{ "info": { "name": "Sphereon Developer Console", "_postman_id": "sphereon-developer-console", "description": "Deployment-aware, secret-free mirror of the policy-filtered Developer Console catalog. Operations are grouped Product > Guide > Story; read each request description and the mounted Scalar/OpenAPI contract before execution.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "name": "edk", "description": "EDK operations exposed by the deployment's policy-filtered OpenAPI catalog.", "item": [ { "name": "application-bff-oauth-client", "description": "Operations associated with the application-bff-oauth-client guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "application-bff-oauth-client-operations", "description": "application-bff-oauth-client-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Complete an OAuth authorization response", "disabled": true, "request": { "description": "Atomically consumes the one-time state, validates the exact RFC 9207 response\nissuer, redirect URI, nonce, selected binding, ID token, and signed access\ntoken, then attaches or replaces the selected resource grant. The owner handle is\nrecovered from encrypted server-side state correlation, so no browser cookie is\nrequired on a cross-site form_post callback.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.completeBffOAuthAuthorization\"}" } } }, { "name": "Resolve a short-lived access token", "disabled": true, "request": { "description": "Returns only a currently valid short-lived access token to the authenticated\nBFF. Refresh is performed backend-side and cross-node serialized. Refresh\ntokens and ID tokens are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.resolveBffOAuthAccessToken\"}" } } }, { "name": "Revoke one exact resource grant", "disabled": true, "request": { "description": "Revokes only the grant bound to the registered public origin, resource kind, instance, and opaque owner.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.revokeBffOAuthGrant\"}" } } }, { "name": "Start an OAuth authorization transaction", "disabled": true, "request": { "description": "Resolves the canonical testing-console AS/client binding for the selected\nissuer or verifier instance. If ownerHandle is absent, creates a new opaque\nbrowser owner handle. The authorization state, nonce, PKCE verifier, metadata,\nand binding remain backend-side.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.startBffOAuthAuthorization\"}" } } }, { "name": "Get one exact resource grant", "disabled": true, "request": { "description": "Returns only the grant bound to the registered public origin, resource kind, instance, and opaque owner.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.getBffOAuthStatus\"}" } } } ] } ] }, { "name": "asset", "description": "Operations associated with the asset guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "asset-operations", "description": "asset-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List assets", "disabled": true, "request": { "description": "Lists the caller-tenant's assets in the namespace as a plain array. The optional `contentType` filter restricts to assets whose content type starts with the given value (for example `image/`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.listAssets\"}" } } }, { "name": "Upload an asset", "disabled": true, "request": { "description": "Uploads an asset into the caller-tenant's library as raw bytes. The stored content type is taken from the request `Content-Type` header, which is authoritative. The asset is content-addressed by the SHA-256 hash of its bytes and deduplicated within the tenant and namespace: re-uploading identical bytes returns a reference to the already-stored asset instead of creating a new one. Returns an [AssetReference] whose `uri` is the stable public hosting path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.uploadAsset\"}" } } }, { "name": "Delete an asset", "disabled": true, "request": { "description": "Deletes a stored asset by its SHA-256 content hash and returns no response body when successful. The public hosting URL stops resolving for this tenant and namespace.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.deleteAsset\"}" } } }, { "name": "Get an asset", "disabled": true, "request": { "description": "Returns the descriptor of one stored asset by its SHA-256 content hash. The asset bytes themselves are served from the public hosting path in the descriptor's `uri`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.getAsset\"}" } } }, { "name": "Download a public asset", "request": { "description": "Serves the raw bytes of a stored asset from its stable tenant-scoped, content-addressed\npublic URL. The response `Content-Type` is whatever the asset was stored as. Because the\nasset id is the SHA-256 content hash, the body can never change for a given URL, so the\nresponse is served with `Cache-Control: public, max-age=31536000, immutable`. Returns 404\nfor an unknown tenant, namespace, or asset.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/assets/{tenantId}/{namespace}/{asset}" } } ] } ] }, { "name": "audit", "description": "Operations associated with the audit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "audit-operations", "description": "audit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List audit events", "disabled": true, "request": { "description": "Returns immutable EDK audit events for the requested tenant. The query\nfields mirror `AuditQueryFilter` and are AND-combined by the audit query\nservice. Events are ordered newest first by the underlying store.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"audit.listAuditEvents\"}" } } } ] } ] }, { "name": "blob-store", "description": "Operations associated with the blob-store guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "blob-store-operations", "description": "blob-store-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Copy a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.copyBlob\"}" } } }, { "name": "Move a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.moveBlob\"}" } } }, { "name": "Search indexed blob metadata", "disabled": true, "request": { "description": "POST /blobs:search. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.searchBlobs\"}" } } }, { "name": "List blobs and common prefixes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.listBlobs\"}" } } }, { "name": "Delete a blob conditionally", "disabled": true, "request": { "description": "When `If-Match` or `X-Expected-Revision` is supplied, deletion is atomic and fails rather than deleting a newer object. An unconditional request retains BlobService delete behavior.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.deleteBlob\"}" } } }, { "name": "Stream blob bytes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.streamBlob\"}" } } }, { "name": "Get blob metadata without content", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobInfo\"}" } } }, { "name": "Stream a blob into a store", "disabled": true, "request": { "description": "Writes or atomically replaces an opaque object. `If-None-Match: *` is create-only; `If-Match` or `X-Expected-Revision` performs compare-and-set. The service verifies the optional Digest header while consuming the stream and rejects partial writes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.putBlob\"}" } } }, { "name": "Verify a blob against an expected content address", "disabled": true, "request": { "description": "Reads the selected object through the backend integrity path without returning its bytes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyBlobIntegrity\"}" } } }, { "name": "Get store capabilities", "disabled": true, "request": { "description": "GET /stores/{storeId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobStoreCapabilities\"}" } } }, { "name": "Store content by digest", "disabled": true, "request": { "description": "POST /stores/{storeId}/cas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.storeContentAddressedBlob\"}" } } }, { "name": "Stream content by digest", "disabled": true, "request": { "description": "GET /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getContentAddressedBlob\"}" } } }, { "name": "Verify content exists and matches its address", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyContentAddressedBlob\"}" } } }, { "name": "Create a temporary provider URL", "disabled": true, "request": { "description": "POST /stores/{storeId}/temporary-urls. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.createBlobTemporaryUrl\"}" } } } ] } ] }, { "name": "business-conduit", "description": "Operations associated with the business-conduit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "business-conduit-operations", "description": "business-conduit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Discover assignments visible to the current operator", "disabled": true, "request": { "description": "GET /assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.discoverBusinessConduitAssignments\"}" } } }, { "name": "Create a business conduit assignment from a server-authorized offer", "disabled": true, "request": { "description": "POST /assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.createBusinessConduitAssignment\"}" } } }, { "name": "Activate an offered business conduit assignment", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/activation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.activateBusinessConduitAssignment\"}" } } }, { "name": "Initiate an interaction from a single-use opaque capture", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/interactions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.initiateBusinessConduitInteraction\"}" } } }, { "name": "Revalidate an assignment against current Party and policy authority", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/revalidation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.revalidateBusinessConduitAssignment\"}" } } }, { "name": "Revoke an assignment and its active interactions", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/revocation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.revokeBusinessConduitAssignment\"}" } } }, { "name": "Get a UI-safe interaction projection", "disabled": true, "request": { "description": "GET /interactions/{interactionRef}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.getBusinessConduitInteraction\"}" } } }, { "name": "Select an eligible business account", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/account. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.selectBusinessConduitAccount\"}" } } }, { "name": "Submit an approval decision bound to the current interaction revision", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/approval. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.submitBusinessConduitApproval\"}" } } }, { "name": "Execute an approved interaction in the target business wallet", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/execution. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.executeBusinessConduitInteraction\"}" } } } ] } ] }, { "name": "catalog", "description": "Operations associated with the catalog guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "catalog-operations", "description": "catalog-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List catalogs", "disabled": true, "request": { "description": "GET /catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.listCatalogs\"}" } } }, { "name": "Create a catalog", "disabled": true, "request": { "description": "POST /catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.createCatalog\"}" } } }, { "name": "Get a catalog", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.getCatalog\"}" } } }, { "name": "Update a catalog", "disabled": true, "request": { "description": "PUT /catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.updateCatalog\"}" } } }, { "name": "Disable a catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/disable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.disableCatalog\"}" } } }, { "name": "Import a remote TS 11 catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/imports/remote. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.importRemoteCatalog\"}" } } }, { "name": "Import a rulebook-catalog tree", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/imports/rulebooks. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.importRulebooks\"}" } } }, { "name": "Publish a catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.publishCatalog\"}" } } }, { "name": "List SchemaMeta entries in a catalog", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}/schemas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.listSchemas\"}" } } }, { "name": "Author a SchemaMeta", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/schemas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.createSchema\"}" } } }, { "name": "Link a hosted VCT or credential design", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/schemas/link. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.linkSchema\"}" } } }, { "name": "Delete a SchemaMeta", "disabled": true, "request": { "description": "DELETE /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.deleteSchema\"}" } } }, { "name": "Get SchemaMeta", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.getSchema\"}" } } }, { "name": "Update a SchemaMeta", "disabled": true, "request": { "description": "PUT /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.updateSchema\"}" } } } ] } ] }, { "name": "credential-design", "description": "Operations associated with the credential-design guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "credential-design-operations", "description": "credential-design-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List tenant design assets", "disabled": true, "request": { "description": "Lists the caller-tenant's content-addressed, design-agnostic design asset blobs. Optional `assetType` and `contentType` query filters narrow the result. Note that a content-addressed asset stores no asset-type segment, so `assetType` is applied loosely by content-type family (`PDF_TEMPLATE` -> `application/pdf`, `SVG_TEMPLATE` -> `image/svg+xml`, `LOGO` / `BACKGROUND_IMAGE` -> any `image/*`); `contentType` matches by content-type prefix.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listDesignAssets\"}" } } }, { "name": "Upload a tenant design asset", "disabled": true, "request": { "description": "Uploads a design-agnostic, tenant-scoped branding asset as raw bytes. The asset is content-addressed (SHA-256) and deduped within the tenant; the stored content type is taken from the request `Content-Type` header. The `assetType` path segment is informational and does not affect the storage key. Returns a reference to the stored asset.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.uploadTenantAsset\"}" } } }, { "name": "List credential designs", "disabled": true, "request": { "description": "Returns every credential design in the caller's tenant that matches the optional filters, as a plain array.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listCredentialDesigns\"}" } } }, { "name": "Create a credential design", "disabled": true, "request": { "description": "Creates a credential design in the caller's tenant. Fails with `409` if a binding already maps to a design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createCredentialDesign\"}" } } }, { "name": "Find credential designs by binding key", "disabled": true, "request": { "description": "Returns the credential designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findCredentialDesignsByBindingKey\"}" } } }, { "name": "Find credential designs by binding", "disabled": true, "request": { "description": "Returns the credential designs whose bindings match the supplied binding object across every set dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findCredentialDesignsByBinding\"}" } } }, { "name": "Import a credential design", "disabled": true, "request": { "description": "Fetches an external credential design from `sourceUrl`, snapshots the response, maps it for the declared `sourceType`, and persists the canonical design with `hostingMode` set to `CACHED_EXTERNAL`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importCredentialDesign\"}" } } }, { "name": "Resolve a credential design", "disabled": true, "request": { "description": "Resolves a credential design selected by `designId`, a full `binding`, or a `bindingKey` + `bindingValue` pair, returning the merged design with its issuer and verifier designs, render variants, derived hints, applied layers, locked fields, and an ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveCredentialDesign\"}" } } }, { "name": "Delete a credential design", "disabled": true, "request": { "description": "Deletes a credential design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteCredentialDesign\"}" } } }, { "name": "Get a credential design", "disabled": true, "request": { "description": "Returns one credential design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getCredentialDesign\"}" } } }, { "name": "Update a credential design", "disabled": true, "request": { "description": "Updates a credential design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateCredentialDesign\"}" } } }, { "name": "Download a design asset", "disabled": true, "request": { "description": "Returns the raw bytes of a stored branding asset. The response `Content-Type` is whatever the asset was stored as (for example `image/png`, `image/svg+xml`, or `application/pdf`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getDesignAsset\"}" } } }, { "name": "Upload a design asset", "disabled": true, "request": { "description": "Uploads a branding asset for a credential design as raw bytes. The asset slot is set by `assetType` and the locale by `locale`; the stored content type is taken from the request `Content-Type` header. Returns a reference to the stored asset.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.uploadDesignAsset\"}" } } }, { "name": "Refresh an imported credential design", "disabled": true, "request": { "description": "Re-fetches an imported credential design from its source and re-applies the mapper, returning the updated design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshCredentialDesign\"}" } } }, { "name": "List credential design versions", "disabled": true, "request": { "description": "Lists immutable snapshots for a credential design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listCredentialDesignVersions\"}" } } }, { "name": "Get credential design version content", "disabled": true, "request": { "description": "Returns the immutable credential design content stored for the requested version.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getCredentialDesignVersion\"}" } } }, { "name": "Restore credential design version", "disabled": true, "request": { "description": "Restores the selected immutable version by copying its content into the credential design and appending a new current version.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.restoreCredentialDesignVersion\"}" } } }, { "name": "List issuer designs", "disabled": true, "request": { "description": "Returns the issuer designs in the caller's tenant matching the optional filters.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listIssuerDesigns\"}" } } }, { "name": "Create an issuer design", "disabled": true, "request": { "description": "Creates an issuer design in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createIssuerDesign\"}" } } }, { "name": "Find issuer designs by binding key", "disabled": true, "request": { "description": "Returns the issuer designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findIssuerDesignsByBindingKey\"}" } } }, { "name": "Find issuer designs by binding", "disabled": true, "request": { "description": "Returns the issuer designs whose bindings match the supplied binding object.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findIssuerDesignsByBinding\"}" } } }, { "name": "Import an issuer design", "disabled": true, "request": { "description": "Fetches an external issuer design from `sourceUrl`, snapshots and maps it, and persists the canonical issuer design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importIssuerDesign\"}" } } }, { "name": "Resolve an issuer design", "disabled": true, "request": { "description": "Resolves an issuer design selected by id or binding, returning the merged design with its render variants, applied layers, and locked fields.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveIssuerDesign\"}" } } }, { "name": "Delete an issuer design", "disabled": true, "request": { "description": "Deletes an issuer design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteIssuerDesign\"}" } } }, { "name": "Get an issuer design", "disabled": true, "request": { "description": "Returns one issuer design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getIssuerDesign\"}" } } }, { "name": "Update an issuer design", "disabled": true, "request": { "description": "Updates an issuer design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateIssuerDesign\"}" } } }, { "name": "Refresh an imported issuer design", "disabled": true, "request": { "description": "Re-fetches an imported issuer design from its source and re-applies the mapper.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshIssuerDesign\"}" } } }, { "name": "List render variants", "disabled": true, "request": { "description": "Returns the render variants in the caller's tenant, optionally narrowed by alias substring.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listRenderVariants\"}" } } }, { "name": "Create a render variant", "disabled": true, "request": { "description": "Creates a reusable render variant in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createRenderVariant\"}" } } }, { "name": "Delete a render variant", "disabled": true, "request": { "description": "Deletes a render variant and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteRenderVariant\"}" } } }, { "name": "Get a render variant", "disabled": true, "request": { "description": "Returns one render variant by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getRenderVariant\"}" } } }, { "name": "Update a render variant", "disabled": true, "request": { "description": "Replaces a render variant's content. The body is the same shape used to create one.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateRenderVariant\"}" } } }, { "name": "Get a source snapshot", "disabled": true, "request": { "description": "Returns the metadata and stored payload reference for the snapshot captured when a design was imported.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getSourceSnapshot\"}" } } }, { "name": "Refresh a source snapshot", "disabled": true, "request": { "description": "Re-fetches the snapshot's source, using its stored ETag for a conditional request, and returns the updated snapshot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshSourceSnapshot\"}" } } }, { "name": "List verifier designs", "disabled": true, "request": { "description": "Returns the verifier designs in the caller's tenant matching the optional filters.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listVerifierDesigns\"}" } } }, { "name": "Create a verifier design", "disabled": true, "request": { "description": "Creates a verifier design in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createVerifierDesign\"}" } } }, { "name": "Find verifier designs by binding key", "disabled": true, "request": { "description": "Returns the verifier designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findVerifierDesignsByBindingKey\"}" } } }, { "name": "Find verifier designs by binding", "disabled": true, "request": { "description": "Returns the verifier designs whose bindings match the supplied binding object.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findVerifierDesignsByBinding\"}" } } }, { "name": "Import a verifier design", "disabled": true, "request": { "description": "Fetches an external verifier design from `sourceUrl`, snapshots and maps it, and persists the canonical verifier design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importVerifierDesign\"}" } } }, { "name": "Resolve a verifier design", "disabled": true, "request": { "description": "Resolves a verifier design selected by id or binding, returning the merged design with its render variants, applied layers, and locked fields.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveVerifierDesign\"}" } } }, { "name": "Delete a verifier design", "disabled": true, "request": { "description": "Deletes a verifier design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteVerifierDesign\"}" } } }, { "name": "Get a verifier design", "disabled": true, "request": { "description": "Returns one verifier design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getVerifierDesign\"}" } } }, { "name": "Update a verifier design", "disabled": true, "request": { "description": "Updates a verifier design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateVerifierDesign\"}" } } }, { "name": "Refresh an imported verifier design", "disabled": true, "request": { "description": "Re-fetches an imported verifier design from its source and re-applies the mapper.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshVerifierDesign\"}" } } }, { "name": "Download a public design asset", "request": { "description": "Serves content-addressed design assets referenced from OID4VCI display metadata and\nSD-JWT VC type metadata, such as logo and background images. The `{asset}` value is the\nhash leaf produced by the design asset upload flow and may include a file extension.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/assets/design/{asset}" } } ] } ] }, { "name": "developer-console", "description": "Operations associated with the developer-console guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "developer-console-runtime", "description": "developer-console-runtime operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get the policy-filtered Postman collection.", "request": { "description": "GET /api/developer-console/v1/artifacts/postman/collection. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/artifacts/postman/collection" } }, { "name": "Get the secret-free Postman environment.", "request": { "description": "GET /api/developer-console/v1/artifacts/postman/environment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/artifacts/postman/environment" } }, { "name": "Forward one allowlisted same-origin Developer Console request.", "disabled": true, "request": { "description": "Resolves route identity and target authority server-side, then forwards only approved request headers and the server-held downstream credential. A prior owner cookie is used when a browser grant session is available; read-only bearer fallback remains host-protected, while mutating calls require the cookie-backed CSRF session. The response is the upstream status/body with a safe response-header allowlist; upstream cookies, redirects, authorization headers, and other hop-by-hop headers are not exposed.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.forwardDeveloperConsoleRequest\"}" } } }, { "name": "Complete and rotate a server-held Developer Console OAuth session.", "disabled": true, "request": { "description": "Completes the allowlisted authorization callback and rotates the opaque server session cookies. Callback data is bounded form data; it never contains caller credentials supplied by this API. The owner cookie is downstream session state from start and is sent automatically when present; it is not a substitute for protected caller authentication.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.completeDeveloperConsoleBffSession\"}" } } }, { "name": "Start a server-held Developer Console OAuth session.", "disabled": true, "request": { "description": "Starts an authorization-code session for an allowlisted mounted route. The server owns the downstream authority, resource, audience, scopes, and opaque session state; the protected host authenticates the caller. This operation creates the downstream owner cookie, so that cookie cannot be the caller-authentication requirement for start.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.startDeveloperConsoleBffSession\"}" } } }, { "name": "Get safe Developer Console bootstrap metadata.", "request": { "description": "GET /api/developer-console/v1/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/bootstrap" } }, { "name": "Get the policy-filtered mounted API catalog.", "request": { "description": "GET /api/developer-console/v1/catalog. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/catalog" } }, { "name": "Get enabled related testing surfaces.", "request": { "description": "GET /api/developer-console/v1/related-surfaces. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/related-surfaces" } }, { "name": "Get one policy-filtered mounted OpenAPI document.", "request": { "description": "GET /api/developer-console/v1/specs/{specId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/specs/{specId}" } } ] } ] }, { "name": "did", "description": "Operations associated with the did guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-operations", "description": "did-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DIDs", "disabled": true, "request": { "description": "Returns a page of local DID records. Filters are applied before\npagination. `role` is parsed from `MANAGED` or `EXTERNAL`; `expand`\naccepts `document`, `keys`, or `all` as a comma-separated query value.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDids\"}" } } }, { "name": "Create a new DID", "disabled": true, "request": { "description": "Creates a MANAGED DID from caller-supplied public JWK material or an\nexisting same-tenant KMS key. `PUBLIC_JWK` never grants server-side\nsigning authority. `KMS` resolves the provider and key within the\nactive tenant and persists a server-side binding. Method-specific\noptions are passed in `options`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.createDid\"}" } } }, { "name": "Track an externally-managed DID", "disabled": true, "request": { "description": "Registers a reference to an externally-managed DID for local tracking.\nOnly the DID string (and optional alias) is persisted; the resolver\nfetches the document and the IDK CacheService holds it. The tracked\nDID always gets `role = EXTERNAL`. KMS key material is never bound to\nexternal DIDs; keys belong to MANAGED DIDs created locally via\n`POST /identifiers`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.trackExternalDid\"}" } } }, { "name": "Delete a DID", "disabled": true, "request": { "description": "Soft-deletes the local DID resource (sets deletedAt timestamp).\nDoes NOT deactivate the DID on the network/ledger. The DID can be\nrecovered by querying with includeDeleted=true. To deactivate a DID\non the network, use the deactivate action instead.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deleteDid\"}" } } }, { "name": "Get DID", "disabled": true, "request": { "description": "Returns a single DID. The default response is the lightweight `Did`\nsummary, the same shape as items in `GET /identifiers`. Use `?expand=document,keys`\n(or `?expand=all`) to include the resolved DID document and KMS key\nmappings inline on the returned object.\n\nSub-resource collections (controllers, also-known-as, equivalent-ids,\nverification methods, verification relationships, services) are\ndeliberately not folded into this response; fetch them via their\ndedicated sub-resource endpoints (`/identifiers/{did}/controllers`,\n`/identifiers/{did}/verification-methods`, etc.).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDid\"}" } } }, { "name": "Partially update a DID", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDid\"}" } } }, { "name": "Replace a DID", "disabled": true, "request": { "description": "Replaces the mutable declarative fields of a DID in one request.\nCollections in the body are full replacement sets. Verification\nmethods and key mappings are intentionally managed through their\ndedicated sub-resource endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.replaceDid\"}" } } }, { "name": "Deactivate a DID", "disabled": true, "request": { "description": "Publishes a deactivation operation to the DID method's network or\nledger. This is irreversible for most DID methods. Sets the\ndeactivated flag to true on the local DID. This is fundamentally\ndifferent from DELETE, which only soft-deletes the local DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deactivateDid\"}" } } }, { "name": "List also-known-as entries", "disabled": true, "request": { "description": "Lists alternative URIs for the DID subject in DID Core\n`alsoKnownAs` form.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listAlsoKnownAs\"}" } } }, { "name": "Add an also-known-as entry", "disabled": true, "request": { "description": "Adds an also-known-as URI. