/management/v2/network-acls/get-network-acls-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /network-acls/{id}","playground":"interactive","deprecated":false,"title":"Delete Access Control List","href":"/docs/api/management/v2/network-acls/delete-network-acls-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /network-acls/{id}","playground":"interactive","deprecated":false,"title":"Partial Update for an Access Control List","href":"/docs/api/management/v2/network-acls/patch-network-acls-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /network-acls/{id}","playground":"interactive","deprecated":false,"title":"Update Access Control List","href":"/docs/api/management/v2/network-acls/put-network-acls-by-id"}]},{"group":"Organizations","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations","playground":"interactive","deprecated":false,"title":"Get organizations","href":"/docs/api/management/v2/organizations/get-organizations"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations","playground":"interactive","deprecated":false,"title":"Create an Organization","href":"/docs/api/management/v2/organizations/post-organizations"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/name/{name}","playground":"interactive","deprecated":false,"title":"Get organization by name","href":"/docs/api/management/v2/organizations/get-name-by-name"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/search","playground":"interactive","deprecated":false,"title":"Search organizations","href":"/docs/api/management/v2/organizations/get-search"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}","playground":"interactive","deprecated":false,"title":"Get organization","href":"/docs/api/management/v2/organizations/get-organizations-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}","playground":"interactive","deprecated":false,"title":"Delete organization","href":"/docs/api/management/v2/organizations/delete-organizations-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /organizations/{id}","playground":"interactive","deprecated":false,"title":"Modify an Organization","href":"/docs/api/management/v2/organizations/patch-organizations-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/client-grants","playground":"interactive","deprecated":false,"title":"Get client grants associated to an organization","href":"/docs/api/management/v2/organizations/get-organization-client-grants"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/client-grants","playground":"interactive","deprecated":false,"title":"Associate a client grant with an organization","href":"/docs/api/management/v2/organizations/create-organization-client-grants"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/client-grants/{grant_id}","playground":"interactive","deprecated":false,"title":"Remove a client grant from an organization","href":"/docs/api/management/v2/organizations/delete-client-grants-by-grant-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/clients","playground":"interactive","deprecated":false,"title":"List organization client associations","href":"/docs/api/management/v2/organizations/get-organization-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/clients","playground":"interactive","deprecated":false,"title":"Remove client associations from an organization","href":"/docs/api/management/v2/organizations/delete-organization-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/clients","playground":"interactive","deprecated":false,"title":"Associate clients with an organization","href":"/docs/api/management/v2/organizations/post-organization-clients"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/clients/{client_id}","playground":"interactive","deprecated":false,"title":"Get an organization client association","href":"/docs/api/management/v2/organizations/get-organization-client"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /organizations/{id}/clients/{client_id}","playground":"interactive","deprecated":false,"title":"Update an organization client association","href":"/docs/api/management/v2/organizations/patch-organization-client"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/connections","playground":"interactive","deprecated":false,"title":"Get connections associated with an organization","href":"/docs/api/management/v2/organizations/get-organization-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/connections","playground":"interactive","deprecated":false,"title":"Add a connection to an organization","href":"/docs/api/management/v2/organizations/post-organization-connection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/connections/{connection_id}","playground":"interactive","deprecated":false,"title":"Get a specific connection associated with an organization","href":"/docs/api/management/v2/organizations/get-organization-connection"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/connections/{connection_id}","playground":"interactive","deprecated":false,"title":"Delete a connection from an organization","href":"/docs/api/management/v2/organizations/delete-organization-connection"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /organizations/{id}/connections/{connection_id}","playground":"interactive","deprecated":false,"title":"Update a connection for an organization","href":"/docs/api/management/v2/organizations/patch-organization-connection"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/discovery-domains","playground":"interactive","deprecated":false,"title":"Retrieve all organization discovery domains","href":"/docs/api/management/v2/organizations/get-discovery-domains"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/discovery-domains","playground":"interactive","deprecated":false,"title":"Create an organization discovery domain","href":"/docs/api/management/v2/organizations/post-discovery-domains"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/discovery-domains/name/{discovery_domain}","playground":"interactive","deprecated":false,"title":"Retrieve an organization discovery domain by domain name","href":"/docs/api/management/v2/organizations/get-name-by-discovery-domain"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/discovery-domains/{discovery_domain_id}","playground":"interactive","deprecated":false,"title":"Retrieve an organization discovery domain by ID","href":"/docs/api/management/v2/organizations/get-discovery-domains-by-discovery-domain-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/discovery-domains/{discovery_domain_id}","playground":"interactive","deprecated":false,"title":"Delete an organization discovery domain","href":"/docs/api/management/v2/organizations/delete-discovery-domains-by-discovery-domain-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /organizations/{id}/discovery-domains/{discovery_domain_id}","playground":"interactive","deprecated":false,"title":"Update an organization discovery domain","href":"/docs/api/management/v2/organizations/patch-discovery-domains-by-discovery-domain-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/enabled_connections","playground":"interactive","deprecated":false,"title":"Get connections enabled for an organization","href":"/docs/api/management/v2/organizations/get-enabled-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/enabled_connections","playground":"interactive","deprecated":false,"title":"Add connections to an organization","href":"/docs/api/management/v2/organizations/post-enabled-connections"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/enabled_connections/{connectionId}","playground":"interactive","deprecated":false,"title":"Get an enabled connection for an organization","href":"/docs/api/management/v2/organizations/get-enabled-connections-by-connection-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/enabled_connections/{connectionId}","playground":"interactive","deprecated":false,"title":"Delete connections from an organization","href":"/docs/api/management/v2/organizations/delete-enabled-connections-by-connection-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /organizations/{id}/enabled_connections/{connectionId}","playground":"interactive","deprecated":false,"title":"Update the Connection of an Organization","href":"/docs/api/management/v2/organizations/patch-enabled-connections-by-connection-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/invitations","playground":"interactive","deprecated":false,"title":"Get invitations to an organization","href":"/docs/api/management/v2/organizations/get-invitations"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/invitations","playground":"interactive","deprecated":false,"title":"Create invitations to an organization","href":"/docs/api/management/v2/organizations/post-invitations"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/invitations/{invitation_id}","playground":"interactive","deprecated":false,"title":"Get a specific invitation to an Organization","href":"/docs/api/management/v2/organizations/get-invitations-by-invitation-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/invitations/{invitation_id}","playground":"interactive","deprecated":false,"title":"Delete an invitation to an Organization","href":"/docs/api/management/v2/organizations/delete-invitations-by-invitation-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/members","playground":"interactive","deprecated":false,"title":"Get members who belong to an organization","href":"/docs/api/management/v2/organizations/get-organization-members"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/members","playground":"interactive","deprecated":false,"title":"Delete members from an organization","href":"/docs/api/management/v2/organizations/delete-members"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/members","playground":"interactive","deprecated":false,"title":"Add members to an organization","href":"/docs/api/management/v2/organizations/post-members"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/members/{user_id}/effective-roles","playground":"interactive","deprecated":false,"title":"List organization member effective roles.","href":"/docs/api/management/v2/organizations/get-organization-member-effective-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/members/{user_id}/effective-roles/sources/groups","playground":"interactive","deprecated":false,"title":"List organization member role group sources.","href":"/docs/api/management/v2/organizations/get-organization-member-role-source-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/members/{user_id}/roles","playground":"interactive","deprecated":false,"title":"Get user roles assigned to an Organization member","href":"/docs/api/management/v2/organizations/get-organization-member-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/members/{user_id}/roles","playground":"interactive","deprecated":false,"title":"Delete user roles from an Organization member","href":"/docs/api/management/v2/organizations/delete-organization-member-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{id}/members/{user_id}/roles","playground":"interactive","deprecated":false,"title":"Assign user roles to an Organization member","href":"/docs/api/management/v2/organizations/post-organization-member-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/organization-templates","playground":"interactive","deprecated":false,"title":"Get organization template for organization","href":"/docs/api/management/v2/organizations/get-organizations-by-id-organization-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{id}/organization-templates/{template_id}","playground":"interactive","deprecated":false,"title":"Unassign an organization template from an organization","href":"/docs/api/management/v2/organizations/delete-organizations-by-id-organization-templates-by-template-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /organizations/{id}/organization-templates/{template_id}","playground":"interactive","deprecated":false,"title":"Assign an organization template to an organization","href":"/docs/api/management/v2/organizations/put-organizations-by-id-organization-templates-by-template-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{id}/roles/{role_id}/members","playground":"interactive","deprecated":false,"title":"List the members assigned to a role in the context of an organization","href":"/docs/api/management/v2/organizations/get-organization-role-members"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{organization_id}/groups","playground":"interactive","deprecated":false,"title":"List the groups that are assigned to the organization.","href":"/docs/api/management/v2/organizations/get-organization-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{organization_id}/groups/{group_id}/roles","playground":"interactive","deprecated":false,"title":"List the roles assigned to a group in the context of an organization.","href":"/docs/api/management/v2/organizations/get-organization-group-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /organizations/{organization_id}/groups/{group_id}/roles","playground":"interactive","deprecated":false,"title":"Remove roles assigned to a group in an organization context.","href":"/docs/api/management/v2/organizations/delete-organization-group-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /organizations/{organization_id}/groups/{group_id}/roles","playground":"interactive","deprecated":false,"title":"Assign roles to a group in an organization