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `akaUri`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addAlsoKnownAs\"}" } } }, { "name": "Remove an also-known-as entry", "disabled": true, "request": { "description": "Removes one also-known-as entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeAlsoKnownAs\"}" } } }, { "name": "List controllers", "disabled": true, "request": { "description": "Lists controller DID entries for the DID. The response uses the\npublic controller view with row id, controller DID, ordering, and\ntimestamps.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listControllers\"}" } } }, { "name": "Add a controller", "disabled": true, "request": { "description": "Adds a controller DID to the DID. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response\nexposes the value as `controllerDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addController\"}" } } }, { "name": "Remove a controller", "disabled": true, "request": { "description": "Removes one controller entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeController\"}" } } }, { "name": "Get the resolved DID document", "disabled": true, "request": { "description": "Returns the DID document for the given DID. For MANAGED DIDs the document is\nrecomposed from the persisted graph; for EXTERNAL DIDs it is served from the IDK\nCacheService and re-resolved on cache miss.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidDocument\"}" } } }, { "name": "Invalidate the cached DID document", "disabled": true, "request": { "description": "Drops the cached DID document for the given DID, forcing the next\n`GET /identifiers/{did}/document` to re-resolve it from the network/source.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.invalidateDidDocument\"}" } } }, { "name": "Refresh cached DID document", "disabled": true, "request": { "description": "Triggers a fresh resolution of an EXTERNAL DID's document, repopulates the IDK\nCacheService entry, and returns the freshly resolved document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.refreshDidDocument\"}" } } }, { "name": "List equivalent-id entries", "disabled": true, "request": { "description": "Lists equivalent DID identifiers stored for the DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listEquivalentIds\"}" } } }, { "name": "Add an equivalent-id entry", "disabled": true, "request": { "description": "Adds an equivalent DID identifier. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `equivalentDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addEquivalentId\"}" } } }, { "name": "Remove an equivalent-id entry", "disabled": true, "request": { "description": "Removes one equivalent-id entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeEquivalentId\"}" } } }, { "name": "List key mappings", "disabled": true, "request": { "description": "Lists KMS key bindings for verification methods on this DID. These\nrows describe local signing key usage and are separate from the DID\ndocument's public verification material.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listKeyMappings\"}" } } }, { "name": "Add a key mapping", "disabled": true, "request": { "description": "Add a key mapping binding a verification method to a KMS-managed\nkey reference (`keyInfo.providerId` + `keyInfo.alias`/`keyInfo.kid`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addKeyMapping\"}" } } }, { "name": "Remove a key mapping", "disabled": true, "request": { "description": "Removes one local KMS key mapping by its mapping id. This does not\nremove the verification method from the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeKeyMapping\"}" } } }, { "name": "Resolve a DID or dereference a DID URL", "disabled": true, "request": { "description": "Resolves a locally managed DID or dereferences a DID URL.\nWhen a plain DID is provided, returns a ResolutionResult containing\nthe DID document with resolution and document metadata.\nWhen a DID URL with a fragment is provided (e.g.,\ndid:example:123#key-1), returns a DereferencingResult containing\nthe specific resource (verification method, service, etc.).\n\nThis performs a local DID lookup first. If the DID is not\nlocally managed, behavior depends on configuration (may fall\nthrough to remote resolution).\n\nFor DIF Universal Resolver interop, use the separate endpoint\nat /1.0/identifiers/{identifier}.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.resolveDid\"}" } } }, { "name": "List DID services", "disabled": true, "request": { "description": "Lists the DID document service entries currently stored for the DID.\nService entries use the DID Core wire shape: `id`, `type`, and\n`serviceEndpoint`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDidServices\"}" } } }, { "name": "Add a DID service", "disabled": true, "request": { "description": "Adds a DID Core service entry. `type` may be a string or an array of\nstrings; `serviceEndpoint` may be a URI string, object, or array.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addDidService\"}" } } }, { "name": "Remove a DID service", "disabled": true, "request": { "description": "Removes one service entry from the DID document model.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeDidService\"}" } } }, { "name": "Get a DID service", "disabled": true, "request": { "description": "Returns one service entry by the service id used in the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidService\"}" } } }, { "name": "Update a DID service", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDidService\"}" } } }, { "name": "List verification methods", "disabled": true, "request": { "description": "Lists verification methods persisted for the DID. Relationship\nmembership is carried on each method through\n`valueVerificationRelation` and `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationMethods\"}" } } }, { "name": "Add a verification method", "disabled": true, "request": { "description": "Adds a verification method backed by an existing KMS key reference.\nUse `valueVerificationRelation` to embed the method by value in one\nrelationship, and `referenceVerificationRelations` to reference it by\nDID URL from one or more relationships.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationMethod\"}" } } }, { "name": "Remove a verification method", "disabled": true, "request": { "description": "Removes the verification method from the DID and drops relationship\nbindings that point at it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationMethod\"}" } } }, { "name": "Get a verification method", "disabled": true, "request": { "description": "Returns one verification method by fragment or absolute DID URL. The\npath segment is percent-decoded before lookup.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getVerificationMethod\"}" } } }, { "name": "Update a verification method", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a nullable field to null removes it. `keyInfo` can\nbe partially supplied to rebind only selected KMS-key fields.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateVerificationMethod\"}" } } }, { "name": "List verification relationships (derived view)", "disabled": true, "request": { "description": "Returns the per-purpose view of verification relationships derived\nfrom the DID's verification methods. Read-only; to add or remove\na VM from a relationship, update the VM's\n`valueVerificationRelation` / `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationRelationships\"}" } } }, { "name": "Add a verification relationship", "disabled": true, "request": { "description": "Binds an existing verification method to a verification relationship\npurpose. The default is a referenced relationship; set `embed` to true\nto serialize the relationship as an inline verification method object.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationRelationship\"}" } } }, { "name": "Remove a verification relationship", "disabled": true, "request": { "description": "Removes one stored relationship binding by id. Use the id returned by\n`POST /identifiers/{did}/verification-relationships`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationRelationship\"}" } } }, { "name": "List supported DID methods", "disabled": true, "request": { "description": "Returns the capability snapshot for every DID method registered\nwith the deployment.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listSupportedMethods\"}" } } }, { "name": "Get capabilities for a DID method", "disabled": true, "request": { "description": "Returns the full capability profile registered for one DID method,\nincluding lifecycle support, key-management support, service support,\nrepresentation hints, caching behavior, and usage guidance.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilities\"}" } } }, { "name": "Get the capability summary for a DID method", "disabled": true, "request": { "description": "Returns a compact boolean capability summary for one DID method. This\nendpoint is intended for client feature gating.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilitySummary\"}" } } } ] } ] }, { "name": "did-hosting", "description": "Operations associated with the did-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-hosting-operations", "description": "did-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the hosted DID document for a path-less DID.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nwith no path (`did:web:` or the did:web companion of\n`did:webvh::`).\n", "method": "GET", "header": [], "url": "{{baseUrl}}/.well-known/did.json" } }, { "name": "Resolve the hosted DID document for a DID with a path.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nplus a path. `path` is one or more URL segments (the colon-delimited DID\npath segments rendered with slashes), up to the configured maximum depth.\nFor example `did:web:example.com:tenants:acme` is served at\n`/tenants/acme/did.json`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{path}/did.json" } } ] } ] }, { "name": "eidas-signature", "description": "Operations associated with the eidas-signature guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "eidas-signature-operations", "description": "eidas-signature-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List signature configurations", "disabled": true, "request": { "description": "GET /configs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.listConfigs\"}" } } }, { "name": "Create a signature configuration", "disabled": true, "request": { "description": "Creates a reusable signature configuration that can be referenced when signing.\nConfigurations define signature level, format parameters, timestamp settings, etc.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.createConfig\"}" } } }, { "name": "Delete a signature configuration", "disabled": true, "request": { "description": "DELETE /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.deleteConfig\"}" } } }, { "name": "Get a signature configuration", "disabled": true, "request": { "description": "GET /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.getConfig\"}" } } }, { "name": "Update a signature configuration", "disabled": true, "request": { "description": "PUT /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.updateConfig\"}" } } }, { "name": "Simple PDF signing with visual signature", "disabled": true, "request": { "description": "Signs a PDF document with a simple visual signature (blue bar style).\nThis is a convenience endpoint for quick PDF signing with sensible defaults.\n\nSupports both JSON (Base64 content) and multipart form data uploads.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.ezDocSealSign\"}" } } }, { "name": "Complete signature with external value (step 2 of 2)", "disabled": true, "request": { "description": "Completes a signature using an externally computed signature value.\nUse the session ID from the `/signatures/digest` response.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.completeSignature\"}" } } }, { "name": "Create digest for external signing (step 1 of 2)", "disabled": true, "request": { "description": "Creates a digest/hash of the document that can be signed externally (e.g., by HSM, smartcard, or remote signing service).\n\nReturns a session ID and the digest bytes. The digest should be signed using the external system,\nthen the signature should be submitted via `/signatures/complete`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.createDigest\"}" } } }, { "name": "Sign a document (one-step)", "disabled": true, "request": { "description": "Signs a document in a single step - determines input, creates digest, signs, and merges in one call.\n\nFor scenarios where the signature must be computed externally (HSM, smartcard, remote signing service),\nuse the two-step workflow with `/signatures/digest` and `/signatures/complete`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.signDocument\"}" } } }, { "name": "Request a timestamp", "disabled": true, "request": { "description": "Requests an RFC 3161 timestamp from a Time Stamp Authority (TSA).\nCan be used standalone or as part of a signing workflow.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.requestTimestamp\"}" } } }, { "name": "Validate a signed document", "disabled": true, "request": { "description": "Validates the signatures in a signed document against EU Trusted Lists.\nSupports CAdES, PAdES, JAdES, and XAdES signed documents.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.validateSignature\"}" } } }, { "name": "Validate a raw signature", "disabled": true, "request": { "description": "Validates a raw cryptographic signature against the original input data.\nUses the referenced key from the KMS to verify the signature.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.validateRawSignature\"}" } } } ] } ] }, { "name": "identity-auth", "description": "Operations associated with the identity-auth guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "identity-auth-operations", "description": "identity-auth-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a login credential", "disabled": true, "request": { "description": "Operator operation. Hashes the plaintext password and stores a new credential keyed on the tenant and username, linked to an existing Identity. Fails with `409` when a credential for that username already exists (`AUTH_CREDENTIAL_ALREADY_EXISTS`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.createCredential\"}" } } }, { "name": "Clear lockout state", "disabled": true, "request": { "description": "Operator operation. Resets the failed-attempts counter and clears a time-based lockout. Does not change a `DISABLED` status, which is a separate operator action.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.unlockCredential\"}" } } }, { "name": "Complete a redirect-flow authentication", "request": { "description": "Callback from the external authentication method. Completes the flow, upserts the resulting Identity, writes the session, and returns the authenticated user. The flow is dispatched by `executionId` and `sessionId`, so this one path serves every configured method. This endpoint does not require a bearer token: it is bound to the one-shot `executionId` issued by the initiate call. A verification that produced no verified identifiers fails with `401` (`AUTH_INVALID_CREDENTIALS`); an unknown or expired execution fails with `404` (`AUTH_SESSION_NOT_FOUND`).", "method": "POST", "header": [], "url": "{{baseUrl}}/callback" } }, { "name": "Change a password", "disabled": true, "request": { "description": "Rotates the stored password hash. The caller must present the current password, which the server re-verifies before rotating. A wrong current password fails with `401` (`AUTH_INVALID_CREDENTIALS`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.updatePassword\"}" } } }, { "name": "OpenID Connect RP-Initiated Logout", "disabled": true, "request": { "description": "Terminates one or many sessions per OpenID Connect RP-Initiated Logout (section 3) and fires back-channel notifications. Supply at least one of `idTokenHint`, `sessionId`, or `identityId`; omitting all three fails with `400` (`AUTH_END_SESSION_ARGUMENT_MISSING`). An `idTokenHint` that cannot be validated fails with `400` (`AUTH_INVALID_ID_TOKEN_HINT`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.endSession\"}" } } }, { "name": "Start a redirect-flow authentication", "disabled": true, "request": { "description": "Starts an external authentication challenge and returns the dispatch URL the user agent should be redirected to. The method is resolved from `methodId`, or the tenant default when `methodId` is null. A configured method that is not a redirect-flow method fails with `400` (`AUTH_METHOD_TYPE_MISMATCH`); a method that is absent or disabled fails with `503` (`AUTH_METHOD_NOT_CONFIGURED`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.initiateAuthentication\"}" } } }, { "name": "Log out a session", "disabled": true, "request": { "description": "Terminates a single Authorization-Server session. Idempotent; logging out an unknown or expired session returns `loggedOut` false without error.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.logoutSession\"}" } } }, { "name": "Get the authenticated user for a session", "disabled": true, "request": { "description": "Returns the authenticated user bound to an Authorization-Server session id, or `user: null` when the session is unknown, expired, or not yet authenticated. The session id is carried in the body because it is bearer-equivalent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.getAuthenticatedSession\"}" } } } ] } ] }, { "name": "inbox", "description": "Operations associated with the inbox guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "inbox-operations", "description": "inbox-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Request a policy-filtered evidentiary export job", "disabled": true, "request": { "description": "The server derives export ID, tenant, requester, and request time from authenticated context. This asynchronous evidence archive is separate from management metrics and never returns unbounded correlations inline.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxEvidenceExport\"}" } } }, { "name": "Get an evidentiary export job", "disabled": true, "request": { "description": "GET /evidence-exports/{exportId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxEvidenceExportJob\"}" } } }, { "name": "Download a completed evidentiary export archive", "disabled": true, "request": { "description": "Reauthorizes inbox.export for the current tenant and requester, requires COMPLETED status, audits access, and serves the manifest-bound archive through a short-lived controlled download. It is not a management report.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.downloadInboxEvidenceExportArtifact\"}" } } }, { "name": "List authorized inboxes", "disabled": true, "request": { "description": "GET /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxes\"}" } } }, { "name": "Create an inbox", "disabled": true, "request": { "description": "POST /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInbox\"}" } } }, { "name": "Get an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInbox\"}" } } }, { "name": "Update an inbox", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInbox\"}" } } }, { "name": "List physical folders", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxFolders\"}" } } }, { "name": "Create a physical folder", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxFolder\"}" } } }, { "name": "Get a physical folder", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxFolder\"}" } } }, { "name": "Update a physical folder", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxFolder\"}" } } }, { "name": "List folder bindings", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listFolderBindings\"}" } } }, { "name": "Create a folder binding with a server-generated ID", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createFolderBinding\"}" } } }, { "name": "Update a folder binding", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}/bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateFolderBinding\"}" } } }, { "name": "List work queues for an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxWorkQueues\"}" } } }, { "name": "Create a versioned work queue", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxWorkQueue\"}" } } }, { "name": "Get a work queue", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxWorkQueue\"}" } } }, { "name": "Update a work queue with optimistic concurrency", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxWorkQueue\"}" } } }, { "name": "List inbox routing rules", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxRules\"}" } } }, { "name": "Create an inbox routing rule", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxRule\"}" } } }, { "name": "Delete an inbox routing rule", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteInboxRule\"}" } } }, { "name": "Get an inbox routing rule", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxRule\"}" } } }, { "name": "Update an inbox routing rule", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxRule\"}" } } }, { "name": "List saved inbox views", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listSavedInboxViews\"}" } } }, { "name": "Create a saved inbox view", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createSavedInboxView\"}" } } }, { "name": "Delete a saved inbox view", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteSavedInboxView\"}" } } }, { "name": "Get a saved inbox view", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getSavedInboxView\"}" } } }, { "name": "Update a saved inbox view", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateSavedInboxView\"}" } } }, { "name": "Query authorized inbox items", "disabled": true, "request": { "description": "Executes the versioned structured query across every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. Shared links carry this same `query` parameter as percent-encoded canonical JSON; clients must not translate it into a different filter language.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxItems\"}" } } }, { "name": "Apply tags to a bounded item set as one correlated operation", "disabled": true, "request": { "description": "Source-domain approve, reject, and complete are forbidden as bulk list operations.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkTagInboxItems\"}" } } }, { "name": "Get an inbox item", "disabled": true, "request": { "description": "GET /items/{itemId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItem\"}" } } }, { "name": "Read the latest durable revision of an action receipt", "disabled": true, "request": { "description": "GET /items/{itemId}/action-receipts/{receiptId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxActionReceipt\"}" } } }, { "name": "Submit an item action intent", "disabled": true, "request": { "description": "POST /items/{itemId}/actions/{actionKey}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.performInboxAction\"}" } } }, { "name": "Retrieve an authorized safe artifact", "disabled": true, "request": { "description": "Re-evaluates tenant and inbox.read policy and serves only SAFE content from the managed artifact store. It never proxies a client-supplied URL.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.retrieveInboxArtifact\"}" } } }, { "name": "Get item history", "disabled": true, "request": { "description": "GET /items/{itemId}/history. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemHistory\"}" } } }, { "name": "List auditable legal holds for an item", "disabled": true, "request": { "description": "GET /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxItemLegalHolds\"}" } } }, { "name": "Apply a legal hold that wins over a pending retention sweep", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.applyInboxItemLegalHold\"}" } } }, { "name": "Release a legal hold with optimistic concurrency", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds/{legalHoldId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseInboxItemLegalHold\"}" } } }, { "name": "Get the current user's item state", "disabled": true, "request": { "description": "GET /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemUserState\"}" } } }, { "name": "Update the current user's item state", "disabled": true, "request": { "description": "PUT /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxItemUserState\"}" } } }, { "name": "Stream resumable authorized inbox updates", "disabled": true, "request": { "description": "Streams every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.streamInboxUpdates\"}" } } }, { "name": "Get an authorization-filtered unified inbox summary", "disabled": true, "request": { "description": "Counts every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxSummary\"}" } } }, { "name": "List authorized append-only arrival and completion facts", "disabled": true, "request": { "description": "GET /throughput-facts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxThroughputFacts\"}" } } }, { "name": "Query authorized WORK items across the unified Inbox", "disabled": true, "request": { "description": "Returns WORK items from every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. This is a façade over the canonical Inbox item query.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryWorkItems\"}" } } }, { "name": "Reassign a bounded item set as one correlated operation", "disabled": true, "request": { "description": "POST /work-items/bulk/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkReassignWorkItems\"}" } } }, { "name": "Query authorization-filtered supervisor metrics", "disabled": true, "request": { "description": "POST /work-items/supervisor/query. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxSupervisorMetrics\"}" } } }, { "name": "Submit the fixed approve action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/approve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.approveWorkItem\"}" } } }, { "name": "Atomically claim a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/claim. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.claimWorkItem\"}" } } }, { "name": "Submit the fixed complete action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/complete. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.completeWorkItem\"}" } } }, { "name": "Atomically set bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.setWorkItemCover\"}" } } }, { "name": "Atomically clear bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover/clear. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.clearWorkItemCover\"}" } } }, { "name": "Commit an Inbox-owned SLA escalation synchronously", "disabled": true, "request": { "description": "POST /work-items/{itemId}/escalate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.escalateWorkItem\"}" } } }, { "name": "Explicitly extend a checkout lease; client activity never extends it implicitly", "disabled": true, "request": { "description": "POST /work-items/{itemId}/lease/extend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.extendWorkItemLease\"}" } } }, { "name": "Atomically reassign a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.reassignWorkItem\"}" } } }, { "name": "Submit the fixed reject action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reject. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.rejectWorkItem\"}" } } }, { "name": "Atomically release a work item assignment", "disabled": true, "request": { "description": "POST /work-items/{itemId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseWorkItem\"}" } } }, { "name": "Take over a held or expired checkout and record both holders", "disabled": true, "request": { "description": "POST /work-items/{itemId}/take-over. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.takeOverWorkItem\"}" } } } ] } ] }, { "name": "kms", "description": "Operations associated with the kms guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "kms-operations", "description": "kms-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List provider capabilities", "disabled": true, "request": { "description": "Returns the capability report for every configured provider. Disabled providers are excluded by default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCapabilities\"}" } } }, { "name": "List certificate-chain aliases", "disabled": true, "request": { "description": "GET /certificate-chains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateChainAliases\"}" } } }, { "name": "Delete a certificate chain", "disabled": true, "request": { "description": "Deletes the EDK certificate-chain reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteCertificateChain\"}" } } }, { "name": "Get a certificate chain", "disabled": true, "request": { "description": "GET /certificate-chains/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateChain\"}" } } }, { "name": "Store a certificate chain", "disabled": true, "request": { "description": "Associates the supplied leaf-to-root certificate chain with the key identified by the path alias. When that key already exists in the selected provider, omit keyInfo or supply public-only key metadata; private key material is neither required nor accepted for the association. The provider must expose certificate-store support.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeCertificateChain\"}" } } }, { "name": "List persisted tenant certificate references", "disabled": true, "request": { "description": "Lists only references in the authenticated tenant index. It never enumerates a provider's certificate inventory and returns public certificate and relationship metadata only.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateReferences\"}" } } }, { "name": "Get persisted tenant certificate-reference metadata", "disabled": true, "request": { "description": "Returns one public metadata projection from the authenticated tenant reference index.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateReference\"}" } } }, { "name": "List trusted certificate aliases", "disabled": true, "request": { "description": "GET /certificates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listTrustedCertificateAliases\"}" } } }, { "name": "Generate a certificate signing request", "disabled": true, "request": { "description": "POST /certificates/csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateCertificateSigningRequest\"}" } } }, { "name": "Issue a certificate", "disabled": true, "request": { "description": "POST /certificates/issue. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificate\"}" } } }, { "name": "Issue a certificate from a CSR", "disabled": true, "request": { "description": "POST /certificates/issue-from-csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificateFromCsr\"}" } } }, { "name": "Register a tenant-owned certificate reference", "disabled": true, "request": { "description": "Registers a provider-native certificate reference or stored public certificate material. Registration does not create/import key material. The stored_public_material source requires certificateChain, a non-empty list of Base64-encoded DER certificates, and rejects provider-native material. The provider_native source requires certificateChain to be omitted and resolves the certificate from provider capability. The key_certificate_chain kind requires linkedKeyAlias or linkedKeyKid and binds the leaf public key. providerCertificateId is optional and identifies a provider certificate when supplied. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. For a provider-native certificate reached through a platform-shared Azure Key Vault provider, the native certificate must carry `sphereon-tenant-id` set to the authenticated tenant id. AWS KMS has no provider-native certificate object API.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerCertificateReference\"}" } } }, { "name": "Delete a trusted certificate", "disabled": true, "request": { "description": "Deletes the EDK certificate reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteTrustedCertificate\"}" } } }, { "name": "Get a trusted certificate", "disabled": true, "request": { "description": "GET /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getTrustedCertificate\"}" } } }, { "name": "Store a trusted certificate", "disabled": true, "request": { "description": "POST /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeTrustedCertificate\"}" } } }, { "name": "Decrypt data", "disabled": true, "request": { "description": "POST /encryption/decrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.decrypt\"}" } } }, { "name": "Encrypt data", "disabled": true, "request": { "description": "POST /encryption/encrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.encrypt\"}" } } }, { "name": "Perform key agreement", "disabled": true, "request": { "description": "POST /encryption/key-agreement. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.performKeyAgreement\"}" } } }, { "name": "Unwrap a key", "disabled": true, "request": { "description": "POST /encryption/unwrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.unwrapKey\"}" } } }, { "name": "Wrap a key", "disabled": true, "request": { "description": "POST /encryption/wrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.wrapKey\"}" } } }, { "name": "List all managed cryptographic keys across all providers", "disabled": true, "request": { "description": "Lists key metadata across every provider configured for the calling tenant. Only metadata is returned (alias, kid, algorithm, type); private key material is never included. Pass the optional `providerId` query parameter to restrict the listing to a single provider. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeys\"}" } } }, { "name": "Generate a new key (provider chosen from body or default)", "disabled": true, "request": { "description": "Generates a new key. The request body selects the signature algorithm (for example `ECDSA_SHA256`) and may optionally include an `alias`, `use`, `keyOperations`, and a `providerId`. If `providerId` is omitted the default provider is used. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 400 if the requested algorithm or provider is not available.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateKey\"}" } } }, { "name": "Import externally supplied key material (provider taken from keyInfo)", "disabled": true, "request": { "description": "Imports a key you already hold into the KMS. The target provider is taken from the `providerId` inside the body's `keyInfo` (for example `testsoftware`), and the alias likewise comes from `keyInfo.alias`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 400 if the keyInfo is missing required fields or names an unknown provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.importKey\"}" } } }, { "name": "Register an existing provider key for platform use", "disabled": true, "request": { "description": "Explicitly onboards a key that already exists inside a provider into the platform's persistent key reference store, so the platform can discover and use it later. The body identifies the key by its `providerId` and exact provider-native `alias`, with an optional canonical `kid`. EDK stores that alias unchanged in the authenticated tenant's reference index; it does not add the backing-alias prefix used for platform-managed generated or imported keys. When the provider is a platform-shared AWS or Azure resource, the native key must carry `sphereon-tenant-id` set to the authenticated tenant id; the assignment is checked again before later use. A tenant-owned provider does not require that shared-provider tag. Registration does not create/import key material; the key must already live in the named provider. The response confirms registration and echoes the alias, providerId, and kid. Returns 400 if the provider or key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerKeyReference\"}" } } }, { "name": "Delete a key from the key store by alias or kid", "disabled": true, "request": { "description": "Removes the EDK key reference identified by `aliasOrKid` (its alias or kid). For an externally managed reference, Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible: deletion continues to follow the existing provider and key-store deletion rules. Pass the optional `providerId` query parameter to scope the deletion to a single provider. Returns 204 with no body on success, or 404 if no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key across the calling tenant's providers by its alias or kid. The `aliasOrKid` path parameter may be the alias (for example `my-signing-key`) or the kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Pass the optional `providerId` query parameter to disambiguate when the same alias exists in more than one provider. Returns 404 if no matching key is found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKey\"}" } } }, { "name": "List configured key providers", "disabled": true, "request": { "description": "Returns every non-internal key provider that is configured and available for the calling tenant. Providers are configured server-side (for example a `SOFTWARE`, `AWS_KMS`, or `AZURE_KEYVAULT` provider); this endpoint does not create them. Internal system providers such as `license` and `platform` are intentionally hidden from this regular KMS REST surface. Use the returned `providerId` (for example `testsoftware`) to scope key operations to a specific provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeyProviders\"}" } } }, { "name": "Query matching providers", "disabled": true, "request": { "description": "Returns all providers matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryProviders\"}" } } }, { "name": "Query the best matching provider", "disabled": true, "request": { "description": "Returns the best provider matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryBestProvider\"}" } } }, { "name": "Get key provider details", "disabled": true, "request": { "description": "Returns the configuration details of a single key provider identified by its `providerId` path parameter (for example `testsoftware`). Returns 404 if no provider with that id is configured for the calling tenant, or if the provider is an internal system provider such as `license` or `platform`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKeyProvider\"}" } } }, { "name": "Get capabilities for one provider", "disabled": true, "request": { "description": "GET /providers/{providerId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getProviderCapabilities\"}" } } }, { "name": "List all managed cryptographic keys for a provider", "disabled": true, "request": { "description": "Lists the keys managed by the provider identified by `providerId`. Only key metadata is returned (alias, kid, algorithm, type); private key material is never included. Returns 404 if the provider id is unknown for the calling tenant or if it is an internal system provider such as `license` or `platform`. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerListKeys\"}" } } }, { "name": "Generate a new key in a provider", "disabled": true, "request": { "description": "Generates a new key inside the provider identified by `providerId`. The request body selects the signature algorithm (for example `ECDSA_SHA256`), and optionally an `alias`, intended `use` (`sig`/`enc`), and `keyOperations`. If no alias is given the provider assigns one. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 404 if the provider id is unknown, or 400 if the requested algorithm is not supported.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGenerateKey\"}" } } }, { "name": "Import externally supplied key material into a provider", "disabled": true, "request": { "description": "Imports a key that you already hold (its key material is supplied in the request body as a JWK) into the provider identified by `providerId`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 404 if the provider id is unknown, or 400 if the supplied keyInfo is invalid.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerImportKey\"}" } } }, { "name": "Delete a key from a provider", "disabled": true, "request": { "description": "Permanently removes the key identified by `aliasOrKid` from the provider identified by `providerId`. The `aliasOrKid` may be the key's alias or its kid. Returns 204 with no body on success, or 404 if the provider id is unknown or no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerDeleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key in the provider identified by `providerId`. The `aliasOrKid` path parameter may be either the key's alias (for example `my-signing-key`) or its kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Returns 404 if the provider id is unknown or no key matches the alias or kid in that provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGetKey\"}" } } }, { "name": "List all configured key resolvers", "disabled": true, "request": { "description": "Returns every key resolver configured for the calling tenant. A key resolver turns a key reference (a JWK, kid, X.509 chain, or DID) into a concrete public key. Each resolver advertises which identifier methods and key types it supports. The default deployment exposes a resolver with id `jose_cose_resolver`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listResolvers\"}" } } }, { "name": "Get key resolver details", "disabled": true, "request": { "description": "Returns the configuration of a single key resolver identified by its `resolverId` path parameter (for example `jose_cose_resolver`), including the identifier methods and key types it supports. Returns 404 if no resolver with that id is configured for the calling tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getResolver\"}" } } }, { "name": "Resolve a public key", "disabled": true, "request": { "description": "Resolves a public key through the resolver identified by `resolverId` (for example `jose_cose_resolver`). The request body carries a `keyInfo` reference to resolve, an optional `identifierMethod` (for example `JWK`, `KID`, `DID`, `X5C`) hinting how to interpret it, optional `trustedCerts`, and an optional `verifyX509CertificateChain` flag. The response is a fully resolved key whose public `key` JWK is guaranteed to be present. Returns 404 if the resolver id is unknown, or 400 if the key reference cannot be resolved.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.resolveKey\"}" } } }, { "name": "Create a raw signature", "disabled": true, "request": { "description": "Produces a raw (detached) cryptographic signature over the supplied bytes using a managed key. The request body identifies the key with a `keyInfo` (by `providerId` plus either `alias` or `kid`) and carries the bytes to sign in `input` as a base64-encoded string; the signature algorithm is taken from the resolved key. The response returns the signature bytes, base64-encoded; only the signature is returned, not the input. Pass the same `input` and `keyInfo` to `/signatures/raw/verify`. Returns 400 if the key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.createRawSignature\"}" } } }, { "name": "Verify a raw signature", "disabled": true, "request": { "description": "Verifies a raw (detached) signature against the original bytes using a managed key. The request body carries the `keyInfo` identifying the verifying key, the original bytes in `input` (base64), and the candidate `signature` (base64). The response is `{ \"isValid\": true }` when the signature matches and `{ \"isValid\": false }` when it does not (for example when the input was tampered with). Verification failures due to a wrong signature return 200 with `isValid: false`, not an error status. Returns 400 only for malformed input.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.isValidRawSignature\"}" } } } ] } ] }, { "name": "oid4vci-issuance-template", "description": "Operations associated with the oid4vci-issuance-template guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuance-template-operations", "description": "oid4vci-issuance-template-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List issuance templates", "disabled": true, "request": { "description": "GET /templates/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.listIssuanceTemplates\"}" } } }, { "name": "Create issuance template", "disabled": true, "request": { "description": "POST /templates/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.createIssuanceTemplate\"}" } } }, { "name": "Delete issuance template", "disabled": true, "request": { "description": "DELETE /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.deleteIssuanceTemplate\"}" } } }, { "name": "Get issuance template", "disabled": true, "request": { "description": "GET /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.getIssuanceTemplate\"}" } } }, { "name": "Patch issuance template", "disabled": true, "request": { "description": "PATCH /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.patchIssuanceTemplate\"}" } } }, { "name": "Replace issuance template", "disabled": true, "request": { "description": "PUT /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.replaceIssuanceTemplate\"}" } } }, { "name": "Create credential offer from issuance template", "disabled": true, "request": { "description": "Resolves the template, merges execution overrides, and calls the existing credential-offer session creation path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.createCredentialOfferFromIssuanceTemplate\"}" } } } ] } ] }, { "name": "oid4vci-issuer", "description": "Operations associated with the oid4vci-issuer guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuer-operations", "description": "oid4vci-issuer-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Initialise an issuance pipeline session", "disabled": true, "request": { "description": "Allocates a new issuance pipeline session for a registered pipeline configuration,\noptionally seeded with attributes and connector fields known at init time. No phase runs here;\nthis only opens the session. Drive phases afterwards with the contribute endpoint. The\nresponse returns the session id and the resolved correlation handle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.initPipelineSession\"}" } } }, { "name": "Apply an approval-gate decision to a session", "disabled": true, "request": { "description": "Applies an approve or reject decision to a session that is awaiting approval. On approval\nthe session moves towards ready; on rejection it fails. The approver identity is resolved\nfrom the authenticated context and is never supplied in the body. A reason is required on\nrejection.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.approvePipelineSession\"}" } } }, { "name": "Read accumulated session attributes", "disabled": true, "request": { "description": "Returns the attribute values accumulated in the session bag, keyed by attribute path,\nplus the names of any connector fields present on the session. Connector-field values are\nsensitive and are never returned over this API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getSessionAttributes\"}" } } }, { "name": "Contribute attributes to a session", "disabled": true, "request": { "description": "Pushes compact attribute groups and connector fields into an active session as input for the\ncredential-request phase. The session is identified by the path correlation id; the\nattributes and connector fields come from the body. Each record carries provenance: the\nproducing contributor, the phase, the capture time, an optional assurance level, a\nconflict-resolution priority, and a retention policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.contributeAttributes\"}" } } }, { "name": "Contribute attributes via an asynchronous callback", "request": { "description": "Inbound contribution endpoint for a connector contributor that answers out of band. The\ncallback token is the opaque capability artefact minted by the issuer when the contributor was\ndispatched; it is validated and cross-checked against the path correlation id. The body is\nfed into the pipeline as a deferred contribution. Authorisation is carried by the callback\ntoken in the path, so this endpoint does not require a bearer token.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/api/oid4vci/v1/backend/sessions/{correlationId}/callbacks/{callbackToken}" } }, { "name": "Evaluate session attribute completeness", "disabled": true, "request": { "description": "Returns a verdict per credential-claims binding: whether the session's accumulated bag\nsatisfies every mandatory attribute path, which paths are still missing, and whether\ndeferral or approval is indicated. This is a read-only verdict; it does not mutate the\nsession.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.evaluateCompleteness\"}" } } }, { "name": "Mark a contributor's contribution as failed", "disabled": true, "request": { "description": "Records that a single connector contributor could not deliver its contribution to the session.\nA later completeness evaluation can then treat an unsatisfied required contributor as a hard\nmiss rather than waiting indefinitely.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.recordPipelineContributorFailure\"}" } } }, { "name": "Resolve a pre-session data-entry form for a credential configuration", "disabled": true, "request": { "description": "Resolves the same data-entry form as the testing-surface operation of the same name,\nseeded from each bound design claim's `exampleValue`, so an operator can fill in the\nclaim values before an issuance session exists. Unlike the testing operation this path\nis never gated on the instance testing surface being enabled and always requires bearer\ncredentials; the tenant is taken from the token and the instance and configuration are\nscoped exactly as on the testing path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciCredentialConfigurationOperatorForm\"}" } } }, { "name": "Execute an issuer testing action", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/actions/{action}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.executeOid4vciTestingAction\"}" } } }, { "name": "Get issuer testing-surface bootstrap links", "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/oid4vci/v1/testing/instances/{instanceId}/bootstrap" } }, { "name": "Get issuer testing-surface capabilities", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingCapabilities\"}" } } }, { "name": "Resolve a pre-session data-entry form for a credential configuration", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/credential-configurations/{configurationId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingCredentialConfigurationOperatorForm\"}" } } }, { "name": "List event-sourced issuer sessions", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingSessions\"}" } } }, { "name": "Get a issuer session projection", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingSession\"}" } } }, { "name": "List immutable issuer session events", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingSessionEvents\"}" } } }, { "name": "Get the operator form for an issuer session", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingOperatorForm\"}" } } }, { "name": "Amend the operator form values for an issuer session", "disabled": true, "request": { "description": "PUT /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.amendOid4vciTestingOperatorForm\"}" } } }, { "name": "Validate operator-form values for an issuer session", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form/validation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.validateOid4vciTestingOperatorForm\"}" } } }, { "name": "Release a deferred session so the next wallet poll issues", "disabled": true, "request": { "description": "Advances a session that is deferred or awaiting approval so the next wallet poll of the\ndeferred-credential endpoint returns the issued credential. The approver identity is\nresolved from the authenticated context, mirroring approvePipelineSession.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.markOid4vciTestingSessionReady\"}" } } }, { "name": "List issuer testing status lists", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/status-lists. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingStatusLists\"}" } } }, { "name": "Get an issuer testing status-list entry", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/status-lists/{statusListId}/entries/{index}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingStatusListEntry\"}" } } }, { "name": "Update an issuer testing status-list entry", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/status-lists/{statusListId}/entries/{index}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.updateOid4vciTestingStatusListEntry\"}" } } }, { "name": "List issuer testing templates", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingTemplates\"}" } } }, { "name": "Execute an issuer testing template", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/templates/{templateId}/execute. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.executeOid4vciTestingTemplate\"}" } } }, { "name": "Get the issuer testing workspace", "disabled": true, "request": { "description": "Returns operational dashboard aggregates, credential catalog metadata, and action URLs. AS-protected instances require their exact configured resource grant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingWorkspace\"}" } } }, { "name": "Get hosted SD-JWT VC type metadata", "request": { "description": "Returns a design-generated SD-JWT VC type metadata document for VCT bindings whose\n`vctHostingMode` is `HOSTED`. External VCTs and plain non-hosted VCT strings are not\nserved from this endpoint.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/schema/vct/{vctId}" } } ] } ] }, { "name": "oid4vci-issuer-session", "description": "Operations associated with the oid4vci-issuer-session guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuer-session-operations", "description": "oid4vci-issuer-session-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a credential offer and its issuance session", "disabled": true, "request": { "description": "Creates a new OID4VCI Credential Offer for the supplied credential configuration ids and\nopens a tracked issuance session for it. The response carries everything needed to start\nthe wallet flow and to follow the session afterwards: the offer URI, an optional QR code\ndata URI (returned only when `qr_code` options were supplied), the transaction code (when a\npre-authorized grant requested one), a `status_uri` for polling, and the `correlation_id`\nthat keys the session.\n\nGrant selection follows the request `grants`. When neither a pre-authorized nor an\nauthorization code grant is given, a pre-authorized code grant is used by default. Supply a\n`correlation_id` to use your own business key, otherwise the server generates one. This\nendpoint is meant to be called from the issuer backend, not from a browser or wallet.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.createCredentialOffer\"}" } } }, { "name": "Delete a credential offer session", "disabled": true, "request": { "description": "Removes all state associated with the credential-offer session identified by its\n`correlation_id`. Use it to clean up after the session completes, after it times out, or to\ncancel an outstanding offer. Returns `204 No Content` on success.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.deleteCredentialOffer\"}" } } }, { "name": "Get credential offer session status", "disabled": true, "request": { "description": "Returns the current status of a credential-offer session identified by its\n`correlation_id`. The response always carries the status and a `last_updated` timestamp.\nWhen the session has reached `credential_issued`, the response also includes\n`issuance_data` (the issued credential configuration ids and credential identifiers). When\nthe session has reached `error`, the response includes an `error` object with a code and\nmessage. Poll this endpoint to follow the session across the issuance lifecycle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.getCredentialOfferStatus\"}" } } } ] } ] }, { "name": "oid4vp-dcql", "description": "Operations associated with the oid4vp-dcql guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-dcql-operations", "description": "oid4vp-dcql-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DCQL query configurations", "disabled": true, "request": { "description": "Returns every DCQL query configuration belonging to the calling tenant, ordered by `queryId`. Returns an empty array when the tenant has no configurations. Only the calling tenant's configurations are visible.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlQueries\"}" } } }, { "name": "Author a DCQL query from verifiable-credential channels and persist it", "disabled": true, "request": { "description": "Derives a multi-credential DCQL query from the referenced, version-pinned verifiable-credential channels, persists it to the versioned DCQL store under the caller-chosen `queryId`, and records REQUEST-role business-term usage lineage. Authoring an existing `queryId` appends a new version (the version in the response advances monotonically). Requires the `semantic-modeling.v1` feature; without it the request fails with `403` and nothing is persisted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.createAuthoredDcqlQuery\"}" } } }, { "name": "Create a DCQL query configuration", "disabled": true, "request": { "description": "Creates a new DCQL query configuration for the calling tenant. The `queryId` you supply becomes the stable handle used to reference, update, and delete the configuration later. Fails with `409` if a configuration with the same `queryId` already exists for the tenant, and with `400` if the DCQL query is malformed (for example a query that has neither `credentials` nor `credential_sets`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.createDcqlQuery\"}" } } }, { "name": "Preview a DCQL query derived from verifiable-credential channels, without persisting it", "disabled": true, "request": { "description": "Derives a multi-credential DCQL query from the referenced, version-pinned verifiable-credential channels and returns it together with per-credential-query provenance. Nothing is created or modified. Each channel reference contributes exactly one credential query. Requires the `semantic-modeling.v1` feature; without it the request fails with `403`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.previewDcqlQuery\"}" } } }, { "name": "Delete a DCQL query configuration", "disabled": true, "request": { "description": "Permanently deletes the configuration identified by `{queryId}` for the calling tenant. Returns `204` with no body on success and `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.deleteDcqlQuery\"}" } } }, { "name": "List versions of a DCQL query configuration", "disabled": true, "request": { "description": "GET /queries/{queryId}/versions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlQueryVersions\"}" } } }, { "name": "Get a DCQL query configuration", "disabled": true, "request": { "description": "Returns the single DCQL query configuration identified by `{queryId}` for the calling tenant. Fails with `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getDcqlQuery\"}" } } }, { "name": "Get a single version of a DCQL query configuration", "disabled": true, "request": { "description": "GET /queries/{queryId}/versions/{version}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getDcqlQueryVersion\"}" } } }, { "name": "Partially update a DCQL query configuration", "disabled": true, "request": { "description": "Partially updates the configuration identified by `{queryId}`. Only the fields present (and non-null) in the body are changed; every omitted field keeps its stored value. The merge behaviour matches `PUT`, but `PATCH` is the idiomatic verb when changing one or two fields (for example flipping `enabled` to `false` without resending the DCQL query). The `queryId` is taken from the path, never the body. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.patchDcqlQuery\"}" } } }, { "name": "Restore a previous version of a DCQL query configuration", "disabled": true, "request": { "description": "Restores the configuration to the supplied version, creating a new current version with the restored content. Returns the resulting configuration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.restoreDcqlQueryVersion\"}" } } }, { "name": "Replace a DCQL query configuration", "disabled": true, "request": { "description": "Replaces the configuration identified by `{queryId}`. A `PUT` caller supplies every mutable field (`name`, `description`, `dcqlQuery`, `enabled`). The `queryId` is taken from the path and is never read from the body. Any field omitted or sent as `null` leaves the stored value unchanged, so to clear `description` send an empty string rather than `null`. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.replaceDcqlQuery\"}" } } } ] } ] }, { "name": "oid4vp-universal", "description": "Operations associated with the oid4vp-universal guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-universal-operations", "description": "oid4vp-universal-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create authorization request and session", "disabled": true, "request": { "description": "Creates a new OID4VP authorization request that can be used to request digital credentials\nfrom a wallet. Returns the URIs needed to start the flow and check its status. The supplied\n`queryId` must be configured on the Relying Party agent.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.create-authorization-request\"}" } } }, { "name": "Remove authorization request state", "disabled": true, "request": { "description": "Deletes all state associated with an authorization request. Use for cleanup after completion or timeout.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.delete-authorization-request\"}" } } }, { "name": "Get authorization session status", "disabled": true, "request": { "description": "Checks the current status of an Authorization Request session. Can optionally include verified credential data\nin the response when the status is 'verified'.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.get-authorization-status\"}" } } } ] } ] }, { "name": "oid4vp-verification-template", "description": "Operations associated with the oid4vp-verification-template guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-verification-template-operations", "description": "oid4vp-verification-template-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List verification templates", "disabled": true, "request": { "description": "GET /templates/verification. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.listVerificationTemplates\"}" } } }, { "name": "Create verification template", "disabled": true, "request": { "description": "POST /templates/verification. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.createVerificationTemplate\"}" } } }, { "name": "Delete verification template", "disabled": true, "request": { "description": "DELETE /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.deleteVerificationTemplate\"}" } } }, { "name": "Get verification template", "disabled": true, "request": { "description": "GET /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.getVerificationTemplate\"}" } } }, { "name": "Patch verification template", "disabled": true, "request": { "description": "PATCH /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.patchVerificationTemplate\"}" } } }, { "name": "Replace verification template", "disabled": true, "request": { "description": "PUT /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.replaceVerificationTemplate\"}" } } }, { "name": "Create authorization request from verification template", "disabled": true, "request": { "description": "Resolves the template, resolves the configured DCQL query/version, merges overrides, and calls the existing authorization-request session creation path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.createAuthorizationRequestFromVerificationTemplate\"}" } } } ] } ] }, { "name": "oid4vp-verifier", "description": "Operations associated with the oid4vp-verifier guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-verifier-operations", "description": "oid4vp-verifier-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Execute a verifier testing action", "disabled": true, "request": { "description": "POST /api/oid4vp/v1/testing/instances/{instanceId}/actions/{action}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.executeOid4vpTestingAction\"}" } } }, { "name": "Get verifier testing-console bootstrap links", "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/oid4vp/v1/testing/instances/{instanceId}/bootstrap" } }, { "name": "Get verifier testing-console capabilities", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingCapabilities\"}" } } }, { "name": "List event-sourced verifier sessions", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingSessions\"}" } } }, { "name": "Get a verifier session projection", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions/{sessionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingSession\"}" } } }, { "name": "List immutable verifier session events", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions/{sessionId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingSessionEvents\"}" } } }, { "name": "List verifier testing templates", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingTemplates\"}" } } }, { "name": "Execute a verifier testing template", "disabled": true, "request": { "description": "POST /api/oid4vp/v1/testing/instances/{instanceId}/templates/{templateId}/execute. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.executeOid4vpTestingTemplate\"}" } } }, { "name": "Get the verifier testing workspace", "disabled": true, "request": { "description": "Returns operational dashboard aggregates, client/DCQL/template catalog metadata, transport defaults, and action URLs. AS-protected instances require their exact configured resource grant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingWorkspace\"}" } } } ] } ] }, { "name": "party-manager", "description": "Operations associated with the party-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "party-manager-operations", "description": "party-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List groups", "disabled": true, "request": { "description": "Returns a page of `group` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listGroups\"}" } } }, { "name": "Create a group", "disabled": true, "request": { "description": "POST /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createGroup\"}" } } }, { "name": "Soft-delete a group", "disabled": true, "request": { "description": "DELETE /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteGroup\"}" } } }, { "name": "Get a group", "disabled": true, "request": { "description": "GET /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getGroup\"}" } } }, { "name": "Update a group", "disabled": true, "request": { "description": "PUT /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateGroup\"}" } } }, { "name": "List a group's members", "disabled": true, "request": { "description": "Returns a page of the parties that are members of the group. Members may be of any type, so each item is a polymorphic [PartyEntity].