context.","href":"/docs/api/management/v2/organizations/post-organization-group-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /organizations/{organization_id}/roles/{role_id}/groups","playground":"interactive","deprecated":false,"title":"List the groups assigned to a role in the context of an organization","href":"/docs/api/management/v2/organizations/get-organization-role-groups"}]},{"group":"Prompts","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /prompts","playground":"interactive","deprecated":false,"title":"Get prompt settings","href":"/docs/api/management/v2/prompts/get-prompts"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /prompts","playground":"interactive","deprecated":false,"title":"Update prompt settings","href":"/docs/api/management/v2/prompts/patch-prompts"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /prompts/rendering","playground":"interactive","deprecated":false,"title":"Get render setting configurations for all screens","href":"/docs/api/management/v2/prompts/get-all-rendering"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /prompts/rendering","playground":"interactive","deprecated":false,"title":"Update render settings for multiple screens","href":"/docs/api/management/v2/prompts/patch-bulk-rendering"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /prompts/{prompt}/custom-text/{language}","playground":"interactive","deprecated":false,"title":"Get custom text for a prompt","href":"/docs/api/management/v2/prompts/get-custom-text-by-language"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /prompts/{prompt}/custom-text/{language}","playground":"interactive","deprecated":false,"title":"Set custom text for a specific prompt","href":"/docs/api/management/v2/prompts/put-custom-text-by-language"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /prompts/{prompt}/partials","playground":"interactive","deprecated":false,"title":"Get partials for a prompt","href":"/docs/api/management/v2/prompts/get-partials"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /prompts/{prompt}/partials","playground":"interactive","deprecated":false,"title":"Set partials for a prompt","href":"/docs/api/management/v2/prompts/put-partials"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /prompts/{prompt}/screen/{screen}/rendering","playground":"interactive","deprecated":false,"title":"Get render settings for a screen","href":"/docs/api/management/v2/prompts/get-rendering"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /prompts/{prompt}/screen/{screen}/rendering","playground":"interactive","deprecated":false,"title":"Update render settings for a screen","href":"/docs/api/management/v2/prompts/patch-rendering"}]},{"group":"Rate Limit Policies","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /rate-limit-policies","playground":"interactive","deprecated":false,"title":"Get rate limit policies","href":"/docs/api/management/v2/rate-limit-policies/get-rate-limit-policies"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /rate-limit-policies","playground":"interactive","deprecated":false,"title":"Create a rate limit policy","href":"/docs/api/management/v2/rate-limit-policies/post-rate-limit-policies"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /rate-limit-policies/{id}","playground":"interactive","deprecated":false,"title":"Get a rate limit policy","href":"/docs/api/management/v2/rate-limit-policies/get-rate-limit-policies-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /rate-limit-policies/{id}","playground":"interactive","deprecated":false,"title":"Delete a rate limit policy","href":"/docs/api/management/v2/rate-limit-policies/delete-rate-limit-policies-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /rate-limit-policies/{id}","playground":"interactive","deprecated":false,"title":"Update a rate limit policy","href":"/docs/api/management/v2/rate-limit-policies/patch-rate-limit-policies-by-id"}]},{"group":"Refresh Tokens","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /refresh-tokens","playground":"interactive","deprecated":false,"title":"Get refresh tokens","href":"/docs/api/management/v2/refresh-tokens/get-refresh-tokens"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /refresh-tokens/revoke","playground":"interactive","deprecated":false,"title":"Revoke refresh tokens","href":"/docs/api/management/v2/refresh-tokens/revoke-refresh-tokens"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /refresh-tokens/{id}","playground":"interactive","deprecated":false,"title":"Get a refresh token","href":"/docs/api/management/v2/refresh-tokens/get-refresh-token"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /refresh-tokens/{id}","playground":"interactive","deprecated":false,"title":"Delete a refresh token","href":"/docs/api/management/v2/refresh-tokens/delete-refresh-token"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /refresh-tokens/{id}","playground":"interactive","deprecated":false,"title":"Update a refresh token","href":"/docs/api/management/v2/refresh-tokens/patch-refresh-tokens-by-id"}]},{"group":"Resource Servers","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /resource-servers","playground":"interactive","deprecated":false,"title":"Get resource servers","href":"/docs/api/management/v2/resource-servers/get-resource-servers"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /resource-servers","playground":"interactive","deprecated":false,"title":"Create a resource server","href":"/docs/api/management/v2/resource-servers/post-resource-servers"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /resource-servers/search","playground":"interactive","deprecated":false,"title":"Search resource servers","href":"/docs/api/management/v2/resource-servers/get-resource-servers-search"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /resource-servers/{id}","playground":"interactive","deprecated":false,"title":"Get a resource server","href":"/docs/api/management/v2/resource-servers/get-resource-servers-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /resource-servers/{id}","playground":"interactive","deprecated":false,"title":"Delete a resource server","href":"/docs/api/management/v2/resource-servers/delete-resource-servers-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /resource-servers/{id}","playground":"interactive","deprecated":false,"title":"Update a resource server","href":"/docs/api/management/v2/resource-servers/patch-resource-servers-by-id"}]},{"group":"Risk Assessments","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /risk-assessments/settings","playground":"interactive","deprecated":false,"title":"Get risk assessment settings","href":"/docs/api/management/v2/risk-assessments/get-risk-assessments-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /risk-assessments/settings","playground":"interactive","deprecated":false,"title":"Update risk assessment