\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listGroupMembers\"}" } } }, { "name": "Replace a group's membership", "disabled": true, "request": { "description": "Replaces the full membership of the group with the supplied set of party ids.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.replaceGroupMembers\"}" } } }, { "name": "Remove a party from a group", "disabled": true, "request": { "description": "Removes the party from the group's membership. Idempotent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.removeGroupMember\"}" } } }, { "name": "Add a party to a group", "disabled": true, "request": { "description": "Adds the party to the group's membership. Idempotent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addGroupMember\"}" } } }, { "name": "Remove an identity's application binding", "disabled": true, "request": { "description": "DELETE /identities/{identityId}/applications/{applicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteIdentityApplicationBinding\"}" } } }, { "name": "Get an identity's application binding", "disabled": true, "request": { "description": "Returns the binding between an identity and an application's login surface, including the permitted authentication methods and the binding status.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getIdentityApplicationBinding\"}" } } }, { "name": "Bind an identity to an application", "disabled": true, "request": { "description": "Creates or replaces the binding between an identity and an application's login surface, making the identity authenticable against that application with the permitted methods.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.setIdentityApplicationBinding\"}" } } }, { "name": "List organizations", "disabled": true, "request": { "description": "Returns a page of `organization` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizations\"}" } } }, { "name": "Create an organization", "disabled": true, "request": { "description": "POST /organizations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createOrganization\"}" } } }, { "name": "Soft-delete an organization", "disabled": true, "request": { "description": "DELETE /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteOrganization\"}" } } }, { "name": "Get an organization", "disabled": true, "request": { "description": "GET /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getOrganization\"}" } } }, { "name": "Update an organization", "disabled": true, "request": { "description": "PUT /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateOrganization\"}" } } }, { "name": "List an organization's registrations", "disabled": true, "request": { "description": "Returns the business registrations held by the organization.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationRegistrations\"}" } } }, { "name": "Add a registration to an organization", "disabled": true, "request": { "description": "POST /organizations/{id}/registrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addOrganizationRegistration\"}" } } }, { "name": "List organization units", "disabled": true, "request": { "description": "Returns a page of `organization_unit` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnits\"}" } } }, { "name": "Create an organization unit", "disabled": true, "request": { "description": "POST /ou. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createOrganizationUnit\"}" } } }, { "name": "Soft-delete an organization unit", "disabled": true, "request": { "description": "DELETE /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteOrganizationUnit\"}" } } }, { "name": "Get an organization unit", "disabled": true, "request": { "description": "GET /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getOrganizationUnit\"}" } } }, { "name": "Update an organization unit", "disabled": true, "request": { "description": "PUT /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateOrganizationUnit\"}" } } }, { "name": "List an organization unit's child units", "disabled": true, "request": { "description": "Returns a page of the organization units whose `parentOuId` is this unit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnitChildren\"}" } } }, { "name": "List an organization unit's members", "disabled": true, "request": { "description": "Returns a page of the parties whose home organization unit is this unit. Members may be of any type, so each item is a polymorphic [PartyEntity].\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnitMembers\"}" } } }, { "name": "List parties of any type", "disabled": true, "request": { "description": "Returns a page of parties in the caller's tenant across all types. Each item is a polymorphic [PartyEntity] discriminated by `partyType`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listParties\"}" } } }, { "name": "Get a party of any type", "disabled": true, "request": { "description": "Returns the party as a polymorphic [PartyEntity], whatever its type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getParty\"}" } } }, { "name": "List a party's electronic addresses", "disabled": true, "request": { "description": "Returns the party's electronic addresses, primary addresses first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listElectronicAddresses\"}" } } }, { "name": "Add an electronic address to a party", "disabled": true, "request": { "description": "POST /parties/{id}/addresses/electronic. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addElectronicAddress\"}" } } }, { "name": "Delete an electronic address", "disabled": true, "request": { "description": "DELETE /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteElectronicAddress\"}" } } }, { "name": "Get one electronic address", "disabled": true, "request": { "description": "GET /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getElectronicAddress\"}" } } }, { "name": "Update an electronic address", "disabled": true, "request": { "description": "PUT /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateElectronicAddress\"}" } } }, { "name": "List a party's physical addresses", "disabled": true, "request": { "description": "Returns the physical and postal addresses attached to the party.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPhysicalAddresses\"}" } } }, { "name": "Add a physical address to a party", "disabled": true, "request": { "description": "POST /parties/{id}/addresses/physical. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addPhysicalAddress\"}" } } }, { "name": "Delete a physical address", "disabled": true, "request": { "description": "DELETE /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deletePhysicalAddress\"}" } } }, { "name": "Get one physical address", "disabled": true, "request": { "description": "GET /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getPhysicalAddress\"}" } } }, { "name": "Update a physical address", "disabled": true, "request": { "description": "PUT /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updatePhysicalAddress\"}" } } }, { "name": "List a party's relationships", "disabled": true, "request": { "description": "Returns the relationships the party participates in, on either side.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPartyRelationships\"}" } } }, { "name": "List persons", "disabled": true, "request": { "description": "Returns a page of `natural_person` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPersons\"}" } } }, { "name": "Create a person", "disabled": true, "request": { "description": "POST /persons. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createPerson\"}" } } }, { "name": "Soft-delete a person", "disabled": true, "request": { "description": "DELETE /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deletePerson\"}" } } }, { "name": "Get a person", "disabled": true, "request": { "description": "GET /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getPerson\"}" } } }, { "name": "Update a person", "disabled": true, "request": { "description": "PUT /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updatePerson\"}" } } }, { "name": "List relationships", "disabled": true, "request": { "description": "Returns a page of relationships in the caller's tenant. Filters combine with AND. Use `partyId` to match either side, or `leftId`/`rightId` to match a specific side. Both counter-parties are resolvable to their full [PartyEntity] through the party endpoints.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listRelationships\"}" } } }, { "name": "Create a relationship", "disabled": true, "request": { "description": "POST /relationships. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createRelationship\"}" } } }, { "name": "Delete a relationship", "disabled": true, "request": { "description": "DELETE /relationships/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteRelationship\"}" } } }, { "name": "Get a relationship", "disabled": true, "request": { "description": "Returns a single relationship by id. Both counter-parties are resolvable to their full [PartyEntity] through the party endpoints.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getRelationship\"}" } } }, { "name": "Update a relationship", "disabled": true, "request": { "description": "Updates status, validity end, and verification. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateRelationship\"}" } } }, { "name": "List services", "disabled": true, "request": { "description": "Returns a page of `service` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listServices\"}" } } }, { "name": "Create a service", "disabled": true, "request": { "description": "POST /services. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createService\"}" } } }, { "name": "Soft-delete a service", "disabled": true, "request": { "description": "DELETE /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteService\"}" } } }, { "name": "Get a service", "disabled": true, "request": { "description": "GET /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getService\"}" } } }, { "name": "Update a service", "disabled": true, "request": { "description": "PUT /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateService\"}" } } }, { "name": "Get an application's login configuration", "disabled": true, "request": { "description": "Returns the login-surface configuration for a `service` party that acts as an application: the accepted authentication methods, the identifier types usable to log in, the permitted external IdPs, and whether self-registration is open.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getApplicationLoginConfig\"}" } } }, { "name": "Set an application's login configuration", "disabled": true, "request": { "description": "Sets the login-surface configuration for a `service` party that acts as an application: the accepted authentication methods, the identifier types usable to log in, the permitted external IdPs, and whether self-registration is open.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.setApplicationLoginConfig\"}" } } } ] } ] }, { "name": "platform-admin", "description": "Operations associated with the platform-admin guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-admin-operations", "description": "platform-admin-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get the license status projection", "disabled": true, "request": { "description": "Returns the sanitized status projection of the effective license - lifecycle status, per-product summaries, and expiry signals. Underlying license material, decoded claims, and the entitlement graph are never exposed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationLicense\"}" } } }, { "name": "Get onboarding policy", "disabled": true, "request": { "description": "Returns the onboarding policy toggles that constrain which onboarding flows are accepted.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationOnboarding\"}" } } }, { "name": "Update onboarding policy", "disabled": true, "request": { "description": "Updates the onboarding policy. Every field is optional; a field left\nunset leaves that toggle unchanged. Returns the full updated policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.putApplicationOnboarding\"}" } } }, { "name": "Get evaluated onboarding availability", "disabled": true, "request": { "description": "Returns the evaluated availability matrix composed from license features,\nconfig toggles, and runtime readiness of the application tenant and email\ntransport. Each flow carries a stable reason string\nwhen it is unavailable.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationOnboardingAvailability\"}" } } }, { "name": "Get application tenant status", "disabled": true, "request": { "description": "Returns the runtime state of the application tenant, including the\nreadiness of the platform-hosted authorization server and whether the\nfirst customer tenant can yet be registered.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationTenant\"}" } } }, { "name": "Create or reconcile the application tenant", "disabled": true, "request": { "description": "Creates the application tenant and its hosted authorization server, or\nreconciles them if they already exist, and returns the resulting state.\nOptional operator contact details seed the initial operator account.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.bootstrapApplicationTenant\"}" } } }, { "name": "Get the feature catalog", "disabled": true, "request": { "description": "Returns the data-driven feature catalog (the assembled FeatureRegistry). Each entry carries the stable feature key, its typed value kind, a description, and the products that may include it. Read-only; drives the admin console feature/entitlement surfaces.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getFeatureCatalog\"}" } } }, { "name": "Get tenant onboarding status", "disabled": true, "request": { "description": "Returns the public-safe lifecycle status of a tenant registration attempt,\nincluding the per-step timeline, keyed by the `correlationId` returned at\nregistration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getTenantOnboardingStatus\"}" } } }, { "name": "List tenants", "disabled": true, "request": { "description": "Lists tenants as a paginated envelope. Supply `parentTenantId` to list the\nchildren of a parent; omit it to list root tenants. Sort by `createdAt` or\n`slug`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenants\"}" } } }, { "name": "Register a tenant", "disabled": true, "request": { "description": "Registers an organization tenant with required natural-person contacts,\na mandatory default authorization server and key store, optional issuer\nand verifier surfaces, and owner/admin account delivery.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.registerTenant\"}" } } }, { "name": "Confirm tenant signup email token", "request": { "description": "Public entry point. Confirms a signup using the plaintext verification\ntoken from the email. When approval is not required the response carries\nthe resulting registration. The verification token is write-only.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/confirm" } }, { "name": "List pending tenant signups", "disabled": true, "request": { "description": "Lists pending signup requests as a paginated envelope. Supply\n`parentTenantId` to scope to a parent; omit it to list root signups. Sort\nby `createdAt` or `email`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listPendingTenantSignups\"}" } } }, { "name": "Mark expired pending tenant signups", "disabled": true, "request": { "description": "Marks pending signup requests whose expiry has passed as expired, relative to the supplied `now`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.reconcileExpiredTenantSignups\"}" } } }, { "name": "Request tenant signup email verification", "request": { "description": "Public entry point. Starts a self-service signup and sends an email\nverification to the supplied address. Returns the signup request id, its\nexpiry, whether operator approval is required, and the email delivery\nresult.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/request" } }, { "name": "Approve pending tenant signup", "disabled": true, "request": { "description": "Approves an email-verified signup request and drives it to registration.\nWhen registration completes the response carries the resulting\nregistration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.approveTenantSignup\"}" } } }, { "name": "Reject pending tenant signup", "disabled": true, "request": { "description": "Rejects a pending signup request with an optional reason.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.rejectTenantSignup\"}" } } }, { "name": "Resend tenant signup email verification", "request": { "description": "Public entry point. Re-mints and resends the verification email for a pending signup request.", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/{signupRequestId}/resend" } }, { "name": "Delete tenant", "disabled": true, "request": { "description": "Soft-deletes the tenant routing row.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.deleteTenant\"}" } } }, { "name": "Get tenant", "disabled": true, "request": { "description": "Returns a single tenant by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getTenant\"}" } } }, { "name": "List immediate child tenants", "disabled": true, "request": { "description": "Lists the immediate children of a parent tenant as a paginated envelope. Sort by `createdAt` or `slug`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listSubtenants\"}" } } }, { "name": "List tenant domains", "disabled": true, "request": { "description": "Lists the domains attached to a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenantDomains\"}" } } }, { "name": "Add tenant domain", "disabled": true, "request": { "description": "Attaches a domain (platform subdomain or custom) to a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.addTenantDomain\"}" } } }, { "name": "Remove tenant domain", "disabled": true, "request": { "description": "Detaches a domain from a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.removeTenantDomain\"}" } } }, { "name": "Verify tenant custom domain", "disabled": true, "request": { "description": "Submits a DNS challenge proof to verify a custom domain and returns the\nupdated domain. The verification proof is write-only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.markTenantDomainVerified\"}" } } }, { "name": "Update tenant status", "disabled": true, "request": { "description": "Updates a tenant's lifecycle status and returns the updated tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.updateTenantStatus\"}" } } }, { "name": "List tenant public endpoint bindings", "disabled": true, "request": { "description": "Lists the public endpoint bindings for a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenantPublicEndpoints\"}" } } }, { "name": "Delete tenant public endpoint binding", "disabled": true, "request": { "description": "Deletes the public endpoint binding for a tenant and service type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.deleteTenantPublicEndpoint\"}" } } }, { "name": "Create or update tenant public endpoint binding", "disabled": true, "request": { "description": "Creates or updates the public endpoint binding for a tenant and service type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.upsertTenantPublicEndpoint\"}" } } } ] } ] }, { "name": "platform-bootstrap", "description": "Operations associated with the platform-bootstrap guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-bootstrap-operations", "description": "platform-bootstrap-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the tenant admin-console context for the exact public host", "request": { "description": "Returns the browser-safe tenant administration context bound to the\nexact public origin supplied by the trusted reverse proxy. The service\nreads `X-Forwarded-Host`, `X-Forwarded-Proto`, and\n`X-Forwarded-Prefix`; it does not accept a tenant id or slug selector.\n\nResolution succeeds only when the host is a non-deleted verified tenant\ndomain, the owning tenant is ACTIVE, and an active OAuth2 authorization\nserver endpoint for the same tenant is registered on that exact host.\nUnknown, unverified, inactive, cross-tenant, and host-mismatched\nrequests all return 404. The response contains no client secret,\ninternal network address, credential, or token.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/admin-console-context" } }, { "name": "Get internal platform bootstrap configuration", "disabled": true, "request": { "description": "Returns the platform-authoritative bootstrap projection for an internal\nconsumer such as a satellite, workload service, frontend server, or\noperator tool.\n\nThe response may include internal Kubernetes or Docker network\naddresses. It is not browser-safe and must be protected by service or\noperator authentication.\n\n`services.tenantKms` is internal service discovery for the tenant-KMS\ngRPC command receiver and its HTTP health endpoint. It never advertises\na public or generic KMS REST API. KMS resource administration remains on\nthe typed platform-config surface.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-bootstrap.getPlatformBootstrapConfig\"}" } } }, { "name": "Get browser-safe application runtime configuration", "request": { "description": "Returns the sanitized runtime configuration response for a known\nplatform-hosted browser application.\n\nKnown application ids include `admin-console`, `platform-onboarding`,\nand `license-portal`. Unknown application ids are rejected. The response\nis safe to expose to browser JavaScript and does not include internal\nKubernetes or Docker addresses, raw secrets, business-authored credential\nartifacts, DCQL query bodies, issuer or verifier designs, or service\nconfiguration bodies.\n\nThe response may use the inbound request origin as the platform base URL.\nThat behavior is for browser runtime wiring only; `.well-known` protocol\nmetadata continues to use the canonical public endpoint binding for the\nresolved tenant/service.\n\nTyped KMS administration is exposed only by the platform-config API.\nBrowser runtime configuration never projects a tenant-KMS service or\ngeneric KMS provider, key, or credential endpoint.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/runtime-config/{applicationId}" } } ] } ] }, { "name": "platform-config", "description": "Operations associated with the platform-config guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-config-operations", "description": "platform-config-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get tenant-wide Developer Console configuration", "disabled": true, "request": { "description": "Returns effective tenant defaults and tenant overrides for the Developer Console.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getDeveloperConsoleConfig\"}" } } }, { "name": "Replace tenant-wide Developer Console configuration", "disabled": true, "request": { "description": "Replaces the tenant policy when the supplied revision is current; the response has the next revision.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceDeveloperConsoleConfig\"}" } } }, { "name": "List authorization-server migration entries", "disabled": true, "request": { "description": "Lists only the acting customer tenant's sanitized migration ledger entries. The platform tenant is rejected. Source configuration values, credentials, secret locators, exception messages, and stack traces are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerMigrations\"}" } } }, { "name": "Get an authorization-server migration entry", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-server-migrations/{authorizationServerMigrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerMigration\"}" } } }, { "name": "Accept and retry a reviewed migration source change", "disabled": true, "request": { "description": "Distinct audited operation for an administrator-reviewed source change. It re-reads the source, requires the recorded and current digests plus ledger revision to match the request, records the digest transition and operator reason, and retries the FAILED source. It is not a resume mode. Conflicts and cancellation do not mutate the ledger.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.acceptAuthorizationServerMigrationSourceChange\"}" } } }, { "name": "Resume a failed authorization-server migration", "disabled": true, "request": { "description": "Invokes the coded migration for a FAILED source using revision and source-digest compare-and-set. It never edits a runtime projection or creates a compatibility record. A stale revision, changed digest, APPLIED entry, wrong tenant, or platform tenant fails with conflict or forbidden and does not mutate the ledger.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resumeAuthorizationServerMigration\"}" } } }, { "name": "List authorization-server resources", "disabled": true, "request": { "description": "Lists durable hosted and external resources for the tenant. Runtime configuration projections are not lifecycle authority.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServers\"}" } } }, { "name": "Create a hosted or external authorization-server resource", "disabled": true, "request": { "description": "Creates a durable authorization-server resource. The platform tenant is not a valid target. EXTERNAL registration performs secured OAuth2 and OIDC discovery from the issuer and accepts no manual endpoint overrides. External resources do not consume a license quota; hosted creation consumes the existing hosted-AS entitlement and quota.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServer\"}" } } }, { "name": "Delete an authorization-server resource", "disabled": true, "request": { "description": "Deletes a decommissioned non-system resource and its generated runtime projection.\n\nBusiness wallets log their users in through an authorization server, so this delete is guarded by the wallet binding join. If any business wallet has this AS as its **default** authorization server the request is rejected with `409` unconditionally: `detachBindings` does not override it, because removing a wallet's default AS breaks login for that wallet. Repoint those wallets at another authorization server first. If wallets merely bind this AS without defaulting to it, the delete is still rejected with `409` unless `detachBindings=true`, which removes those binding rows and de-registers the wallets' public clients as part of the delete. Call `listBusinessWallets` with `boundAuthorizationServerId=` (add `boundDefaultOnly=true` for the unrecoverable set) to enumerate the affected wallets before deleting.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServer\"}" } } }, { "name": "Get an authorization-server resource", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServer\"}" } } }, { "name": "Update an authorization-server resource", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServer\"}" } } }, { "name": "Activate an authorization-server resource", "disabled": true, "request": { "description": "Hosted activation enforces the hosted-AS entitlement and quota. External activation is license-unrestricted and requires a current valid discovery snapshot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.activateAuthorizationServer\"}" } } }, { "name": "List AS OAuth2 clients", "disabled": true, "request": { "description": "Lists public and confidential registrations. Confidential entries expose only credential state and opaque typed references.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerClients\"}" } } }, { "name": "Register an AS OAuth2 client", "disabled": true, "request": { "description": "Creates a public or confidential client registration. Raw secrets are accepted only as write-once values stored immediately through secret management and are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerClient\"}" } } }, { "name": "Delete an AS OAuth2 client", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServerClient\"}" } } }, { "name": "Get an AS OAuth2 client", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerClient\"}" } } }, { "name": "Update an AS OAuth2 client", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServerClient\"}" } } }, { "name": "Replace an AS OAuth2 client", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAuthorizationServerClient\"}" } } }, { "name": "Get hosted authorization-server configuration", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getHostedAuthorizationServerConfiguration\"}" } } }, { "name": "Replace hosted authorization-server configuration", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceHostedAuthorizationServerConfiguration\"}" } } }, { "name": "Decommission an authorization-server resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/decommission. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.decommissionAuthorizationServer\"}" } } }, { "name": "Get AS device flow settings", "disabled": true, "request": { "description": "Returns effective RFC 8628 device authorization grant settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsDeviceFlowSettings\"}" } } }, { "name": "Update AS device flow settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to device flow settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsDeviceFlowSettings\"}" } } }, { "name": "Replace AS device flow settings", "disabled": true, "request": { "description": "Replaces device flow settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsDeviceFlowSettings\"}" } } }, { "name": "Refresh external discovery metadata", "disabled": true, "request": { "description": "Fetches, validates, reconciles, and atomically persists a new metadata snapshot and digest. Redirects, private network targets, DNS rebinding, untrusted TLS, oversized responses, issuer contradictions, and unsupported algorithms are rejected.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.refreshExternalAuthorizationServerDiscovery\"}" } } }, { "name": "Get AS feature policy", "disabled": true, "request": { "description": "Returns the effective OAuth/OIDC feature policy for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsFeaturesSettings\"}" } } }, { "name": "Update AS feature policy", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the feature policy. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsFeaturesSettings\"}" } } }, { "name": "Replace AS feature policy", "disabled": true, "request": { "description": "Replaces the feature policy. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsFeaturesSettings\"}" } } }, { "name": "List federation bindings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listFederationBindings\"}" } } }, { "name": "Create a federation binding", "disabled": true, "request": { "description": "The source must be HOSTED and the target must be an EXTERNAL resource with a validated OIDC capability. This operation is license-unrestricted.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createFederationBinding\"}" } } }, { "name": "Replace federation binding order", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/order. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.reorderFederationBindings\"}" } } }, { "name": "Delete a federation binding", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteFederationBinding\"}" } } }, { "name": "Get a federation binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getFederationBinding\"}" } } }, { "name": "Update a federation binding", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateFederationBinding\"}" } } }, { "name": "Disable a federation binding", "disabled": true, "request": { "description": "Disables the binding through its distinct lifecycle operation and returns enabled false with status DISABLED.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.disableFederationBinding\"}" } } }, { "name": "Enable a validated federation binding", "disabled": true, "request": { "description": "Enables only a binding whose latest persisted validation status is VALID. Unvalidated, invalid, stale, or disabled-without-current-validation bindings are rejected with conflict.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.enableFederationBinding\"}" } } }, { "name": "Validate a federation binding", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateFederationBinding\"}" } } }, { "name": "Get AS grant settings", "disabled": true, "request": { "description": "Returns effective grant types, response types, and scopes for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsGrantSettings\"}" } } }, { "name": "Update AS grant settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to grant settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsGrantSettings\"}" } } }, { "name": "Replace AS grant settings", "disabled": true, "request": { "description": "Replaces grant settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsGrantSettings\"}" } } }, { "name": "List AS identities", "disabled": true, "request": { "description": "Lists real identities bound to the AS application with activation and delivery lifecycle state.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerIdentities\"}" } } }, { "name": "Create an AS identity", "disabled": true, "request": { "description": "Creates or reuses an identity by protected email, adds a suspended AUTHENTICABLE application binding, and sends an activation email when routing is available. The request never accepts a password or activation code. If email is unavailable, the response may contain a one-time manual activation link.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerIdentity\"}" } } }, { "name": "Delete an AS identity", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServerIdentity\"}" } } }, { "name": "Get an AS identity", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerIdentity\"}" } } }, { "name": "Enable or disable an AS identity", "disabled": true, "request": { "description": "Updates only this identity's binding to the addressed authorization server. Disabling does not delete the identity or affect bindings to other applications. The authenticated administrator cannot disable their own account.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServerIdentity\"}" } } }, { "name": "Create a one-time manual activation link", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}/activation/manual-link. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerIdentityManualActivationLink\"}" } } }, { "name": "Resend an AS identity activation email", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}/activation/resend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resendAuthorizationServerIdentityActivation\"}" } } }, { "name": "Send an AS identity password-change email", "disabled": true, "request": { "description": "Only verified primary email identifiers are eligible. No password, token, or manual link is exposed to the operator.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.sendAuthorizationServerIdentityPasswordChange\"}" } } }, { "name": "Get AS interactive authorization settings", "disabled": true, "request": { "description": "Returns effective OID4VCI interactive authorization endpoint (IAE) settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Update AS interactive authorization settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to interactive authorization settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Replace AS interactive authorization settings", "disabled": true, "request": { "description": "Replaces interactive authorization settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Get AS signed metadata settings", "disabled": true, "request": { "description": "Returns effective signed authorization-server metadata document settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsSignedMetadataSettings\"}" } } }, { "name": "Update AS signed metadata settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to signed metadata settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsSignedMetadataSettings\"}" } } }, { "name": "Replace AS signed metadata settings", "disabled": true, "request": { "description": "Replaces signed metadata settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsSignedMetadataSettings\"}" } } }, { "name": "Get hosted authorization-server signing reference", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getHostedAuthorizationServerSigning\"}" } } }, { "name": "Replace hosted authorization-server signing reference", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceHostedAuthorizationServerSigning\"}" } } }, { "name": "Suspend an authorization-server resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.suspendAuthorizationServer\"}" } } }, { "name": "Get AS token exchange settings", "disabled": true, "request": { "description": "Returns effective RFC 8693 token exchange settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsTokenExchangeSettings\"}" } } }, { "name": "Update AS token exchange settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to token exchange settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsTokenExchangeSettings\"}" } } }, { "name": "Replace AS token exchange settings", "disabled": true, "request": { "description": "Replaces token exchange settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsTokenExchangeSettings\"}" } } }, { "name": "Get AS token settings", "disabled": true, "request": { "description": "Returns effective token lifetimes and token behavior for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsTokenSettings\"}" } } }, { "name": "Update AS token settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to token settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsTokenSettings\"}" } } }, { "name": "Replace AS token settings", "disabled": true, "request": { "description": "Replaces token settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsTokenSettings\"}" } } }, { "name": "Validate an external authorization server", "disabled": true, "request": { "description": "Performs SSRF-hardened OAuth2 and OIDC discovery without mutating the stored snapshot. HOSTED resources are rejected.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateExternalAuthorizationServer\"}" } } }, { "name": "Get AS WebAuthn login settings", "disabled": true, "request": { "description": "Returns the effective local WebAuthn relying-party policy for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsWebAuthnSettings\"}" } } }, { "name": "Update AS WebAuthn login settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the local WebAuthn relying-party policy.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsWebAuthnSettings\"}" } } }, { "name": "Replace AS WebAuthn login settings", "disabled": true, "request": { "description": "Replaces the local WebAuthn relying-party policy. Enabling WebAuthn requires an RP ID and at least one allowed origin.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsWebAuthnSettings\"}" } } }, { "name": "List tenant email accounts", "disabled": true, "request": { "description": "Lists SMTP mail accounts registered for the tenant. For the platform tenant these accounts are named platform defaults; regular tenants can add their own accounts to send mail with their own sender name, address, and SMTP server.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailAccounts\"}" } } }, { "name": "Create an email account", "disabled": true, "request": { "description": "Creates an EXTERNAL software party with an EMAIL_SERVER capability and writes the mail account config under `vdx.service.email.accounts..*`. The optional write-only SMTP password creates the account's typed resource binding; raw secret identifiers, provider references, paths, and environment-variable names are rejected.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailAccount\"}" } } }, { "name": "Delete an email account", "disabled": true, "request": { "description": "Soft-deletes the email account software party and removes its mail config prefix. An account referenced as a local default or explicit assignment must first be removed from the routing policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailAccount\"}" } } }, { "name": "Get an email account", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/accounts/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailAccount\"}" } } }, { "name": "Update an email account", "disabled": true, "request": { "description": "Updates the tenant mail account configuration. The path id is the email account software party id; the stable account id remains the `` segment in the config key prefix. SMTP credentials are created, rotated, or detached only through the account's typed resource mutation and are never returned as secret IDs, locators, or plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateEmailAccount\"}" } } }, { "name": "Send a test email through an account", "disabled": true, "request": { "description": "Sends a test message using the selected tenant email account. The path id is the email account software party id; the server resolves the stable `accountId` and dispatches through the tenant-scoped email service.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.testSendEmailAccount\"}" } } }, { "name": "Create a custom email type and its initial template atomically", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/catalog. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailCatalogEntry\"}" } } }, { "name": "Get email routing policy", "disabled": true, "request": { "description": "Returns the tenant-local account-centric routing policy together with redacted effective resolution for every registered email type. Effective routes use an explicit assignment, local default, then the APP-scoped platform default. Account credentials are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailRouting\"}" } } }, { "name": "Replace email routing policy", "disabled": true, "request": { "description": "Atomically replaces the local policy. Tenant policies may reference only accounts in that tenant's TENANT scope; the platform policy may reference only APP-scoped platform accounts. An email type may be assigned to only one account. Disabled types never resolve.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.putEmailRouting\"}" } } }, { "name": "List email templates", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailTemplates\"}" } } }, { "name": "Create another template for an existing email type", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailTemplate\"}" } } }, { "name": "Delete a locally owned email template", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/email/templates/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailTemplate\"}" } } }, { "name": "Get an email template and revision history", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/templates/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailTemplate\"}" } } }, { "name": "Save an email template draft", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/email/templates/{templateId}/draft. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.saveEmailTemplateDraft\"}" } } }, { "name": "Reset a local template override to its inherited layer", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/email/templates/{templateId}/override. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resetEmailTemplateOverride\"}" } } }, { "name": "Render a branded email template preview", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.previewEmailTemplate\"}" } } }, { "name": "Publish the current email template draft", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.publishEmailTemplate\"}" } } }, { "name": "Copy a historical revision into a new draft", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/revisions/{revision}/draft. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.rollbackEmailTemplateToDraft\"}" } } }, { "name": "Send a draft or published template through effective routing", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/test-send. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.testSendEmailTemplate\"}" } } }, { "name": "List registered email types", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/types. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailTypes\"}" } } }, { "name": "Create a custom email type", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/types. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailType\"}" } } }, { "name": "Delete a custom email type", "disabled": true, "request": { "description": "System types cannot be deleted. Custom types referenced by templates or routing must be detached first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailType\"}" } } }, { "name": "Get an email type", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/types/{emailTypeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailType\"}" } } }, { "name": "Update an email type", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/email/types/{emailTypeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateEmailType\"}" } } }, { "name": "Read the tenant's default KMS provider", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/kms/default-provider. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getDefaultKmsProvider\"}" } } }, { "name": "Set the tenant's default KMS provider", "disabled": true, "request": { "description": "The provider must be one the tenant can currently see: a tenant-owned KMS in CONFIGURED state, or an enabled platform KMS. Anything else returns 400.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.setDefaultKmsProvider\"}" } } }, { "name": "List tenant-visible typed KMS offerings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/kms/offerings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listKmsResourceOfferings\"}" } } }, { "name": "List typed KMS resources", "disabled": true, "request": { "description": "Returns browser-safe resource projections addressed only by opaque handles.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listKmsResources\"}" } } }, { "name": "Create a platform-managed typed KMS resource", "disabled": true, "request": { "description": "Creates approved product-owned provider and credential state without caller-selected internal identities.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createManagedKmsResource\"}" } } }, { "name": "Get safe typed KMS resource configuration", "disabled": true, "request": { "description": "Returns a tenant-owned typed KMS resource by opaque handle. Cloud coordinates are limited to the approved public configuration projection. Credential material, permits, raw locators, product-managed credential references, and platform-owned shared-instance configuration are never returned.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getKmsResourceDetail\"}" } } }, { "name": "Attach, write through, or retain an AWS KMS credential", "disabled": true, "request": { "description": "PRODUCT_MANAGED resources accept an optional write-only secret with their derived reference. TENANT_SUPPLIED resources accept only a tenant-owned secret reference plus providerAssignmentId and never plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachAwsKmsCredential\"}" } } }, { "name": "Attach, write through, or retain an Azure Key Vault credential", "disabled": true, "request": { "description": "PRODUCT_MANAGED resources accept an optional write-only secret with their derived reference. TENANT_SUPPLIED resources accept only a tenant-owned secret reference plus providerAssignmentId and never plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachAzureKeyVaultCredential\"}" } } }, { "name": "Read SOFTWARE KMS credential status", "disabled": true, "request": { "description": "Returns status and a read-safe credential reference without material.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getSoftwareKmsCredentialStatus\"}" } } }, { "name": "Write or retain a SOFTWARE KMS credential", "disabled": true, "request": { "description": "The credential reference is required. Supplying the optional write-only password writes through to the binding; omitting it retains the current credential.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.writeSoftwareKmsCredential\"}" } } }, { "name": "Upload a SOFTWARE KMS keystore", "disabled": true, "request": { "description": "Replaces the protected uploaded keystore generation for an UPLOADED_FILE resource. The password and keystore bytes are write-only; clients must send the expected resource version and the configured Java keystore type. Re-upload is the only synchronization path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.uploadSoftwareKmsKeystore\"}" } } }, { "name": "Detach a typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/detach. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.detachKmsResource\"}" } } }, { "name": "Change a typed cloud KMS resource reference", "disabled": true, "request": { "description": "Changes validated non-secret cloud coordinates using optimistic resource versioning.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.changeKmsResourceReference\"}" } } }, { "name": "Retire a detached typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/retire. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.retireKmsResource\"}" } } }, { "name": "Rotate a platform-managed KMS credential", "disabled": true, "request": { "description": "Rotates the existing typed credential leaf using a reference-first, write-through body. Plaintext input is write-only and never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.rotateKmsResource\"}" } } }, { "name": "Read which tenants a platform-owned KMS is offered to", "disabled": true, "request": { "description": "Platform tenant only. Returns the tenants this KMS is offered to. A tenant that is not the platform tenant receives 403 regardless of whether the handle exists.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getKmsResourceSharing\"}" } } }, { "name": "Set which tenants a platform-owned KMS is offered to", "disabled": true, "request": { "description": "Platform tenant only. Replaces the allow-list. Removing a tenant that had enabled this KMS revokes its access on the next provider resolution; keys the tenant created in it are retained but become unreachable until the offer is restored.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.setKmsResourceSharing\"}" } } }, { "name": "Validate a typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateKmsResource\"}" } } }, { "name": "Attach a tenant-managed cloud KMS resource reference", "disabled": true, "request": { "description": "Attaches validated non-secret cloud coordinates; credential authority is attached separately.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachKmsResourceReference\"}" } } }, { "name": "List platform KMSes offered to this tenant", "disabled": true, "request": { "description": "Returns the platform-owned KMSes offered to the calling tenant, each flagged with whether the tenant has enabled it. Configuration and credential state of the platform KMS are never included.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listSharedKmsProviders\"}" } } }, { "name": "Stop using an offered platform KMS", "disabled": true, "request": { "description": "Disabling removes the provider from the tenant's KMS REST surface. Keys the tenant created in it are retained and reappear if it is enabled again. Returns 409 when the provider is the tenant's current default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.disableSharedKmsProvider\"}" } } }, { "name": "Enable an offered platform KMS for this tenant", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/shared-providers/{providerId}:enable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.enableSharedKmsProvider\"}" } } }, { "name": "Import OID4VCI credential configurations from a remote issuer", "disabled": true, "request": { "description": "Fetches issuer metadata from the requested source and materializes the selected `credential_configuration_id` values as per-configuration settings, optionally creating or updating accompanying credential designs. When `dryRun` is true the planned actions are returned without writing any changes.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.importOid4vciIssuerCredentialConfigurations\"}" } } }, { "name": "List OID4VCI issuer per-configuration non-display settings", "disabled": true, "request": { "description": "Returns the editable NON-DISPLAY settings for every `credential_configuration_id` the issuer advertises. The per-locale credential/claim display is owned by the credential-design API and is not part of this resource. These settings are overlaid onto the credential designs by the issuer-metadata read path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerCredentialConfigurationSettings\"}" } } }, { "name": "Delete a single OID4VCI issuer credential-configuration's non-display settings", "disabled": true, "request": { "description": "Removes the `credential_configuration_id` from the issuer's credential-configuration index and clears its non-display settings. Design-authored display and claim metadata are not deleted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciIssuerCredentialConfigurationSetting\"}" } } }, { "name": "Get a single OID4VCI issuer credential-configuration's non-display settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/credential-config-settings/{credentialConfigurationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerCredentialConfigurationSetting\"}" } } }, { "name": "Update a single OID4VCI issuer credential-configuration's non-display settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to one `credential_configuration_id`. Absent fields stay unchanged. Explicit null clears the field. Design-authored display and claim metadata for the same configuration are left untouched.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerCredentialConfigurationSetting\"}" } } }, { "name": "Create or replace a single OID4VCI issuer credential-configuration's non-display settings", "disabled": true, "request": { "description": "Upserts the non-display settings for one `credential_configuration_id` and registers it in the issuer's credential-configuration index. Scalar and list fields are replaced wholesale; omitted/null fields are cleared. Design-authored display and claim metadata for the same configuration are left untouched.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerCredentialConfigurationSetting\"}" } } }, { "name": "Get OID4VCI issuer credential defaults", "disabled": true, "request": { "description": "Returns the effective issuer-level credential defaults with per-field source markers. Each field resolves as `issuer` (a default set at this issuer scope) over `default` (the platform default). These defaults form the `issuer` layer beneath per-configuration settings: for a credential configuration the effective value resolves `configuration` over `issuer` over `design` over `default`. Inheritance is live and resolved at read and issuance time, never snapshotted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerCredentialDefaults\"}" } } }, { "name": "Update OID4VCI issuer credential defaults", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the issuer credential defaults. Absent fields stay unchanged. Explicit null clears the issuer default for that field and returns it to the platform default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerCredentialDefaults\"}" } } }, { "name": "Replace OID4VCI issuer credential defaults", "disabled": true, "request": { "description": "Replaces the issuer credential defaults. Provided non-null fields become issuer-level defaults; omitted fields and explicit nulls clear the issuer default and return the field to the platform default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerCredentialDefaults\"}" } } }, { "name": "List OID4VCI issuer effective per-configuration settings", "disabled": true, "request": { "description": "Returns the effective NON-DISPLAY settings for every advertised `credential_configuration_id` with per-field source markers. For each field the effective value resolves `configuration` (the per-configuration setting) over `issuer` (the issuer credential default) over `design` (identity and display carried by the bound credential design) over `default` (the platform default). Inheritance is live and resolved at read time. A separate `effective-` path segment is used because configuration ids are free-form strings.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerEffectiveCredentialConfigurationSettings\"}" } } }, { "name": "Get a single OID4VCI issuer credential-configuration's effective settings", "disabled": true, "request": { "description": "Returns the effective NON-DISPLAY settings for one `credential_configuration_id` with per-field source markers, resolving `configuration` over `issuer` over `design` over `default`. Inheritance is live and resolved at read time.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerEffectiveCredentialConfigurationSetting\"}" } } }, { "name": "Get EDK OID4VCI issuer issuance settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerIssuanceSettings\"}" } } }, { "name": "Update EDK OID4VCI issuer issuance settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerIssuanceSettings\"}" } } }, { "name": "Get EDK OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerMetadataSettings\"}" } } }, { "name": "Update EDK OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerMetadataSettings\"}" } } }, { "name": "Replace EDK OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuer/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerMetadataSettings\"}" } } }, { "name": "Get EDK OID4VCI issuer security settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/security. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerSecuritySettings\"}" } } }, { "name": "Update EDK OID4VCI issuer security settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/security. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerSecuritySettings\"}" } } }, { "name": "Get the OID4VCI issuer Trust Domain API connection", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/trust-domain-api. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerTrustDomainApiSettings\"}" } } }, { "name": "Update the OID4VCI issuer Trust Domain API connection", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/trust-domain-api. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerTrustDomainApiSettings\"}" } } }, { "name": "List an issuer's authorization-server bindings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerAuthorizationServerBindings\"}" } } }, { "name": "Bind an authorization server to an issuer", "disabled": true, "request": { "description": "The authorization server must belong to the same tenant and support the issuer's selected grant policy. Exactly one enabled binding must be the default.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Remove an issuer authorization-server binding", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Replace an issuer authorization-server binding", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Clear a credential configuration's AS override", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Get a credential configuration's AS override", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Replace a credential configuration's AS override", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Clear an issuance template's AS override", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Get an issuance template's AS override", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Replace an issuance template's AS override", "disabled": true, "request": { "description": "Enabled multi-credential templates are rejected if their credentials resolve to different authorization servers.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Get an issuer's OID4VCI protocol profile", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/protocol-profile. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerProtocolProfile\"}" } } }, { "name": "Atomically apply an OID4VCI profile upgrade", "disabled": true, "request": { "description": "Applies only a compatible preflight at the expected revision, records an audit event, invalidates metadata, and leaves in-flight offers and authorization transactions on their snapshotted starting profile.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.applyOid4vciIssuerProfileUpgrade\"}" } } }, { "name": "Dry-run an OID4VCI profile upgrade", "disabled": true, "request": { "description": "Reports incompatible credentials, metadata, grants, AS bindings, and templates without mutation.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.dryRunOid4vciIssuerProfileUpgrade\"}" } } }, { "name": "Get EDK OID4VP verifier client settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/client. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierClientSettings\"}" } } }, { "name": "Update EDK OID4VP verifier client settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/client. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierClientSettings\"}" } } }, { "name": "Get EDK OID4VP verifier reconciliation settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/identity-reconciliation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierReconciliationSettings\"}" } } }, { "name": "Update EDK OID4VP verifier reconciliation settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/identity-reconciliation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierReconciliationSettings\"}" } } }, { "name": "Get EDK OID4VP request-object signing settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/request-object-signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierRequestObjectSigningSettings\"}" } } }, { "name": "Update EDK OID4VP request-object signing settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/request-object-signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierRequestObjectSigningSettings\"}" } } }, { "name": "Get EDK OID4VP verifier session settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierSessionSettings\"}" } } }, { "name": "Update EDK OID4VP verifier session settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierSessionSettings\"}" } } }, { "name": "Get a status-list signing key binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/status-lists/{statusListId}/signing-key. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getStatusListSigningKeyBinding\"}" } } }, { "name": "Replace a status-list signing key binding", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/status-lists/{statusListId}/signing-key. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceStatusListSigningKeyBinding\"}" } } } ] } ] }, { "name": "platform-setup", "description": "Operations associated with the platform-setup guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-setup-operations", "description": "platform-setup-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Continue the pending administrator password setup", "disabled": true, "request": { "description": "Validates the browser-bound, HttpOnly setup continuation capability and\nredirects to the one-time account activation page. The endpoint is\navailable only while the durable setup gate remains open, the license\nallows the admin console, and exactly one setup-authorized administrator\nstill has no credential.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.continueSetupAdministratorActivation\"}" } } }, { "name": "Enable the platform tenant and operator login", "disabled": true, "request": { "description": "Creates or reconciles the platform tenant, seeds the platform-integrated\nauthorization server, creates the initial natural-person operator identity, and\nissues its one-time password activation. The first-run gate remains open until\nthat account action writes a usable credential. Production tenants are created\nafterwards through the authenticated platform admin API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.bootstrapPlatform\"}" } } }, { "name": "Import a protected license renewal bundle", "disabled": true, "request": { "description": "POST /license-management/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.importSetupLicenseManagementBundle\"}" } } }, { "name": "Preview a protected license renewal bundle import", "disabled": true, "request": { "description": "POST /license-management/import/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.previewSetupLicenseManagementBundleImport\"}" } } }, { "name": "Get persisted contacts and the latest generated license request", "disabled": true, "request": { "description": "GET /license-management/request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getManagedLicenseRequestState\"}" } } }, { "name": "Validate and persist license contacts without generating a request", "disabled": true, "request": { "description": "PUT /license-management/request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.saveManagedLicenseRequestState\"}" } } }, { "name": "Generate and persist a signed replacement license request", "disabled": true, "request": { "description": "POST /license-management/request/generate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.generateManagedLicenseRequest\"}" } } }, { "name": "Get configured license request defaults", "disabled": true, "request": { "description": "GET /license-request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupLicenseRequestStatus\"}" } } }, { "name": "Generate a signed local license request", "disabled": true, "request": { "description": "POST /license-request/generate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.generateSetupLicenseRequest\"}" } } }, { "name": "Import a protected setup license bundle", "disabled": true, "request": { "description": "POST /license/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.importSetupLicenseBundle\"}" } } }, { "name": "Preview a protected setup license bundle import", "disabled": true, "request": { "description": "POST /license/import/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.previewSetupLicenseBundleImport\"}" } } }, { "name": "Get persisted first-run onboarding state", "disabled": true, "request": { "description": "Returns the persisted deployment draft and generated license request artifact, if present, so the setup UI can resume after a browser restart.