settings","href":"/docs/api/management/v2/risk-assessments/patch-risk-assessments-settings"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /risk-assessments/settings/new-device","playground":"interactive","deprecated":false,"title":"Get new device assessor","href":"/docs/api/management/v2/risk-assessments/get-new-device"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /risk-assessments/settings/new-device","playground":"interactive","deprecated":false,"title":"Update new device assessor","href":"/docs/api/management/v2/risk-assessments/patch-new-device"}]},{"group":"Roles","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /roles","playground":"interactive","deprecated":false,"title":"Get roles","href":"/docs/api/management/v2/roles/get-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /roles","playground":"interactive","deprecated":false,"title":"Create a role","href":"/docs/api/management/v2/roles/post-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /roles/{id}","playground":"interactive","deprecated":false,"title":"Get a role","href":"/docs/api/management/v2/roles/get-roles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /roles/{id}","playground":"interactive","deprecated":false,"title":"Delete a role","href":"/docs/api/management/v2/roles/delete-roles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /roles/{id}","playground":"interactive","deprecated":false,"title":"Update a role","href":"/docs/api/management/v2/roles/patch-roles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /roles/{id}/groups","playground":"interactive","deprecated":false,"title":"Get a role's groups","href":"/docs/api/management/v2/roles/get-role-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /roles/{id}/groups","playground":"interactive","deprecated":false,"title":"Remove groups from a role","href":"/docs/api/management/v2/roles/delete-role-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /roles/{id}/groups","playground":"interactive","deprecated":false,"title":"Assign groups to a role","href":"/docs/api/management/v2/roles/post-role-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /roles/{id}/permissions","playground":"interactive","deprecated":false,"title":"Get permissions granted by role","href":"/docs/api/management/v2/roles/get-role-permission"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /roles/{id}/permissions","playground":"interactive","deprecated":false,"title":"Remove permissions from a role","href":"/docs/api/management/v2/roles/delete-role-permission-assignment"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /roles/{id}/permissions","playground":"interactive","deprecated":false,"title":"Associate permissions with a role","href":"/docs/api/management/v2/roles/post-role-permission-assignment"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /roles/{id}/users","playground":"interactive","deprecated":false,"title":"Get a role's users","href":"/docs/api/management/v2/roles/get-role-user"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /roles/{id}/users","playground":"interactive","deprecated":false,"title":"Assign users to a role","href":"/docs/api/management/v2/roles/post-role-users"}]},{"group":"Rules","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /rules","playground":"interactive","deprecated":false,"title":"Get rules","href":"/docs/api/management/v2/rules/get-rules"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /rules","playground":"interactive","deprecated":false,"title":"Create a rule","href":"/docs/api/management/v2/rules/post-rules"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /rules/{id}","playground":"interactive","deprecated":false,"title":"Get a rule","href":"/docs/api/management/v2/rules/get-rules-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /rules/{id}","playground":"interactive","deprecated":false,"title":"Delete a rule","href":"/docs/api/management/v2/rules/delete-rules-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /rules/{id}","playground":"interactive","deprecated":false,"title":"Update a rule","href":"/docs/api/management/v2/rules/patch-rules-by-id"}]},{"group":"Rules Configs","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /rules-configs","playground":"interactive","deprecated":false,"title":"Retrieve config variable keys for rules (get_rules-configs)","href":"/docs/api/management/v2/rules-configs/get-rules-configs"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /rules-configs/{key}","playground":"interactive","deprecated":false,"title":"Delete rules config for a given key","href":"/docs/api/management/v2/rules-configs/delete-rules-configs-by-key"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /rules-configs/{key}","playground":"interactive","deprecated":false,"title":"Set rules config for a given key","href":"/docs/api/management/v2/rules-configs/put-rules-configs-by-key"}]},{"group":"Self Service Profiles","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /self-service-profiles","playground":"interactive","deprecated":false,"title":"Get self-service profiles","href":"/docs/api/management/v2/self-service-profiles/get-self-service-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /self-service-profiles","playground":"interactive","deprecated":false,"title":"Create a self-service profile","href":"/docs/api/management/v2/self-service-profiles/post-self-service-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /self-service-profiles/{id}","playground":"interactive","deprecated":false,"title":"Get a self-service profile by Id","href":"/docs/api/management/v2/self-service-profiles/get-self-service-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /self-service-profiles/{id}","playground":"interactive","deprecated":false,"title":"Delete a self-service profile by Id","href":"/docs/api/management/v2/self-service-profiles/delete-self-service-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /self-service-profiles/{id}","playground":"interactive","deprecated":false,"title":"Update a self-service profile","href":"/docs/api/management/v2/self-service-profiles/patch-self-service-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /self-service-profiles/{id}/custom-text/{language}/{page}","playground":"interactive","deprecated":false,"title":"Get custom text for a self-service profile","href":"/docs/api/management/v2/self-service-profiles/get-self-service-profile-custom-text"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /self-service-profiles/{id}/custom-text/{language}/{page}","playground":"interactive","deprecated":false,"title":"Set custom text for a self-service profile","href":"/docs/api/management/v2/self-service-profiles/put-self-service-profile-custom-text"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /self-service-profiles/{id}/sso-ticket","playground":"interactive","deprecated":false,"title":"Create