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupOnboardingState\"}" } } }, { "name": "Get first-run setup readiness", "disabled": true, "request": { "description": "GET /status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupStatus\"}" } } } ] } ] }, { "name": "secret-management", "description": "Operations associated with the secret-management guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "secret-management-operations", "description": "secret-management-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "listPlatformSecretOfferings", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretOfferings\"}" } } }, { "name": "listPlatformSecretOfferingProviderDefinitions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretOfferingProviderDefinitions\"}" } } }, { "name": "createPlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the offering-provider collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "getPlatformSecretOfferingProviderSetupOptions", "disabled": true, "request": { "description": "Role-correct setup catalog filtered server-side to provider types, authentication modes, configuration fields, capabilities, and isolation modes eligible for backend-isolated platform offerings.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderSetupOptions\"}" } } }, { "name": "retirePlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition; assigned, published, migration-retained, or otherwise referenced definitions cannot retire.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retirePlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "getPlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "rotatePlatformSecretOfferingProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag and rotates only the published revision resolved by the server.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotatePlatformSecretOfferingProviderCredentials\"}" } } }, { "name": "createPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent platform-offering provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "getPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "stagePlatformSecretOfferingProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed offering candidate revision aggregate ETag; explicit confirmed clear requests use the same fenced transition.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stagePlatformSecretOfferingProviderCredentials\"}" } } }, { "name": "preflightPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "publishPlatformSecretOffering", "disabled": true, "request": { "description": "If-Match fences the path-addressed READY provider revision ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.publishPlatformSecretOffering\"}" } } }, { "name": "markPlatformSecretOfferingProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag; READY requires the persisted, unexpired preflight for this exact revision.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markPlatformSecretOfferingProviderRevisionReady\"}" } } }, { "name": "testPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "getPlatformSecretOffering", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/{offeringId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOffering\"}" } } }, { "name": "updatePlatformSecretOffering", "disabled": true, "request": { "description": "If-Match fences the path-addressed offering ETag returned by this GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.updatePlatformSecretOffering\"}" } } }, { "name": "getPlatformSecretStorage", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretStorage\"}" } } }, { "name": "listPlatformSecretMigrations", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/migrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretMigrations\"}" } } }, { "name": "startPlatformSecretMigration", "disabled": true, "request": { "description": "If-Match fences the active platform-storage assignment returned by the storage GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.startPlatformSecretMigration\"}" } } }, { "name": "getPlatformSecretMigration", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/migrations/{migrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretMigration\"}" } } }, { "name": "listPlatformSecretProviderDefinitions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretProviderDefinitions\"}" } } }, { "name": "createPlatformSecretProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the platform provider collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretProviderDefinition\"}" } } }, { "name": "getPlatformSecretProviderSetupOptions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/options. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderSetupOptions\"}" } } }, { "name": "retirePlatformSecretProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retirePlatformSecretProviderDefinition\"}" } } }, { "name": "getPlatformSecretProviderDefinition", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderDefinition\"}" } } }, { "name": "rotatePlatformSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotatePlatformSecretProviderCredentials\"}" } } }, { "name": "createPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretProviderRevision\"}" } } }, { "name": "getPlatformSecretProviderRevision", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderRevision\"}" } } }, { "name": "stagePlatformSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stagePlatformSecretProviderCredentials\"}" } } }, { "name": "preflightPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightPlatformSecretProviderRevision\"}" } } }, { "name": "markPlatformSecretProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markPlatformSecretProviderRevisionReady\"}" } } }, { "name": "testPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testPlatformSecretProviderRevision\"}" } } }, { "name": "getGlobalTenantSecretPolicy", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getGlobalTenantSecretPolicy\"}" } } }, { "name": "updateGlobalTenantSecretPolicy", "disabled": true, "request": { "description": "If-Match fences the global policy ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.updateGlobalTenantSecretPolicy\"}" } } }, { "name": "listTenantSecretPolicyOverrides", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy/overrides. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretPolicyOverrides\"}" } } }, { "name": "deleteTenantSecretPolicyOverride", "disabled": true, "request": { "description": "If-Match fences the path-addressed override ETag; deleting restores global inheritance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.deleteTenantSecretPolicyOverride\"}" } } }, { "name": "getTenantSecretPolicyOverride", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy/overrides/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretPolicyOverride\"}" } } }, { "name": "putTenantSecretPolicyOverride", "disabled": true, "request": { "description": "If-Match fences the item ETag, or the override collection ETag when creating a missing override.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.putTenantSecretPolicyOverride\"}" } } }, { "name": "getTenantSecretAssignment", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/assignment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretAssignment\"}" } } }, { "name": "listTenantSecretMigrations", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/migrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretMigrations\"}" } } }, { "name": "startTenantSecretMigration", "disabled": true, "request": { "description": "If-Match fences the active tenant assignment returned by the assignment GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.startTenantSecretMigration\"}" } } }, { "name": "getTenantSecretMigration", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/migrations/{migrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretMigration\"}" } } }, { "name": "preflightTenantSecretOffering", "disabled": true, "request": { "description": "If-Match must be the selected option's `preflightEtag`; it fences the path-addressed target offering aggregate before issuing the short-lived migration preflight result.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightTenantSecretOffering\"}" } } }, { "name": "getTenantSecretOptions", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/options. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretOptions\"}" } } }, { "name": "listTenantSecretProviders", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretProviders\"}" } } }, { "name": "createTenantSecretProvider", "disabled": true, "request": { "description": "If-Match fences the tenant provider collection and effective-policy version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretProvider\"}" } } }, { "name": "retireTenantSecretProvider", "disabled": true, "request": { "description": "If-Match fences the path-addressed tenant provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retireTenantSecretProvider\"}" } } }, { "name": "getTenantSecretProvider", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretProvider\"}" } } }, { "name": "rotateTenantSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotateTenantSecretProviderCredentials\"}" } } }, { "name": "createTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent tenant provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretProviderRevision\"}" } } }, { "name": "getTenantSecretProviderRevision", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretProviderRevision\"}" } } }, { "name": "stageTenantSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stageTenantSecretProviderCredentials\"}" } } }, { "name": "preflightTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightTenantSecretProviderRevision\"}" } } }, { "name": "markTenantSecretProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markTenantSecretProviderRevisionReady\"}" } } }, { "name": "testTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testTenantSecretProviderRevision\"}" } } }, { "name": "listTenantSecretValues", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/values. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretValues\"}" } } }, { "name": "createTenantSecretValue", "disabled": true, "request": { "description": "If-Match fences the active assignment and secret-value collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretValue\"}" } } }, { "name": "getTenantSecretValue", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/values/{secretId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretValue\"}" } } }, { "name": "rotateTenantSecretValue", "disabled": true, "request": { "description": "If-Match fences the path-addressed secret handle ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotateTenantSecretValue\"}" } } } ] } ] }, { "name": "semantic-model-authoring", "description": "Operations associated with the semantic-model-authoring guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "semantic-model-authoring-operations", "description": "semantic-model-authoring-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List credential-branding records for the calling tenant", "disabled": true, "request": { "description": "GET /branding. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listCredentialBrandings\"}" } } }, { "name": "Create a draft credential-branding record", "disabled": true, "request": { "description": "POST /branding. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createCredentialBranding\"}" } } }, { "name": "Delete a credential-branding record by id", "disabled": true, "request": { "description": "DELETE /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteCredentialBranding\"}" } } }, { "name": "Get a credential-branding record by id", "disabled": true, "request": { "description": "GET /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getCredentialBranding\"}" } } }, { "name": "Update a draft credential-branding record's name, description, locales, or layout", "disabled": true, "request": { "description": "PATCH /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateCredentialBranding\"}" } } }, { "name": "Toggle credential-branding status (draft <-> published)", "disabled": true, "request": { "description": "PUT /branding/{brandingId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setCredentialBrandingStatus\"}" } } }, { "name": "Bump the credential-branding record's snapshot version", "disabled": true, "request": { "description": "POST /branding/{brandingId}/version. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotBrandingVersion\"}" } } }, { "name": "List channels for the calling tenant", "disabled": true, "request": { "description": "Returns a page of channels matching the optional filter, each as a channel\nenvelope ({channel, definition}). Pagination accepts both `limit`/`offset` and OpenAPI-style\n`page`/`size`; the parser normalises and clamps `limit` to `[1, 100]` (default `20`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listChannels\"}" } } }, { "name": "Create an API-payload definition for one data product", "disabled": true, "request": { "description": "POST /channels/api. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createApiPayloadChannel\"}" } } }, { "name": "Replace an API-payload definition's content", "disabled": true, "request": { "description": "PUT /channels/api/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateApiPayloadChannel\"}" } } }, { "name": "Create a verifiable-credential definition for one data product", "disabled": true, "request": { "description": "POST /channels/credentials. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createVerifiableCredentialChannel\"}" } } }, { "name": "Replace a verifiable-credential definition's content", "disabled": true, "request": { "description": "PUT /channels/credentials/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateVerifiableCredentialChannel\"}" } } }, { "name": "List FORM channels (optional nameContains/dataProductId filters)", "disabled": true, "request": { "description": "GET /channels/forms. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listFormChannels\"}" } } }, { "name": "Create a form definition binding one data product to a capture form", "disabled": true, "request": { "description": "POST /channels/forms. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createFormChannel\"}" } } }, { "name": "Get a FORM channel by id", "disabled": true, "request": { "description": "GET /channels/forms/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getFormChannel\"}" } } }, { "name": "Replace a form definition's content", "disabled": true, "request": { "description": "PUT /channels/forms/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateFormChannel\"}" } } }, { "name": "Set a FORM channel's publication state", "disabled": true, "request": { "description": "PUT /channels/forms/{channelId}/publication. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.publishFormChannel\"}" } } }, { "name": "Create an OID4VCI issuance definition for one data product", "disabled": true, "request": { "description": "POST /channels/oid4vci. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createOid4vciIssuanceChannel\"}" } } }, { "name": "Replace an OID4VCI issuance definition's content", "disabled": true, "request": { "description": "PUT /channels/oid4vci/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateOid4vciIssuanceChannel\"}" } } }, { "name": "Create a PDF/document definition for one data product", "disabled": true, "request": { "description": "POST /channels/pdf. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createPdfDocumentChannel\"}" } } }, { "name": "Replace a PDF/document definition's content", "disabled": true, "request": { "description": "PUT /channels/pdf/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updatePdfDocumentChannel\"}" } } }, { "name": "Delete a channel by id", "disabled": true, "request": { "description": "DELETE /channels/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteChannel\"}" } } }, { "name": "Get a channel by id (returned as a channel envelope)", "disabled": true, "request": { "description": "GET /channels/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getChannel\"}" } } }, { "name": "List data-domain identities and revision pointers", "disabled": true, "request": { "description": "GET /data-domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomains\"}" } } }, { "name": "Create the stable data-domain identity and initial draft revision", "disabled": true, "request": { "description": "POST /data-domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomain\"}" } } }, { "name": "Get a data-domain identity and revision pointers", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomain\"}" } } }, { "name": "List publications", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainPublications\"}" } } }, { "name": "Create a publication for an approved revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/publications. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainPublication\"}" } } }, { "name": "Get a publication", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainPublication\"}" } } }, { "name": "List publication notices", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}/notices. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainPublicationNotices\"}" } } }, { "name": "Create a publication notice", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/publications/{publicationId}/notices. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainPublicationNotice\"}" } } }, { "name": "Get a publication notice", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}/notices/{noticeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainPublicationNotice\"}" } } }, { "name": "List revisions", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainRevisions\"}" } } }, { "name": "Create a draft revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainRevision\"}" } } }, { "name": "Delete a draft revision", "disabled": true, "request": { "description": "DELETE /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteDataDomainDraftRevision\"}" } } }, { "name": "Get an exact pinned revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevision\"}" } } }, { "name": "Replace draft revision content", "disabled": true, "request": { "description": "PUT /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.replaceDataDomainDraftRevision\"}" } } }, { "name": "Get the exact published revision content", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/composed. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevisionComposed\"}" } } }, { "name": "Project exact revision governance as an ODRL Offer", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainGovernancePolicy\"}" } } }, { "name": "List reviews for an exact revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainReviews\"}" } } }, { "name": "Create a review for an exact draft revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions/{revision}/reviews. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainReview\"}" } } }, { "name": "Get a review", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainReview\"}" } } }, { "name": "List immutable decisions for a review", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainReviewDecisions\"}" } } }, { "name": "Record an immutable review decision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainReviewDecision\"}" } } }, { "name": "Get an immutable review decision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions/{decisionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainReviewDecision\"}" } } }, { "name": "List usages for an exact data-domain revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/usages. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainRevisionUsages\"}" } } }, { "name": "Validate the exact revision content", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/validation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevisionValidation\"}" } } }, { "name": "List data products for the calling tenant", "disabled": true, "request": { "description": "Returns a page of data products matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Sort is constrained to an allow-list (`name`, `createdAt`,\n`updatedAt`, `version`); the default is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataProducts\"}" } } }, { "name": "Create a draft data product narrowing one published object model", "disabled": true, "request": { "description": "POST /data-products. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataProduct\"}" } } }, { "name": "Delete an data product by id", "disabled": true, "request": { "description": "DELETE /data-products/{dataProductId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteDataProduct\"}" } } }, { "name": "Get an data product by id", "disabled": true, "request": { "description": "GET /data-products/{dataProductId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataProduct\"}" } } }, { "name": "Update a draft data product's name, description, selection or overrides", "disabled": true, "request": { "description": "Partial update of a DRAFT data product. Each field is optional; a null (or absent) field leaves the\ncorresponding value unchanged. The object model reference, lifecycle status and version are not\neditable here. Updating a PUBLISHED data product is a conflict.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateDataProduct\"}" } } }, { "name": "Resolve an data product into its effective contract", "disabled": true, "request": { "description": "Resolves the data product against the object model its `objectModelRef` pins, restricts to the selected paths,\nand applies the narrow-only member overrides, yielding the effective contract a downstream\ncredential definition consumes. This is a read and is not license-gated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.resolveDataProduct\"}" } } }, { "name": "Replace a draft data product's selection entries wholesale", "disabled": true, "request": { "description": "Replaces the data product's `selected` entries wholesale. Overrides are untouched; an override whose\n`(roleRef, path)` is no longer selected is rejected by validation. The data product must be in DRAFT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setDataProductSelection\"}" } } }, { "name": "Toggle data product status (draft <-> published)", "disabled": true, "request": { "description": "PUT /data-products/{dataProductId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setDataProductStatus\"}" } } }, { "name": "Bump the data product's snapshot version", "disabled": true, "request": { "description": "Bumps the data product's monotonic snapshot `version` by one. No request body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotDataProductVersion\"}" } } }, { "name": "List object models for the calling tenant", "disabled": true, "request": { "description": "Returns a page of object models matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Sort is constrained to an allow-list; the default is\n`createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listObjectModels\"}" } } }, { "name": "Create a draft object model", "disabled": true, "request": { "description": "POST /objects. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createObjectModel\"}" } } }, { "name": "Delete an object model by id", "disabled": true, "request": { "description": "DELETE /objects/{objectModelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteObjectModel\"}" } } }, { "name": "Get an object model by id", "disabled": true, "request": { "description": "GET /objects/{objectModelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getObjectModel\"}" } } }, { "name": "Update an object model's name or description", "disabled": true, "request": { "description": "Partial update of an object model's mutable metadata (name, description). Each field is optional; a\nnull (or absent) field leaves the corresponding value unchanged. Domain refs, roles,\nrelationships, overrides, version and status have their own endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateObjectModel\"}" } } }, { "name": "Set (replace) the domain refs of an object model", "disabled": true, "request": { "description": "Replaces the whole domain-ref set wholesale. The reconstructed object model enforces the\nat-most-one-ref-per-data-domain invariant and that roles and relationships still reference\nreferenced data domains.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelDomainRefs\"}" } } }, { "name": "Set (replace) the narrow-only overrides of an object model", "disabled": true, "request": { "description": "Replaces the narrow-only per-attribute override set wholesale. The reconstructed object model\nvalidates that each override references a declared role; the data-domain-aware widening check\nrejects any override that would widen rather than narrow the data-domain attribute.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelOverrides\"}" } } }, { "name": "Set (replace) the relationships of an object model", "disabled": true, "request": { "description": "Replaces the selected data-domain relationship set wholesale. The reconstructed object model validates\nthat each relationship references a data domain the object model refers to and resolves to a real data-domain\nrelationship whose ends are bound by the object model's roles.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelRelationships\"}" } } }, { "name": "Resolve an object model into its effective object-graph projection", "disabled": true, "request": { "description": "Resolves the object model across its referenced data-domain snapshots: each role composes its bound\nobject type (root plus applied specializations) with the object model's narrow-only overrides applied,\nand each selected relationship is projected over the bound roles, yielding the effective\nobject-graph projection. This is a read and is not license-gated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.resolveObjectModel\"}" } } }, { "name": "Set (replace) the roles of an object model", "disabled": true, "request": { "description": "Replaces the declared role set wholesale. The reconstructed object model validates role-id\nuniqueness and that overrides still reference declared roles and roles reference referenced\ndata domains.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelRoles\"}" } } }, { "name": "Generate (and optionally register) an object model's use-case JSON Schema", "disabled": true, "request": { "description": "Resolves the object model and projects its resolved nested attributes into a CONFORMANCE-BEARING\nJSON Schema: an attribute whose effective mandatory flag is set contributes to the enclosing\nobject's `required` array, data-domain object boundaries nest, entry-code narrowing maps to `enum`,\nand a repeating attribute maps to an `array`. Only `JSON_SCHEMA` is supported now; any other\n`targetType` (including `JSON_LD_CONTEXT`) is reserved for a later phase and rejected with a\n400. When `register` is true the schema is also registered with the schema registry under the\n`object-models` namespace and the resulting registry id is returned; registration is the\nonly license-gated path (pure generation is a read).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.generateObjectModelSchema\"}" } } }, { "name": "Toggle object model status (draft <-> published)", "disabled": true, "request": { "description": "PUT /objects/{objectModelId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelStatus\"}" } } }, { "name": "Bump the object model's snapshot version", "disabled": true, "request": { "description": "Bumps the object model's monotonic snapshot `version` by one. No request body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotObjectModelVersion\"}" } } } ] } ] }, { "name": "statuslist-hosting", "description": "Operations associated with the statuslist-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "statuslist-hosting-operations", "description": "statuslist-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the signed status-list token by correlation id", "request": { "description": "Returns the raw signed status-list token for the list with business correlation id\n`{correlationId}`. This is the stable, externally referenced address that issued credentials\nembed, since the correlation id is operator-chosen and does not change across upgrades. The\nbody is the bare signed token with the token's own `Content-Type` and a\n`Cache-Control: public, max-age=`\nheader (falling back to `public, max-age=300`). Returns `404` when no list has this correlation\nid.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{correlationId}" } } ] } ] }, { "name": "statuslist-management", "description": "Operations associated with the statuslist-management guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "statuslist-management-operations", "description": "statuslist-management-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List credential status lists", "disabled": true, "request": { "description": "Returns status-list summaries matching the optional filters. Pagination\nuses `limit` and `offset`; `limit` is clamped to `[1, 100]` and defaults\nto `20`. The default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.listStatusLists\"}" } } }, { "name": "Create a credential status list", "disabled": true, "request": { "description": "Creates a status-list definition and signs the initial empty token.\n`correlationId` is the stable business key used by issuance bindings\nand hosted URLs. The response includes the signed token; list endpoints\nreturn summaries without the token.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.createStatusList\"}" } } }, { "name": "Delete a credential status list", "disabled": true, "request": { "description": "Soft-deletes the status list owned by the calling tenant and releases its hosted URL.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.deleteStatusList\"}" } } }, { "name": "Get a credential status list by id", "disabled": true, "request": { "description": "Fetches the full status-list record, including the signed token that\ncan be served by the hosting API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.getStatusList\"}" } } }, { "name": "Get a single status-list entry by index", "disabled": true, "request": { "description": "Looks up one allocated entry by its status-list index. The optional `entryCorrelationId` and\n`credentialId` query parameters narrow the lookup when the same index could be disambiguated\nby business key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.getStatusListEntry\"}" } } }, { "name": "Update a credential's status (revoke / suspend / reactivate)", "disabled": true, "request": { "description": "Sets the status value of a single entry within the status list identified by `{id}`. Select\nthe entry by exactly one of `statusListIndex`, `entryCorrelationId`, or `credentialId`, and\nset `value` to the new status (e.g. `1` = INVALID to revoke, `2` = SUSPENDED to suspend,\n`0` = VALID to reactivate).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.updateCredentialStatus\"}" } } } ] } ] }, { "name": "theme", "description": "Operations associated with the theme guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "theme-operations", "description": "theme-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Purge the theme cache", "disabled": true, "request": { "description": "Purges the theme resolution cache, for one tenant or globally. Platform admin operation.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.purgeThemeCache\"}" } } }, { "name": "Generate a palette", "disabled": true, "request": { "description": "Generates a Material Design 3 tonal palette from a seed color.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.generatePalette\"}" } } }, { "name": "Resolve the theme for a registered public host", "request": { "description": "Resolves the tenant exclusively from the request Host and an active issuer or\nverifier public-endpoint binding. Unknown, disabled, ambiguous, or cross-tenant\nhosts return 404. No tenant identifier is accepted in this route.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/resolved" } }, { "name": "Resolve theme CSS for a registered public host", "request": { "description": "Host-resolved CSS companion to `GET /resolved`.", "method": "GET", "header": [], "url": "{{baseUrl}}/resolved/css" } }, { "name": "List applications", "disabled": true, "request": { "description": "Returns every brandable application the tenant runs, as a plain array: platform-managed instances merged from the platform instance registries plus applications registered through this API.