an access ticket to initiate the Self-Service Enterprise Configuration flow","href":"/docs/api/management/v2/self-service-profiles/post-sso-ticket"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /self-service-profiles/{profileId}/sso-ticket/{id}/revoke","playground":"interactive","deprecated":false,"title":"Revoke a Self-Service Enterprise Configuration access ticket","href":"/docs/api/management/v2/self-service-profiles/post-revoke"}]},{"group":"Sessions","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /sessions/{id}","playground":"interactive","deprecated":false,"title":"Get session","href":"/docs/api/management/v2/sessions/get-session"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /sessions/{id}","playground":"interactive","deprecated":false,"title":"Delete session","href":"/docs/api/management/v2/sessions/delete-session"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /sessions/{id}","playground":"interactive","deprecated":false,"title":"Update session","href":"/docs/api/management/v2/sessions/patch-sessions-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /sessions/{id}/revoke","playground":"interactive","deprecated":false,"title":"Revokes a session","href":"/docs/api/management/v2/sessions/revoke-session"}]},{"group":"Stats","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /stats/active-users","playground":"interactive","deprecated":false,"title":"Get active users count","href":"/docs/api/management/v2/stats/get-active-users"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /stats/daily","playground":"interactive","deprecated":false,"title":"Get daily stats","href":"/docs/api/management/v2/stats/get-daily"}]},{"group":"Supplemental Signals","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /supplemental-signals","playground":"interactive","deprecated":false,"title":"Get the supplemental signals configuration for a tenant","href":"/docs/api/management/v2/supplemental-signals/get-supplemental-signals"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /supplemental-signals","playground":"interactive","deprecated":false,"title":"Update the supplemental signals configuration for a tenant","href":"/docs/api/management/v2/supplemental-signals/patch-supplemental-signals"}]},{"group":"Tenants","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /tenants/settings","playground":"interactive","deprecated":false,"title":"Get tenant settings","href":"/docs/api/management/v2/tenants/tenant-settings-route"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /tenants/settings","playground":"interactive","deprecated":false,"title":"Update tenant settings","href":"/docs/api/management/v2/tenants/patch-settings"}]},{"group":"Tickets","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json POST /tickets/email-verification","playground":"interactive","deprecated":false,"title":"Create an email verification ticket","href":"/docs/api/management/v2/tickets/post-email-verification"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /tickets/password-change","playground":"interactive","deprecated":false,"title":"Create a password change ticket","href":"/docs/api/management/v2/tickets/post-password-change"}]},{"group":"Token Exchange Profiles","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /token-exchange-profiles","playground":"interactive","deprecated":false,"title":"Get token exchange profiles","href":"/docs/api/management/v2/token-exchange-profiles/get-token-exchange-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /token-exchange-profiles","playground":"interactive","deprecated":false,"title":"Create a token exchange profile","href":"/docs/api/management/v2/token-exchange-profiles/post-token-exchange-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /token-exchange-profiles/{id}","playground":"interactive","deprecated":false,"title":"Get a token exchange profile","href":"/docs/api/management/v2/token-exchange-profiles/get-token-exchange-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /token-exchange-profiles/{id}","playground":"interactive","deprecated":false,"title":"Delete a token exchange profile","href":"/docs/api/management/v2/token-exchange-profiles/delete-token-exchange-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /token-exchange-profiles/{id}","playground":"interactive","deprecated":false,"title":"Update an existing token exchange profile","href":"/docs/api/management/v2/token-exchange-profiles/patch-token-exchange-profiles-by-id"}]},{"group":"User Attribute Profiles","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-attribute-profiles","playground":"interactive","deprecated":false,"title":"Get User Attribute Profiles","href":"/docs/api/management/v2/user-attribute-profiles/get-user-attribute-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /user-attribute-profiles","playground":"interactive","deprecated":false,"title":"Post User Attribute Profile","href":"/docs/api/management/v2/user-attribute-profiles/post-user-attribute-profiles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-attribute-profiles/templates","playground":"interactive","deprecated":false,"title":"Get User Attribute Profile Templates","href":"/docs/api/management/v2/user-attribute-profiles/get-user-attribute-profile-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-attribute-profiles/templates/{id}","playground":"interactive","deprecated":false,"title":"Get User Attribute Profile Template","href":"/docs/api/management/v2/user-attribute-profiles/get-user-attribute-profile-template"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-attribute-profiles/{id}","playground":"interactive","deprecated":false,"title":"Get User Attribute Profile","href":"/docs/api/management/v2/user-attribute-profiles/get-user-attribute-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /user-attribute-profiles/{id}","playground":"interactive","deprecated":false,"title":"Delete User Attribute Profile","href":"/docs/api/management/v2/user-attribute-profiles/delete-user-attribute-profiles-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /user-attribute-profiles/{id}","playground":"interactive","deprecated":false,"title":"Modify a user attribute profile","href":"/docs/api/management/v2/user-attribute-profiles/patch-user-attribute-profiles-by-id"}]},{"group":"User Blocks","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-blocks","playground":"interactive","deprecated":false,"title":"Get blocks by identifier","href":"/docs/api/management/v2/user-blocks/get-user-blocks"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /user-blocks","playground":"interactive","deprecated":false,"title":"Unblock by identifier","href":"/docs/api/management/v2/user-blocks/delete-user-blocks"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /user-blocks/{id}","playground":"interactive","deprecated":false,"title":"Get a user's blocks","href":"/docs/api/management/v2/user-blocks/get-user-blocks-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /user-blocks/{id}","playground":"interactive","deprecated":false,"title":"Unblock a user","href":"/docs/api/management/v2/user-blocks/delete-user-blocks-by-id"}]},{"group":"Users","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users","playground":"interactive","deprecated":false,"title":"List or Search Users","href":"/docs/api/management/v2/users/get-users"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users","playground":"interactive","deprecated":false,"title":"Create a User","href":"/docs/api/management/v2/users/post-users"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}","playground":"interactive","deprecated":false,"title":"Get a User","href":"/docs/api/management/v2/users/get-users-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}","playground":"interactive","deprecated":false,"title":"Delete a User","href":"/docs/api/management/v2/users/delete-users-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /users/{id}","playground":"interactive","deprecated":false,"title":"Update a User","href":"/docs/api/management/v2/users/patch-users-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/authentication-methods","playground":"interactive","deprecated":false,"title":"Get a list of authentication methods","href":"/docs/api/management/v2/users/get-authentication-methods"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/authentication-methods","playground":"interactive","deprecated":false,"title":"Delete all authentication methods for the given user","href":"/docs/api/management/v2/users/delete-authentication-methods"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/authentication-methods","playground":"interactive","deprecated":false,"title":"Creates an authentication method for a given user","href":"/docs/api/management/v2/users/post-authentication-methods"},{"openapi":"docs/oas/management/v2/management-api-oas.json PUT /users/{id}/authentication-methods","playground":"interactive","deprecated":false,"title":"Update all authentication methods by replacing them with the given ones","href":"/docs/api/management/v2/users/put-authentication-methods"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/authentication-methods/{authentication_method_id}","playground":"interactive","deprecated":false,"title":"Get an authentication method by ID","href":"/docs/api/management/v2/users/get-authentication-methods-by-authentication-method-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/authentication-methods/{authentication_method_id}","playground":"interactive","deprecated":false,"title":"Delete an authentication method by ID","href":"/docs/api/management/v2/users/delete-authentication-methods-by-authentication-method-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /users/{id}/authentication-methods/{authentication_method_id}","playground":"interactive","deprecated":false,"title":"Update an authentication method","href":"/docs/api/management/v2/users/patch-authentication-methods-by-authentication-method-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/authenticators","playground":"interactive","deprecated":false,"title":"Delete All Authenticators","href":"/docs/api/management/v2/users/delete-authenticators"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/connected-accounts","playground":"interactive","deprecated":false,"title":"Get a User's Connected Accounts","href":"/docs/api/management/v2/users/get-connected-accounts"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/effective-permissions","playground":"interactive","deprecated":false,"title":"List the permissions assigned to a user directly or through roles or groups.","href":"/docs/api/management/v2/users/get-user-effective-permissions"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/effective-permissions/sources/effective-roles","playground":"interactive","deprecated":false,"title":"List the roles which grant the user a given permission (whether directly or through groups).","href":"/docs/api/management/v2/users/get-user-effective-permission-role-sources"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/effective-roles","playground":"interactive","deprecated":false,"title":"List the roles for a user with sources: directly assigned or through group membership.","href":"/docs/api/management/v2/users/get-user-effective-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/effective-roles/sources/groups","playground":"interactive","deprecated":false,"title":"Get a user's role source groups","href":"/docs/api/management/v2/users/get-user-role-source-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/enrollments","playground":"interactive","deprecated":false,"title":"Get the First Confirmed Multi-factor Authentication (MFA) Enrollment","href":"/docs/api/management/v2/users/get-enrollments"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/groups","playground":"interactive","deprecated":false,"title":"Get user's groups","href":"/docs/api/management/v2/users/get-user-groups"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/identities","playground":"interactive","deprecated":false,"title":"Link a User Account","href":"/docs/api/management/v2/users/post-identities"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/identities/{provider}/{user_id}","playground":"interactive","deprecated":false,"title":"Unlink a User Identity","href":"/docs/api/management/v2/users/delete-user-identity-by-user-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/logs","playground":"interactive","deprecated":false,"title":"Get user's log events","href":"/docs/api/management/v2/users/get-logs-by-user"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/multifactor/actions/invalidate-remember-browser","playground":"interactive","deprecated":false,"title":"Invalidate All Remembered Browsers for Multi-factor Authentication (MFA)","href":"/docs/api/management/v2/users/post-invalidate-remember-browser"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/multifactor/{provider}","playground":"interactive","deprecated":false,"title":"Delete a User's Multi-factor Provider","href":"/docs/api/management/v2/users/delete-multifactor-by-provider"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/organizations","playground":"interactive","deprecated":false,"title":"List user's organizations","href":"/docs/api/management/v2/users/get-user-organizations"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/permissions","playground":"interactive","deprecated":false,"title":"Get a User's Permissions","href":"/docs/api/management/v2/users/get-permissions"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/permissions","playground":"interactive","deprecated":false,"title":"Remove