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listApplications\"}" } } }, { "name": "Register an application", "disabled": true, "request": { "description": "Registers an external application (a self-hosted portal, a mobile app) as a brandable instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.registerApplication\"}" } } }, { "name": "Delete an application", "disabled": true, "request": { "description": "Deletes a registered application. Platform-managed instances are read-only here and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplication\"}" } } }, { "name": "Get an application", "disabled": true, "request": { "description": "GET /{tenant}/applications/{applicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getApplication\"}" } } }, { "name": "Update an application", "disabled": true, "request": { "description": "Updates a registered application. Platform-managed instances are read-only here and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateApplication\"}" } } }, { "name": "Delete an application brand", "disabled": true, "request": { "description": "Removes the application's brand override so it cascades from the tenant brand again.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplicationBrand\"}" } } }, { "name": "Get an application brand", "disabled": true, "request": { "description": "GET /{tenant}/applications/{applicationId}/brand. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getApplicationBrand\"}" } } }, { "name": "Set an application brand", "disabled": true, "request": { "description": "Applies a sparse brand override for one registered application. Set properties override the tenant brand for this application; omitted properties keep cascading from the tenant default.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setApplicationBrand\"}" } } }, { "name": "Resolve a feature for an application", "request": { "description": "Resolves the design elements of one feature for a registered application: what a\nrunning application fetches for itself. Per element, the first match wins:\napplication binding (variant, then common), tenant binding (variant, then common),\nproduct default, element default, then the element's fallback token key; a required\nelement that resolves to nothing is listed in `missingRequired`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/applications/{applicationId}/features/{featureId}/resolved" } }, { "name": "Delete an application stylesheet", "disabled": true, "request": { "description": "DELETE /{tenant}/applications/{applicationId}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplicationStylesheet\"}" } } }, { "name": "Get an application stylesheet", "request": { "description": "Serves the custom CSS stylesheet of one registered application. Returns 404 for an unknown tenant or application, or when no stylesheet is set.", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/applications/{applicationId}/stylesheet" } }, { "name": "Set an application stylesheet", "disabled": true, "request": { "description": "PUT /{tenant}/applications/{applicationId}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setApplicationStylesheet\"}" } } }, { "name": "Get the tenant brand", "disabled": true, "request": { "description": "GET /{tenant}/brand. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getBrand\"}" } } }, { "name": "Set the tenant brand", "disabled": true, "request": { "description": "Applies the tenant brand and regenerates the palette tokens in the canonical tenant definitions, preserving power overrides. Simple and advanced modes compose because they target the same definitions.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setBrand\"}" } } }, { "name": "Resolve branding context", "disabled": true, "request": { "description": "Resolves the tenant's branding as a flat, template-friendly key/value context, for cross-domain use such as email templates.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.resolveBrandingContext\"}" } } }, { "name": "List theme definitions", "disabled": true, "request": { "description": "Returns the tenant's theme definitions matching the optional filters, as a plain array.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listThemeDefinitions\"}" } } }, { "name": "Create a theme definition", "disabled": true, "request": { "description": "POST /{tenant}/definitions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.createThemeDefinition\"}" } } }, { "name": "Validate a theme definition", "disabled": true, "request": { "description": "Validates a theme definition without saving it, including the scope key rules (PRODUCT requires `productType`, APPLICATION requires `applicationId`, other scopes carry neither).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.validateThemeDefinition\"}" } } }, { "name": "Delete a theme definition", "disabled": true, "request": { "description": "DELETE /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteThemeDefinition\"}" } } }, { "name": "Get a theme definition", "disabled": true, "request": { "description": "GET /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getThemeDefinition\"}" } } }, { "name": "Update a theme definition", "disabled": true, "request": { "description": "PUT /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateThemeDefinition\"}" } } }, { "name": "Get theme definition history", "disabled": true, "request": { "description": "Returns the version history of a theme definition as a plain array, newest first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getThemeDefinitionHistory\"}" } } }, { "name": "Restore a deleted theme definition", "disabled": true, "request": { "description": "Restores a soft-deleted theme definition.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.restoreThemeDefinition\"}" } } }, { "name": "Undo a theme definition update", "disabled": true, "request": { "description": "Undoes the last update to a theme definition, or reverts to the version given in the body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.undoThemeDefinition\"}" } } }, { "name": "List features", "disabled": true, "request": { "description": "Returns the brandable features of a product type as a plain array, built-in and custom.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listFeatures\"}" } } }, { "name": "Create a custom feature", "disabled": true, "request": { "description": "Registers a custom feature, as published by user-built workflows, forms, and portal pages.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.createFeature\"}" } } }, { "name": "Delete a custom feature", "disabled": true, "request": { "description": "Deletes a custom feature. Built-in features are read-only and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteFeature\"}" } } }, { "name": "Get a feature", "disabled": true, "request": { "description": "GET /{tenant}/products/{productType}/features/{featureId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getFeature\"}" } } }, { "name": "Update a custom feature", "disabled": true, "request": { "description": "Updates a custom feature. Built-in features are read-only and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateFeature\"}" } } }, { "name": "List element bindings", "disabled": true, "request": { "description": "Returns the stored design element bindings of a feature as a plain array. Without filters, all bindings are returned; `applicationId` and `variant` narrow to one slot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listElementBindings\"}" } } }, { "name": "Delete an element binding", "disabled": true, "request": { "description": "Removes the binding at the exact slot selected by the `applicationId` and `variant` query parameters, so resolution falls through to the next layer.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteElementBinding\"}" } } }, { "name": "Set an element binding", "disabled": true, "request": { "description": "Binds a value to a design element at tenant scope (`applicationId` absent: the default for every application of the product) or application scope, optionally per variant. The `applicationId` and `variant` query parameters select the exact binding slot. Exactly one of `asset` or `text` is set, matching the element kind.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setElementBinding\"}" } } }, { "name": "Resolve a feature at product level", "request": { "description": "Resolves the design elements of one feature at tenant level for a product type,\nwithout an application override layer: the defaults every application of this\nproduct inherits.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/products/{productType}/features/{featureId}/resolved" } }, { "name": "Resolve theme", "request": { "description": "Resolves the effective theme for a tenant, optionally scoped to a registered\napplication and variant. Later scopes win: SYSTEM < PRODUCT < TENANT < APPLICATION\n< PRINCIPAL; the PRODUCT and APPLICATION layers apply only when `applicationId` is\nsupplied. Returns 404 for an unknown tenant; a known tenant with no definitions\nresolves to system defaults with `fallback=true` and `X-Theme-Fallback: true`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/resolved" } }, { "name": "Resolve theme CSS", "request": { "description": "Resolves the effective theme and returns it as CSS custom properties. Same\nparameters and tenant semantics as `GET /{tenant}/resolved`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/resolved/css" } }, { "name": "Seed default themes", "disabled": true, "request": { "description": "Seeds the default theme definitions for a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.seedTheme\"}" } } }, { "name": "Delete the tenant stylesheet", "disabled": true, "request": { "description": "DELETE /{tenant}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteTenantStylesheet\"}" } } }, { "name": "Get the tenant stylesheet", "request": { "description": "Serves the tenant's custom CSS stylesheet. Returns 404 for an unknown tenant or when no stylesheet is set.", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/stylesheet" } }, { "name": "Set the tenant stylesheet", "disabled": true, "request": { "description": "PUT /{tenant}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setTenantStylesheet\"}" } } }, { "name": "Get the editable token set", "disabled": true, "request": { "description": "Returns the editable token set with effective values for the addressed `(scope, variant, applicationId)` combination: tenant scope by default, application scope when `applicationId` is given.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getTokens\"}" } } }, { "name": "Patch tokens", "disabled": true, "request": { "description": "Upserts and removes tokens in the canonical definition for the addressed `(scope, variant, applicationId)` combination. Composes with the brand endpoints, which write the same canonical definitions.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.patchTokens\"}" } } } ] } ] }, { "name": "trust-domain", "description": "Operations associated with the trust-domain guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "trust-domain-operations", "description": "trust-domain-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List Trust Attachments", "disabled": true, "request": { "description": "GET /attachments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAttachments\"}" } } }, { "name": "Delete Trust Attachment", "disabled": true, "request": { "description": "DELETE /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAttachment\"}" } } }, { "name": "Get Trust Attachment", "disabled": true, "request": { "description": "GET /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustAttachment\"}" } } }, { "name": "Put Trust Attachment", "disabled": true, "request": { "description": "PUT /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAttachment\"}" } } }, { "name": "List Trust Domains", "disabled": true, "request": { "description": "GET /domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustDomains\"}" } } }, { "name": "Create Trust Domain", "disabled": true, "request": { "description": "POST /domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustDomain\"}" } } }, { "name": "Delete Trust Domain", "disabled": true, "request": { "description": "DELETE /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustDomain\"}" } } }, { "name": "Get Trust Domain", "disabled": true, "request": { "description": "GET /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustDomain\"}" } } }, { "name": "Put Trust Domain", "disabled": true, "request": { "description": "PUT /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustDomain\"}" } } }, { "name": "List Trust Anchors", "disabled": true, "request": { "description": "GET /domains/{domainId}/anchors. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAnchors\"}" } } }, { "name": "Create Trust Anchor", "disabled": true, "request": { "description": "POST /domains/{domainId}/anchors. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustAnchor\"}" } } }, { "name": "Delete Trust Anchor", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAnchor\"}" } } }, { "name": "Put Trust Anchor", "disabled": true, "request": { "description": "PUT /domains/{domainId}/anchors/{anchorId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAnchor\"}" } } }, { "name": "List Trust Anchor Admissions", "disabled": true, "request": { "description": "GET /domains/{domainId}/anchors/{anchorId}/admissions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAnchorAdmissions\"}" } } }, { "name": "Delete Trust Anchor Admission", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}/admissions/{admissionClass}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAnchorAdmission\"}" } } }, { "name": "Put Trust Anchor Admission", "disabled": true, "request": { "description": "PUT /domains/{domainId}/anchors/{anchorId}/admissions/{admissionClass}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAnchorAdmission\"}" } } }, { "name": "Remove Mdoc Vical Configuration", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}/mdoc-vical. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.removeMdocVicalConfiguration\"}" } } }, { "name": "Describe Mdoc Vical Configuration", "disabled": true, "request": { "description": "Returns the ISO 18013-5 Annex C VICAL configured on this anchor. An anchor with no VICAL yet returns an unconfigured configuration rather than 404, so a client can render the empty form without a special case.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.describeMdocVicalConfiguration\"}" } } }, { "name": "Configure Mdoc Vical Configuration", "disabled": true, "request": { "description": "Sets the VICAL source for this anchor. Every referenced anchor must already exist in the same trust domain, be ACTIVE, and hold the admission class for its job: MDOC_VICAL_SIGNER for the anchors that verify the artifact signature, CREDENTIAL_ISSUER for the issuing authorities the artifact admits. At least one signer anchor is required, because an unverified VICAL would admit every authority it happens to contain.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.configureMdocVicalConfiguration\"}" } } }, { "name": "List Trust Catalogs", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustCatalogs\"}" } } }, { "name": "Create Trust Catalog", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustCatalog\"}" } } }, { "name": "Delete Trust Catalog", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustCatalog\"}" } } }, { "name": "Get Trust Catalog", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustCatalog\"}" } } }, { "name": "Update Trust Catalog", "disabled": true, "request": { "description": "PUT /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.updateTrustCatalog\"}" } } }, { "name": "Validate Trust Catalog Candidate", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs/{catalogId}/candidates/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateTrustCatalogCandidate\"}" } } }, { "name": "List Trust Catalog Snapshots", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}/snapshots. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustCatalogSnapshots\"}" } } }, { "name": "Get Trust Catalog Snapshot", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}/snapshots/{snapshotId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustCatalogSnapshot\"}" } } }, { "name": "Activate Trust Catalog Snapshot", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs/{catalogId}/snapshots/{snapshotId}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateTrustCatalogSnapshot\"}" } } }, { "name": "List Trust Domain Consumers", "disabled": true, "request": { "description": "GET /domains/{domainId}/consumers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustDomainConsumers\"}" } } }, { "name": "List LoTE Remote Sources", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listLoTERemoteSources\"}" } } }, { "name": "Delete LoTE Remote Source", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteLoTERemoteSource\"}" } } }, { "name": "Get LoTE Remote Source", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getLoTERemoteSource\"}" } } }, { "name": "Put LoTE Remote Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putLoTERemoteSource\"}" } } }, { "name": "Get LoTE Remote Source Diagnostics", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}/diagnostics. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getLoTERemoteSourceDiagnostics\"}" } } }, { "name": "Refresh LoTE Remote Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/refresh. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.refreshLoTERemoteSource\"}" } } }, { "name": "List LoTE Remote Source Revisions", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listLoTERemoteSourceRevisions\"}" } } }, { "name": "Activate LoTE Remote Source Revision", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/revisions/{revision}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateLoTERemoteSourceRevision\"}" } } }, { "name": "Validate LoTE Remote Source Revision", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/revisions/{revision}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateLoTERemoteSourceRevision\"}" } } }, { "name": "List Trust Sources", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSources\"}" } } }, { "name": "Ensure Eu Trust Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/trust-sources/eu. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.ensureEuTrustSource\"}" } } }, { "name": "Delete Trust Source", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustSource\"}" } } }, { "name": "Get Trust Source", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustSource\"}" } } }, { "name": "Upsert Custom Trust Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.upsertCustomTrustSource\"}" } } }, { "name": "List Trust Source Derived Entries", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/derived-entries. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceDerivedEntries\"}" } } }, { "name": "Get Trust Source Diagnostics", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/diagnostics. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustSourceDiagnostics\"}" } } }, { "name": "Refresh Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/refresh. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.refreshTrustSource\"}" } } }, { "name": "List Trust Source Refresh Attempts", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/refresh-attempts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceRefreshAttempts\"}" } } }, { "name": "List Trust Source Revisions", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceRevisions\"}" } } }, { "name": "Activate Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/revisions/{revision}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateTrustSource\"}" } } }, { "name": "Validate Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/revisions/{revision}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateTrustSource\"}" } } }, { "name": "Get Active Trust Source Snapshot", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/snapshot. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getActiveTrustSourceSnapshot\"}" } } }, { "name": "Delete Trust Eligibility Grant", "disabled": true, "request": { "description": "DELETE /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustEligibilityGrant\"}" } } }, { "name": "List Trust Eligibility Grants", "disabled": true, "request": { "description": "GET /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustEligibilityGrants\"}" } } }, { "name": "Put Trust Eligibility Grant", "disabled": true, "request": { "description": "PUT /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustEligibilityGrant\"}" } } }, { "name": "Evaluate Catalog Authorization", "disabled": true, "request": { "description": "POST /internal/evaluate/catalog-authorization. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateCatalogAuthorization\"}" } } }, { "name": "Evaluate Credential Issuer Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/credential-issuer. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateCredentialIssuerTrust\"}" } } }, { "name": "Evaluate Verifier Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/verifier. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateVerifierTrust\"}" } } }, { "name": "Evaluate Wallet Provider Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/wallet-provider. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateWalletProviderTrust\"}" } } }, { "name": "Resolve Trust Attachment", "disabled": true, "request": { "description": "POST /internal/resolve/attachment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTrustAttachment\"}" } } }, { "name": "Resolve Trust Authentication Material", "disabled": true, "request": { "description": "POST /internal/resolve/authentication-material. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTrustAuthenticationMaterial\"}" } } }, { "name": "Resolve Tls Server Trust Material", "disabled": true, "request": { "description": "POST /internal/resolve/tls-server-material. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTlsServerTrustMaterial\"}" } } } ] } ] }, { "name": "vault", "description": "Operations associated with the vault guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "vault-operations", "description": "vault-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a vault", "disabled": true, "request": { "description": "POST /vaults. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVault\"}" } } }, { "name": "Delete a vault conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVault\"}" } } }, { "name": "Get a vault descriptor", "disabled": true, "request": { "description": "GET /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVault\"}" } } }, { "name": "Stream a recipient-scoped TDF export", "disabled": true, "request": { "description": "Object export is TDF. Folder/vault export is deterministic BagIt 1.0 carried in TDF. Normal export excludes private keys, PINs, live tokens, cookies, KMS recovery data, secret zones, and unrelated grant topology.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.exportVaultContent\"}" } } }, { "name": "Stream plaintext by mutable path", "disabled": true, "request": { "description": "Never returns protected bytes as plaintext.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileByPath\"}" } } }, { "name": "Stream a plaintext file through an approved protection provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS. That profile must use `/protected-files` so the service never receives plaintext and never bypasses client-controlled protection.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultPlaintextFile\"}" } } }, { "name": "Create an explicit folder", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultFolder\"}" } } }, { "name": "List grants", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultGrants\"}" } } }, { "name": "Create or replace a grant conditionally", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultGrant\"}" } } }, { "name": "Revoke a grant conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/grants/{grantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.revokeVaultGrant\"}" } } }, { "name": "Stream and verify a recipient-scoped TDF export", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/imports. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.importVaultContent\"}" } } }, { "name": "List path entries", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjects\"}" } } }, { "name": "Delete a file or folder conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVaultObject\"}" } } }, { "name": "Get object, path binding, and current version metadata", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVaultObject\"}" } } }, { "name": "Replace object metadata", "disabled": true, "request": { "description": "PATCH /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultObjectMetadata\"}" } } }, { "name": "Stream plaintext by stable object identity", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileById\"}" } } }, { "name": "Stream protected content and its ZERO_ACCESS descriptor", "disabled": true, "request": { "description": "Returns protected bytes, record, plaintext digest/size, package reference, protection parameters, and canonical AAD. This is distinct from plaintext read and never unwraps.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultProtectedFile\"}" } } }, { "name": "Store a client-protected immutable version", "disabled": true, "request": { "description": "The body objectId must match the path objectId and the new client-selected versionId must be unused. The canonical AAD is validated before the authoritative manifest commit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultProtectedVersion\"}" } } }, { "name": "List immutable versions", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/versions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjectVersions\"}" } } }, { "name": "Stream a new plaintext version through an approved provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS; use `/protected-versions` for that profile.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultPlaintextVersion\"}" } } }, { "name": "Copy into a new object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.copyVaultObject\"}" } } }, { "name": "Move or rename without changing object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.moveVaultObject\"}" } } }, { "name": "Replace the vault policy reference", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultPolicy\"}" } } }, { "name": "Store a client-protected ZERO_ACCESS file", "disabled": true, "request": { "description": "Requires client-selected objectId and versionId before upload. The server validates the canonical AAD binding and atomically rejects identifier collision or reuse.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultProtectedFile\"}" } } }, { "name": "Search bounded metadata projections", "disabled": true, "request": { "description": "Implementations must not scan and decrypt object bodies.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.searchVaultMetadata\"}" } } } ] } ] }, { "name": "wallet-credential", "description": "Operations associated with the wallet-credential guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-credential-operations", "description": "wallet-credential-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List wallet credentials", "disabled": true, "request": { "description": "Lists the credential metadata sidecars of one wallet unit. The query\nparameters mirror the credential metadata filter exactly: type\nreferences, formats, issuer reference, subject reference, credential\nconfiguration id, lifecycle states, and deleted-record inclusion.\n\nThe two set-valued enum filters, formats and lifecycleStates, are sent\nas a single comma-separated value each rather than as repeated query\nparameters, because the server reads one value per parameter name.\n\nThere are no paging parameters; the full filtered set is returned in\none response. Paging arrives later as a compatible extension of this\noperation. Raw credential bodies are never part of the result.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.listWalletCredentials\"}" } } }, { "name": "Delete a wallet credential", "disabled": true, "request": { "description": "Deletes one stored credential after verifying the supplied activation\ngrant. The referenced activation decision is single-use and\noperation-bound to operationType wallet.credentials.delete with the\nexact operation hash, nonce, and audience in the request body. The\nserver consumes the decision before performing the deletion, so a\nsecond attempt with the same decision fails even if the first attempt\ndid not complete. A missing, expired, already consumed, or wrong-hash\ndecision is rejected with 403 and nothing is deleted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.deleteWalletCredential\"}" } } }, { "name": "Get a wallet credential", "disabled": true, "request": { "description": "Returns the display projection for one stored credential: the metadata\nsidecar, the issuer party derived inside the authoritative profile\nboundary, tags, the canonical sanitized claim tree with localized\nlabels, and referenced external resources.\n\nThe raw credential body is never exposed by this API. The claim tree\nis a sanitized projection; hidden values are absent rather than\nmasked, and external resources are returned as link references that\nclients decide whether to open.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.getWalletCredential\"}" } } }, { "name": "Refresh wallet credential status", "disabled": true, "request": { "description": "Re-resolves the revocation and validity status of one stored\ncredential against its configured status mechanism and persists the\noutcome. The response carries the updated credential metadata sidecar\nplus the latest status snapshot when one is available.\n\nThis operation is unattended-safe: it requires no activation grant,\ndiscloses nothing beyond the metadata sidecar, and can run from\nbackground jobs and sync loops.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.refreshWalletCredentialStatus\"}" } } } ] } ] }, { "name": "wallet-entitlement", "description": "Operations associated with the wallet-entitlement guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-entitlement-operations", "description": "wallet-entitlement-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List wallet entitlements", "disabled": true, "request": { "description": "GET /entitlements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletEntitlements\"}" } } }, { "name": "Create or update wallet entitlement", "disabled": true, "request": { "description": "PUT /entitlements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletEntitlement\"}" } } }, { "name": "Delete wallet entitlement", "disabled": true, "request": { "description": "DELETE /entitlements/{entitlementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.deleteWalletEntitlement\"}" } } }, { "name": "Get wallet entitlement", "disabled": true, "request": { "description": "GET /entitlements/{entitlementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.getWalletEntitlement\"}" } } }, { "name": "Resolve wallet feature manifest", "disabled": true, "request": { "description": "GET /manifest. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.resolveWalletFeatureManifest\"}" } } }, { "name": "List wallet feature policy assignments", "disabled": true, "request": { "description": "GET /policy-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletFeaturePolicyAssignments\"}" } } }, { "name": "Create or update a scoped wallet feature policy assignment", "disabled": true, "request": { "description": "PUT /policy-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletFeaturePolicyAssignment\"}" } } }, { "name": "Revoke a wallet feature policy assignment", "disabled": true, "request": { "description": "DELETE /policy-assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.revokeWalletFeaturePolicyAssignment\"}" } } }, { "name": "Preview effective wallet feature policy", "disabled": true, "request": { "description": "Membership, organization units, groups, license ceilings, and tenant ceilings are resolved server-side and cannot be asserted by the caller.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.previewWalletFeaturePolicy\"}" } } }, { "name": "List wallet feature policy profiles", "disabled": true, "request": { "description": "GET /policy-profiles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletFeaturePolicyProfiles\"}" } } }, { "name": "Create or update a wallet feature policy profile", "disabled": true, "request": { "description": "PUT /policy-profiles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletFeaturePolicyProfile\"}" } } }, { "name": "Evaluate managed wallet offering readiness", "disabled": true, "request": { "description": "Returns only safe configuration, dependency, and signed-release-evidence gate results for the authenticated tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.evaluateManagedWalletOfferingReadiness\"}" } } } ] } ] }, { "name": "wallet-interaction", "description": "Operations associated with the wallet-interaction guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-interaction-operations", "description": "wallet-interaction-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Bind a screen to a live session", "disabled": true, "request": { "description": "Binds the authenticated screen (bearer screen credential issued by its owning\nauthorization server for the hand-off audience) to the named live session with the\nrole carried by the token and returns the role projection. Binding records presence so\nother screens see the join.