Permissions from a User","href":"/docs/api/management/v2/users/delete-permissions"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/permissions","playground":"interactive","deprecated":false,"title":"Assign Permissions to a User","href":"/docs/api/management/v2/users/post-permissions"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/recovery-code-regeneration","playground":"interactive","deprecated":false,"title":"Generate New Multi-factor Authentication (MFA) Recovery Code","href":"/docs/api/management/v2/users/post-recovery-code-regeneration"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/revoke-access","playground":"interactive","deprecated":false,"title":"Revokes selected resources from a user","href":"/docs/api/management/v2/users/user-revoke-access"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/risk-assessments/clear","playground":"interactive","deprecated":false,"title":"Clear risk assessment assessors for a specific user","href":"/docs/api/management/v2/users/post-clear-assessors"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{id}/roles","playground":"interactive","deprecated":false,"title":"Get a user's roles","href":"/docs/api/management/v2/users/get-user-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{id}/roles","playground":"interactive","deprecated":false,"title":"Remove roles from a user","href":"/docs/api/management/v2/users/delete-user-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /users/{id}/roles","playground":"interactive","deprecated":false,"title":"Assign roles to a user","href":"/docs/api/management/v2/users/post-user-roles"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{user_id}/refresh-tokens","playground":"interactive","deprecated":false,"title":"Get refresh tokens for a user","href":"/docs/api/management/v2/users/get-refresh-tokens-for-user"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{user_id}/refresh-tokens","playground":"interactive","deprecated":false,"title":"Delete refresh tokens for a user","href":"/docs/api/management/v2/users/delete-refresh-tokens-for-user"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users/{user_id}/sessions","playground":"interactive","deprecated":false,"title":"Get sessions for user","href":"/docs/api/management/v2/users/get-sessions-for-user"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /users/{user_id}/sessions","playground":"interactive","deprecated":false,"title":"Delete sessions for user","href":"/docs/api/management/v2/users/delete-sessions-for-user"}]},{"group":"Users By Email","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /users-by-email","playground":"interactive","deprecated":false,"title":"Search Users by Email","href":"/docs/api/management/v2/users-by-email/get-users-by-email"}]},{"group":"Verifiable Credentials","pages":[{"openapi":"docs/oas/management/v2/management-api-oas.json GET /verifiable-credentials/verification/templates","playground":"interactive","deprecated":false,"title":"List verifiable credential templates for a tenant.","href":"/docs/api/management/v2/verifiable-credentials/get-vc-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json POST /verifiable-credentials/verification/templates","playground":"interactive","deprecated":false,"title":"Create a verifiable credential template.","href":"/docs/api/management/v2/verifiable-credentials/post-vc-templates"},{"openapi":"docs/oas/management/v2/management-api-oas.json GET /verifiable-credentials/verification/templates/{id}","playground":"interactive","deprecated":false,"title":"Get a verifiable credential template by ID.","href":"/docs/api/management/v2/verifiable-credentials/get-vc-templates-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json DELETE /verifiable-credentials/verification/templates/{id}","playground":"interactive","deprecated":false,"title":"Delete a verifiable credential template by ID.","href":"/docs/api/management/v2/verifiable-credentials/delete-vc-templates-by-id"},{"openapi":"docs/oas/management/v2/management-api-oas.json PATCH /verifiable-credentials/verification/templates/{id}","playground":"interactive","deprecated":false,"title":"Update a verifiable credential template by ID.","href":"/docs/api/management/v2/verifiable-credentials/patch-vc-templates-by-id"}]}]},{"group":"Authentication API","icon":"list","root":{"title":"Authentication API","href":"/docs/api/authentication"},"pages":[{"group":"Login","pages":[{"title":"Social","sidebarTitle":"Social","href":"/docs/api/authentication/login/index"},{"title":"Database/AD/LDAP (Passive)","href":"/docs/api/authentication/login/authenticate-using-database"},{"title":"Enterprise (SAML and Others)","href":"/docs/api/authentication/login/enterprise-saml-and-others"}]},{"group":"Logout","pages":[{"title":"Auth0 Logout","href":"/docs/api/authentication/logout/auth-0-logout"},{"title":"OIDC Logout","href":"/docs/api/authentication/logout/oidc-logout"},{"title":"SAML Logout","href":"/docs/api/authentication/logout/saml-logout"},{"title":"Global Token Revocation","href":"/docs/api/authentication/logout/global-token-revocation"}]},{"group":"Back-Channel Authentication","pages":[{"title":"Back-Channel Login","href":"/docs/api/authentication/login/start-back-channel-login"},{"title":"Back-Channel Login flow - Status Check","href":"/docs/api/authentication/login/check-back-channel-login-status"}]},{"group":"Passwordless","pages":[{"title":"Get Code or Link","href":"/docs/api/authentication/passwordless/get-code-or-link"},{"title":"Authenticate User","href":"/docs/api/authentication/passwordless/authenticate-user"},{"title":"Verify","href":"/docs/api/authentication/passwordless/verify"}]},{"group":"Passkeys","pages":[{"title":"Start a Passkey Challenge","href":"/docs/api/authentication/passkey/challenge"},{"title":"Register a New User With a Passkey","href":"/docs/api/authentication/passkey/register"}]},{"group":"Signup","pages":[{"title":"Create a new user","href":"/docs/api/authentication/signup/create-a-new-user"}]},{"group":"Change Password","pages":[{"title":"Change Password","href":"/docs/api/authentication/change-password/change-password"}]},{"group":"User Profile","pages":[{"title":"Get User Info","href":"/docs/api/authentication/user-profile/get-user-info"}]},{"group":"Multi Factor Authentication","pages":[{"title":"Challenge Request","href":"/docs/api/authentication/multi-factor-authentication/request-mfa-challenge"},{"title":"Verify multi-factor authentication with one-time password (OTP)","href":"/docs/api/authentication/multi-factor-authentication/verify-mfa-with-otp"},{"title":"Verify with Out-of-Band (OOB)","href":"/docs/api/authentication/multi-factor-authentication/verify-with-out-of-band"},{"title":"Verify with Recovery Code","href":"/docs/api/authentication/multi-factor-authentication/verify-with-recovery-code"},{"title":"Add an Authenticator","href":"/docs/api/authentication/multi-factor-authentication/add-an-authenticator"},{"title":"List Authenticators","href":"/docs/api/authentication/multi-factor-authentication/list-authenticators"},{"title":"Delete an Authenticator","href":"/docs/api/authentication/multi-factor-authentication/delete-authenticator"}]},{"group":"SAML","pages":[{"title":"Accept Request","href":"/docs/api/authentication/saml/accept-saml-request"},{"title":"Get Metadata","href":"/docs/api/authentication/saml/get-saml-metadata"},{"title":"IdP-Initiated Single Sign-On (SSO) Flow","href":"/docs/api/authentication/saml/idp-initiated-sso"}]},{"group":"WS Federation","pages":[{"title":"Accept WS-Federation Request","href":"/docs/api/authentication/ws-federation/accept-ws-federation-request"},{"title":"Get WS-Federation Metadata","href":"/docs/api/authentication/ws-federation/get-ws-federation-metadata"}]},{"group":"Dynamic Application (Client) Registration","pages":[{"title":"Dynamic Application Registration","href":"/docs/api/authentication/dynamic-application-client-registration/dynamic-application-registration"}]},{"group":"Authorization Code Flow","pages":[{"title":"Authorize Application","href":"/docs/api/authentication/authorization-code-flow/authorize-application"},{"title":"Get Token","href":"/docs/api/authentication/authorization-code-flow/get-token"}]},{"group":"Authorization Code Flow with PKCE","pages":[{"title":"Authorize","href":"/docs/api/authentication/authorization-code-flow-with-pkce/authorize-with-pkce"},{"title":"Get Token","href":"/docs/api/authentication/authorization-code-flow-with-pkce/get-token-pkce"}]},{"group":"Authorization Code Flow with Enhanced Privacy Protection","pages":[{"title":"Push Authorization Requests (PAR)","href":"/docs/api/authentication/authorization-code-flow-with-enhanced-privacy-protection/push-authorization-requests"},{"title":"Authorize","href":"/docs/api/authentication/authorization-code-flow-with-enhanced-privacy-protection/authorize"},{"title":"Exchange Authorization Code for Token","href":"/docs/api/authentication/authorization-code-flow-with-enhanced-privacy-protection/exchange-authorization-code-for-token"}]},{"group":"Client Credential Flow","pages":[{"title":"Get Token","href":"/docs/api/authentication/client-credential-flow/get-token"}]},{"group":"Implicit Flow","pages":[{"title":"Authorize","href":"/docs/api/authentication/implicit-flow/authorize"}]},{"group":"Custom Token Exchange","pages":[{"title":"Get Token","href":"/docs/api/authentication/custom-token-exchange/get-token"}]},{"group":"On-Behalf-Of Token Exchange","pages":[{"title":"Get Token","href":"/docs/api/authentication/on-behalf-of-token-exchange/get-token"}]},{"group":"Cross App Access Flow","pages":[{"title":"Get Token","href":"/docs/api/authentication/cross-app-access/get-token"}]},{"group":"Token Vault Token Exchange","pages":[{"title":"Get Token","href":"/docs/api/authentication/token-vault-token-exchange/get-token"}]},{"group":"Resource Owner Password Flow","pages":[{"title":"Get Token","href":"/docs/api/authentication/resource-owner-password-flow/get-token"}]},{"group":"Device Authorization Flow","pages":[{"title":"Authorize Device","href":"/docs/api/authentication/device-authorization-flow/authorize-device"}]},{"group":"Refresh Token","pages":[{"title":"Refresh Access Token","href":"/docs/api/authentication/refresh-token/refresh-token"}]},{"group":"Revoke Refresh Token","pages":[{"title":"Revoke a Refresh Token","href":"/docs/api/authentication/revoke-refresh-token/revoke-refresh-token"}]},{"group":"Token Exchange for Native Social","pages":[{"title":"Token Exchange for Native Social","href":"/docs/api/authentication/token-exchange-for-native-social/token-exchange-native-social"}]},{"group":"Login [Legacy]","pages":[{"title":"Social with Provider's Access Token","href":"/docs/api/authentication/login-legacy/social-with-providers-access-token"},{"title":"Database/AD/LDAP (Active)","href":"/docs/api/authentication/login-legacy/database-ad-lapd-active"}]},{"group":"User Profile [Legacy]","pages":[{"title":"Get Token Info","href":"/docs/api/authentication/user-profile-legacy/get-token-info"}]},{"group":"Account Linking [Legacy]","pages":[{"title":"Link","href":"/docs/api/authentication/account-linking-legacy/link"},{"title":"Unlink","href":"/docs/api/authentication/account-linking-legacy/unlink"}]},{"group":"Delegation [Legacy]","pages":[{"title":"Delegation","href":"/docs/api/authentication/delegation-legacy/delegation"}]},{"group":"Impersonation [Legacy]","pages":[{"title":"Impersonation","href":"/docs/api/authentication/impersonation-legacy/impersonation"}]},{"group":"Resource Owner [Legacy]","pages":[{"title":"Resource Owner Password Grant","href":"/docs/api/authentication/resource-owner-legacy/resource-owner-password-grant"}]}]}]},{"item":"SDKs","icon":"cube","pages":[{"title":"SDKs","href":"/docs/libraries"}]},{"item":"Events Catalog","icon":"notes","pages":[{"title":"Events Catalog","href":"/docs/events"}]},{"item":"Actions Reference","icon":"square-bolt","pages":[{"title":"Actions Reference","href":"/docs/actions/reference"}]},{"item":"Tenant Log Catalog","icon":"square-list","pages":[{"title":"Tenant Log Catalog","href":"/docs/tenant-logs"}]},{"item":"Universal Components","icon":"objects-column","pages":[{"title":"Universal Components","href":"/docs/get-started/universal-components/universal-components-overview"}]}]}]},{"language":"fr","pages":[{"title":"fr","href":"/docs/fr-ca/api/management/v2/events/subscribe-events"}]},{"language":"ja","pages":[{"title":"ja","href":"/docs/ja-jp/api/management/v2/events/subscribe-events"}]}]},"basePath":"","title":"Subscribe to events via Server-Sent Events (SSE) - Auth0 Docs","buildId":"dpl_36EDyZCDfRuoUD9af5CH4M1bqY2h","deploymentId":"dpl_36EDyZCDfRuoUD9af5CH4M1bqY2h","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-DCDCdBVX.js","utils-ME8dDnLe.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-0e84ACsd.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-wgRBj-ia.js","snippetPresets-C11Sgb-o.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-C0lapOpP.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-ZeRQV8fF.js","shallow-BupWh095.js","getApiPlaygroundDisplay-BnYQO2Ss.js","CodeSnippet-RKKOc8c_.js","CodeSnippets-Drf_m8wS.js","Page-Bevw23-4.js","getPastedJson-u6QiPzNZ.js","icon-Bb-CBSxO.js","MethodPill-F7l5AI7V.js","DuplicateIcon-IiAXkdSg.js","createIcon-FliI8EBc.js","DynamicMarkdown-B62XqCSI.js","SectionHeading-Dj31pT03.js","axios-vUo_bRtp.js","Markdown-BOgQCTwD.js","clsx-BIWXJmsZ.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-DKZWslLH.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-UDqbR6xh.js"]}