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.bindHandoffScreen\"}" } } }, { "name": "Send a screen presence heartbeat", "disabled": true, "request": { "description": "Refreshes last-seen for the authenticated screen within the named session. Screens whose\nheartbeats stop stay visible in operator projections marked stale rather than silently\ndisappearing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.heartbeatHandoffScreen\"}" } } }, { "name": "Start a credential hand-off session", "disabled": true, "request": { "description": "Starts a hand-off session wrapping one offer or request run for a business wallet unit\nand returns the snapshot for the starting caller's role. Protocol execution stays owned\nby the backend; this surface captures, initiates and drives interaction only. The single\ndurable expiry timer is scheduled from the resolved session lifetime.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startHandoffSession\"}" } } }, { "name": "Get the role-scoped hand-off session snapshot", "disabled": true, "request": { "description": "Returns the current point-in-time snapshot from the session store read model, projected\nfor the caller's role. Enforcement is by omission server side: a display projection\ncarries no link text, no email action channel, and no result claim data, and the raw\nexchange URI appears in no projection at any role.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionSnapshot\"}" } } }, { "name": "Replay hand-off session events", "disabled": true, "request": { "description": "Returns recorded hand-off session events in the server-sent-events wire format. Each\nevent uses the event name handoff-session-event, the id field carries the per-session\nsequence used as the replay cursor, and the data field carries the HandoffSessionEvent\nJSON document. When the Last-Event-ID request header is present, only events with a\nsequence greater than that value are replayed. Events are served from the session store\nread model only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionEvents\"}" } } }, { "name": "Consume the guarded hand-off exchange URI", "disabled": true, "request": { "description": "Returns the guarded exchange URI held server side for this session to an eligible\nauthenticated screen or operator. This is the ONLY path on which the URI leaves the\nserver: it exists so it can be fed straight into the QR encoder or clipboard path.\nIt never appears in any projection, any stream event, or any log line. Display-role\nscreens use it to feed their encoder without ever receiving link text.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeHandoffExchangeUri\"}" } } }, { "name": "Regenerate the hand-off session", "disabled": true, "request": { "description": "Start over as a distinct action from retry and resume. Cancels the current run,\ninvalidates its correlation id upstream, and starts a successor workflow. The returned\nsnapshot belongs to the successor session; bound screens learn the successor through the\nterminal_reached event and the successorSessionId field. Regeneration after expiry is\nthe expected recovery path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.regenerateHandoffSession\"}" } } }, { "name": "List wallet interaction activity", "disabled": true, "request": { "description": "Lists the interaction activity log projection for a wallet unit in\nascending sequence order. Use afterSequence with the nextSequence\nvalue of the previous page to fetch the next page.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.listWalletInteractionActivity\"}" } } }, { "name": "Start a wallet interaction", "disabled": true, "request": { "description": "Starts a wallet interaction session from a captured entry point and\nreturns the session with its initial state. The walletUnitId inside\nthe request input must equal the walletUnitId path parameter; a\nmismatch is rejected. The execution owner recorded at start is locked\nbefore semantic interpretation and stays immutable for the lifetime\nof the interaction.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startWalletInteraction\"}" } } }, { "name": "Cancel a wallet interaction", "disabled": true, "request": { "description": "Cancels the interaction session and returns the terminal state. All\noutstanding sensitive inputs registered for the session are removed\nwhen the interaction terminates.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.cancelWalletInteraction\"}" } } }, { "name": "Dispatch a wallet interaction action", "disabled": true, "request": { "description": "Dispatches one user or client action into the interaction state\nmachine and returns the resulting state. Sensitive values such as\ntransaction codes and security grants are passed by sensitive-input\nreference, never inline.\n\nOPTIMISTIC CONCURRENCY. A client that sends expectedRevision in the\nrequest body makes the dispatch a conditional write: the server reads\nthe session state first and answers 409 with a\nWalletInteractionRevisionConflict, applying nothing, unless the session\nis still at exactly that revision. This is what keeps an approval the\nuser gave against a screen that has since moved on -- a consent decided\non a stale render, or a retry of an action that already applied -- from\nbeing applied against a state nobody looked at. The conflict body\ncarries the current state so the client can re-render immediately.\nOmitting expectedRevision applies the action unconditionally.\n\nThere are no concurrency-control HTTP headers on this operation. The\nprecondition travels in the body, the way the frame transport already\ncarries lastRevision, so no gateway can strip it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.dispatchWalletInteractionAction\"}" } } }, { "name": "Consume the issuer authorization handoff", "disabled": true, "request": { "description": "Returns the issuer authorization URL held behind authorizationHandoffRef, then spends the\nreference. Public interaction state never carries the URL: this is the one-shot path a\nbrowser host uses to open the issuer sign-in page. A second call with the same reference\nis not found. After the holder returns, register the callback through the sensitive-input\nendpoint and dispatch auth_callback.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeWalletInteractionAuthorizationHandoff\"}" } } }, { "name": "Replay wallet interaction state events", "disabled": true, "request": { "description": "Returns recorded interaction state events in the server-sent-events\nwire format. Each event uses the event name wallet-interaction-state,\nthe id field carries the state revision, and the data field carries\nthe WalletInteractionStateEvent JSON document. When the Last-Event-ID\nrequest header is present, only events with a revision greater than\nthat value are replayed.\n\nThe current implementation returns a bounded replay of the events\nrecorded so far and then closes the response; it does not hold the\nconnection open for live updates. Live streaming is a later server\nenhancement behind this same contract, and remains available today\nthrough the neutral server-streaming command transport.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionEvents\"}" } } }, { "name": "Handle a wallet interaction frame", "disabled": true, "request": { "description": "Multiplexed request/response frame transport over one endpoint. A\nRESUME, DISPATCH_ACTION, or CANCEL client frame is executed against\nthe session and answered with a STATE server frame carrying the\nresulting state and revision; a PING frame is answered with PONG. The\nsessionId inside the frame must equal the sessionId path parameter; a\nmismatch is rejected.\n\nA DISPATCH_ACTION frame that carries lastRevision is a conditional\nwrite on exactly the terms the actions endpoint uses for\nexpectedRevision: it is answered with 409 and an ERROR server frame\ncarrying the current state, applying nothing, unless the session is\nstill at that revision. lastRevision is ignored on RESUME, CANCEL, and\nPING. A RESUME frame of a Failed session with disposition RESUMABLE\nstarts a new phase and advances revision; GET /state is the re-attach\npath that does not. This operation declares no header parameters; the\nprecondition travels in the frame body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.handleWalletInteractionFrame\"}" } } }, { "name": "Resume a wallet interaction", "disabled": true, "request": { "description": "Picks a Failed interaction up where it stopped when error.disposition\nis RESUMABLE: starts a new phase of the same session and returns the\nrestored waiting state. Failed sessions with any other disposition\nare rejected. Live sessions are rehydrated without starting a new\nphase. Re-attaching after restart without changing a Failed session\nis GET /state, not this endpoint. This endpoint takes no request body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.resumeWalletInteraction\"}" } } }, { "name": "Register sensitive interaction input", "disabled": true, "request": { "description": "Registers client-supplied sensitive protocol input for this\ninteraction session and returns an opaque one-time reference. The\ncaller then passes the reference in a subsequent action such as\nsubmit_tx_code, auth_callback, or approve_security_challenge. The\nregistered value is bound to this session and purpose, is consumable\nat most once, is removed when the interaction terminates, is never\nechoed back in any response or interaction state, and is never\nlogged. Only purposes whose value originates at the wallet client are\naccepted: OID4VCI_TRANSACTION_CODE, OID4VCI_AUTHORIZATION_CALLBACK,\nand INTERACTION_SECURITY_GRANT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.registerWalletInteractionSensitiveInput\"}" } } }, { "name": "Get wallet interaction state", "disabled": true, "request": { "description": "Returns the current point-in-time state snapshot of the interaction\nsession, including the revision used for event replay and frame\nreconciliation. This is the re-attach path after restart: it\nrehydrates the session without starting a new phase, so a Failed\nsession stays Failed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionState\"}" } } } ] } ] }, { "name": "wallet-onboarding", "description": "Operations associated with the wallet-onboarding guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-onboarding-operations", "description": "wallet-onboarding-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Capture a one-use managed wallet identifier input", "disabled": true, "request": { "description": "Accepts the identifier only at the authenticated provider boundary. The clear-text email is\nprotected immediately and is never returned, retained in onboarding state, or published to\nevents, outbox messages, or audit projections.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.captureManagedWalletIdentifierInput\"}" } } }, { "name": "Start managed wallet onboarding", "disabled": true, "request": { "description": "POST /processes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.startManagedWalletOnboarding\"}" } } }, { "name": "Observe managed wallet onboarding", "disabled": true, "request": { "description": "GET /processes/{processId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.observeManagedWalletOnboarding\"}" } } }, { "name": "Dispatch a typed onboarding action", "disabled": true, "request": { "description": "POST /processes/{processId}/actions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.dispatchManagedWalletOnboardingAction\"}" } } }, { "name": "Cancel managed wallet onboarding", "disabled": true, "request": { "description": "POST /processes/{processId}/cancel. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.cancelManagedWalletOnboarding\"}" } } }, { "name": "List append-only managed wallet onboarding events", "disabled": true, "request": { "description": "GET /processes/{processId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.listManagedWalletOnboardingEvents\"}" } } }, { "name": "Resume from a verified one-use provider completion", "disabled": true, "request": { "description": "POST /processes/{processId}/resume. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.resumeManagedWalletOnboarding\"}" } } }, { "name": "Inspect privacy-safe managed wallet process support state", "disabled": true, "request": { "description": "GET /processes/{processId}/support. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.inspectManagedWalletSupport\"}" } } } ] } ] }, { "name": "wallet-recovery", "description": "Operations associated with the wallet-recovery guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-recovery-operations", "description": "wallet-recovery-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Capture an atomic complete-unit production backup", "disabled": true, "request": { "description": "POST /backup/capture. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.captureEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Restore and inspect a complete unit in an isolated failure domain", "disabled": true, "request": { "description": "POST /backup/restore. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.restoreEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Verify the latest complete-unit production backup", "disabled": true, "request": { "description": "POST /backup/verify. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.verifyEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Begin fresh-IDV recovery for a new app on the existing wallet pair", "disabled": true, "request": { "description": "POST /newapp/begin. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.beginEnterpriseWalletNewAppRecovery\"}" } } }, { "name": "Atomically activate the new app and apply the old-app disposition", "disabled": true, "request": { "description": "POST /newapp/finalize. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.finalizeEnterpriseWalletNewAppRecovery\"}" } } }, { "name": "Begin recovery into a distinct successor wallet pair", "disabled": true, "request": { "description": "POST /successor/begin. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.beginEnterpriseWalletSuccessorMigration\"}" } } }, { "name": "Migrate complete logical state and atomically publish the successor", "disabled": true, "request": { "description": "POST /successor/finalize. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.finalizeEnterpriseWalletSuccessorMigration\"}" } } }, { "name": "Export a recipient-scoped protected vault package", "disabled": true, "request": { "description": "POST /vault/export. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.exportEnterpriseWalletVault\"}" } } }, { "name": "Import a verified recipient-scoped protected vault package", "disabled": true, "request": { "description": "POST /vault/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.importEnterpriseWalletVault\"}" } } } ] } ] }, { "name": "wallet-unit", "description": "Operations associated with the wallet-unit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-unit-operations", "description": "wallet-unit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Enroll wallet activation", "disabled": true, "request": { "description": "Enrolls the activation verifier for a Wallet Unit. The verifier is\nblinded or derived proof material; raw PIN values are intentionally not\npart of this contract and must not cross this production API boundary.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.enrollWalletActivation\"}" } } }, { "name": "Begin passkey wallet activation ceremony", "disabled": true, "request": { "description": "Creates an operation-bound passkey assertion challenge for remote\nHSM-backed Wallet Unit activation. The returned challenge is bound to\nwallet unit, wallet account, activation key, operation hash, nonce, and\naudience, but does not reveal WSCD provider details to OIDC callers.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyActivation\"}" } } }, { "name": "Issue passkey wallet activation decision", "disabled": true, "request": { "description": "Finishes an operation-bound passkey assertion and issues a short-lived,\nsingle-use activation decision for remote HSM-backed WSCD signing.\nWallet signing still happens through the WSCD signing endpoints using\nthe returned activation decision id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issuePasskeyActivationDecision\"}" } } }, { "name": "Re-enroll wallet activation", "disabled": true, "request": { "description": "Rotates the activation verifier after proving control of the current\nverifier. Both current and replacement values are blinded or derived\nproof material; this is not a reset or account-recovery workflow.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.reEnrollWalletActivation\"}" } } }, { "name": "Revoke wallet activation", "disabled": true, "request": { "description": "Revokes an activation profile/key binding so it can no longer issue\nactivation decisions. This endpoint is limited to activation state and\ndoes not dispatch user notifications or perform factory-delete logic.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletActivation\"}" } } }, { "name": "Unlock wallet activation", "disabled": true, "request": { "description": "Evaluates a blinded or derived activation proof for one operation-bound\nchallenge and returns an activation decision. Accepted decisions are\nshort-lived, single-use inputs for wallet-key signing and must match the\noperation type, hash, nonce, and audience exactly.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.unlockWalletActivation\"}" } } }, { "name": "Issue key attestation", "disabled": true, "request": { "description": "Issues a Key Attestation for one or more attested keys. Production KA\nissuance is bound to key-storage evidence, user-authentication evidence,\nconfigured Wallet Provider signing, and status-list evidence for\nrevocation checks.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issueKeyAttestation\"}" } } }, { "name": "Validate key attestation", "disabled": true, "request": { "description": "Validates KA material or a stored KA reference against audience, nonce,\nsigner trust, key-storage assurance, user-authentication evidence, and\nstatus evidence. This is evidence production for later OID4VCI checks;\nit does not enforce credential-request processing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateKeyAttestation\"}" } } }, { "name": "Validate wallet instance attestation", "disabled": true, "request": { "description": "Validates WIA material or a stored WIA reference against expected\naudience/issuer, JOSE material, Wallet Provider trust, Wallet Solution\ntrust, and status evidence. Missing, expired, revoked, unsupported, or\nuntrusted evidence fails closed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateWalletInstanceAttestation\"}" } } }, { "name": "Issue wallet instance attestation", "disabled": true, "request": { "description": "Issues a Wallet Instance Attestation for a Wallet Unit. Production TS03\nissuance requires configured Wallet Provider signing, Wallet Provider\ntrust evidence, Wallet Solution evidence, status subject evidence, and\nsecure-component evidence; local/test reference material remains\nexplicit and cannot satisfy production VALID evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issueWalletInstanceAttestation\"}" } } }, { "name": "Get wallet attestation validation evidence", "disabled": true, "request": { "description": "Returns the persisted evidence summary for a previously issued or\nvalidated WIA/KA artifact, including failure reasons and provenance when\nvalidation was rejected.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletAttestationValidationEvidence\"}" } } }, { "name": "List wallet-unit party bindings", "disabled": true, "request": { "description": "Lists Wallet Unit to party-graph bindings. These bindings let VDX party\nand relationship services associate a wallet account, a Wallet Unit, and\ntheir relationship hints without making the Wallet Unit backend mandatory\nfor backendless IDK wallets.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnitPartyBindings\"}" } } }, { "name": "Begin passkey assertion ceremony", "disabled": true, "request": { "description": "Creates a WebAuthn assertion challenge for login, step-up, or wallet\nactivation. The browser or wallet application performs\n`navigator.credentials.get` at the edge and submits the assertion\nresponse to the finish endpoint.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyAssertion\"}" } } }, { "name": "Finish passkey assertion ceremony", "disabled": true, "request": { "description": "Verifies the WebAuthn assertion cryptographically, enforces RP/origin,\nuser verification, backup, transport, replay, ownership, and sign-count\npolicy, and returns operation-bound assertion evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.finishPasskeyAssertion\"}" } } }, { "name": "Begin passkey registration ceremony", "disabled": true, "request": { "description": "Creates a WebAuthn registration challenge for an Identity-bound passkey\ncredential. The browser or wallet application performs\n`navigator.credentials.create` at the edge and submits the resulting\npublic credential response to the finish endpoint.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyRegistration\"}" } } }, { "name": "Finish passkey registration ceremony", "disabled": true, "request": { "description": "Verifies the WebAuthn registration response cryptographically and stores\nonly public credential material and Identity/Identifier metadata.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.finishPasskeyRegistration\"}" } } }, { "name": "Allocate wallet-unit status subject", "disabled": true, "request": { "description": "Allocates a backing entry in an existing status list for WIA client\nstatus, KA key-storage status, Wallet Unit status, WSCD/keystore status,\nor related attestation status. The allocation uses the shared status-list\nmodules and returns the compact reference that can be embedded in\nattestation claims.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.allocateWalletUnitStatusSubject\"}" } } }, { "name": "Check wallet-unit status subject", "disabled": true, "request": { "description": "Resolves the current status of a Wallet Unit status subject by compact\nreference or by subject kind and subject id. When unauthenticated\nstatus-list hosting is configured, the public status-list URI returned\nfrom allocation exposes the same revocation state.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.checkWalletUnitStatusSubject\"}" } } }, { "name": "Revoke wallet-unit status subject", "disabled": true, "request": { "description": "Records an irreversible revocation event and updates the backing\nstatus-list entry when a status subject reference is supplied. This is\nthe production publishing path for WIA/KA and secure-component\nrevocation; it does not implement notification, reset, or PID-provider\norchestration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletUnitStatusSubject\"}" } } }, { "name": "Resolve wallet provider trust evidence", "disabled": true, "request": { "description": "Resolves Wallet Provider or attestation-signer trust using the configured\ntrusted-list adapter and ETSI/LoTE trust primitives. The response\ncarries explicit rejection decisions for missing, expired, revoked,\nunsupported-profile, and untrusted evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.resolveWalletProviderTrust\"}" } } }, { "name": "Resolve wallet solution trust evidence", "disabled": true, "request": { "description": "Resolves Wallet Solution trust for a named solution/version and optional\ncertification evidence. This is the Wallet Unit facade over the trusted\nlist evidence needed by WIA issuance and validation.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.resolveWalletSolutionTrust\"}" } } }, { "name": "List wallet units", "disabled": true, "request": { "description": "Lists Wallet Units visible to the caller. Use `walletAccountId` when a\ncaller needs the units belonging to one wallet account; omit it for the\ntenant-scoped view exposed by the service policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnits\"}" } } }, { "name": "Install a wallet unit", "disabled": true, "request": { "description": "Creates the persisted Wallet Unit and wallet-account records used by\nlater activation, attestation, status, and signing commands. The\nrequest may include remote key references, policy references, and party\nbinding evidence, but it does not make the Wallet Unit production VALID;\nVALID is only reached after the production evidence gate is satisfied.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.installWalletUnit\"}" } } }, { "name": "Get a wallet unit", "disabled": true, "request": { "description": "Returns the current Wallet Unit lifecycle state, account state, counters,\nallowed key references, policy references, and audit history. This is\nthe safest way for clients to check whether a unit is merely installed,\noperational, production VALID, revoked, or uninstalled.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnit\"}" } } }, { "name": "Mark wallet unit operational", "disabled": true, "request": { "description": "Moves an installed Wallet Unit into OPERATIONAL state once the local or\nbackend runtime has completed setup. OPERATIONAL means the unit can\ncollect activation and attestation evidence; it is not sufficient for\nproduction key signing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.markWalletUnitOperational\"}" } } }, { "name": "Get wallet-unit party binding", "disabled": true, "request": { "description": "Returns the persisted party binding for one Wallet Unit, including\nrelationship hints and the provenance supplied when the binding was\ncreated or updated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnitPartyBinding\"}" } } }, { "name": "Bind wallet unit to party IDs", "disabled": true, "request": { "description": "Creates or replaces the party binding for a Wallet Unit. This endpoint\nrecords party identifiers and relationship hints only; it does not alter\nactivation state, attestation evidence, status-list entries, or Wallet\nUnit lifecycle state.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.bindWalletUnitParty\"}" } } }, { "name": "Revoke wallet unit", "disabled": true, "request": { "description": "Marks the Wallet Unit REVOKED and records lifecycle evidence. When\nstatus subjects exist for WIA, KA, or related secure components, callers\nshould use the status-subject revocation endpoint to publish the\nirreversible status-list update through the shared status-list backend.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletUnit\"}" } } }, { "name": "Uninstall wallet unit", "disabled": true, "request": { "description": "Marks the Wallet Unit UNINSTALLED for lifecycle bookkeeping. This API\ndoes not implement factory reset or cryptographic asset deletion\norchestration; those workflows are outside this phase of the Wallet Unit\nsurface.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.uninstallWalletUnit\"}" } } }, { "name": "Validate wallet unit", "disabled": true, "request": { "description": "Transitions a Wallet Unit to VALID when persisted production evidence\nsatisfies the configured gate. The service evaluates stored activation\ntranscript evidence, WIA/KA evidence, trusted Wallet Provider/Solution\nevidence, status-list evidence, and secure-component evidence rather\nthan accepting ad-hoc test seeding.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateWalletUnit\"}" } } }, { "name": "List wallet-unit WSCD key references", "disabled": true, "request": { "description": "Lists only opaque key references already associated with the\nauthenticated Wallet Unit. Each entry is resolved through the internal\ntenant KMS public-material command; this operation never performs a\ntenant-wide key or provider enumeration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnitWscdKeyReferences\"}" } } }, { "name": "Provision a wallet-unit WSCD key reference", "disabled": true, "request": { "description": "Provisions a managed holder-proof key through the tenant KMS execution\nboundary, then associates a new opaque `wscd_` reference with\nthe authenticated Wallet Unit and its account. The server resolves the\ntyped KMS assignment and derives all internal aliases. Callers cannot\nselect providers, KMS resources, handles, locators, or raw algorithms.\nPrivate key material is never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.provisionWalletUnitWscdKeyReference\"}" } } }, { "name": "Get wallet-unit WSCD public key detail", "disabled": true, "request": { "description": "Resolves public verification material only after proving that the\nopaque key reference belongs to the authenticated Wallet Unit. Cross-\ntenant, cross-account, and cross-unit references fail closed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnitWscdKeyReference\"}" } } }, { "name": "Create policy-gated WSCD raw signature", "disabled": true, "request": { "description": "Signs raw input with a Wallet Unit WSCD key after lifecycle, account status,\nkey-reference policy, and activation-decision checks. The activation\ndecision must be accepted, unexpired, unconsumed, and bound to the\nexact operation type, hash, nonce, and audience in this request.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.walletUnitWscdRawSign\"}" } } }, { "name": "Create policy-gated WSCD digest signature", "disabled": true, "request": { "description": "Signs a precomputed digest with a Wallet Unit WSCD key after the same\nlifecycle and activation-decision checks as raw signing. This endpoint\nis intended for flows that already compute the operation digest before\ninvoking the Wallet Unit WSCD policy layer.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.walletUnitWscdSignDigest\"}" } } } ] } ] } ] }, { "name": "idk", "description": "IDK operations exposed by the deployment's policy-filtered OpenAPI catalog.", "item": [ { "name": "blob-store", "description": "Operations associated with the blob-store guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "blob-store-operations", "description": "blob-store-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Copy a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.copyBlob\"}" } } }, { "name": "Move a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.moveBlob\"}" } } }, { "name": "Search indexed blob metadata", "disabled": true, "request": { "description": "POST /blobs:search. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.searchBlobs\"}" } } }, { "name": "List blobs and common prefixes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.listBlobs\"}" } } }, { "name": "Delete a blob conditionally", "disabled": true, "request": { "description": "When `If-Match` or `X-Expected-Revision` is supplied, deletion is atomic and fails rather than deleting a newer object. An unconditional request retains BlobService delete behavior.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.deleteBlob\"}" } } }, { "name": "Stream blob bytes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.streamBlob\"}" } } }, { "name": "Get blob metadata without content", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobInfo\"}" } } }, { "name": "Stream a blob into a store", "disabled": true, "request": { "description": "Writes or atomically replaces an opaque object. `If-None-Match: *` is create-only; `If-Match` or `X-Expected-Revision` performs compare-and-set. The service verifies the optional Digest header while consuming the stream and rejects partial writes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.putBlob\"}" } } }, { "name": "Verify a blob against an expected content address", "disabled": true, "request": { "description": "Reads the selected object through the backend integrity path without returning its bytes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyBlobIntegrity\"}" } } }, { "name": "Get store capabilities", "disabled": true, "request": { "description": "GET /stores/{storeId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobStoreCapabilities\"}" } } }, { "name": "Store content by digest", "disabled": true, "request": { "description": "POST /stores/{storeId}/cas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.storeContentAddressedBlob\"}" } } }, { "name": "Stream content by digest", "disabled": true, "request": { "description": "GET /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getContentAddressedBlob\"}" } } }, { "name": "Verify content exists and matches its address", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyContentAddressedBlob\"}" } } }, { "name": "Create a temporary provider URL", "disabled": true, "request": { "description": "POST /stores/{storeId}/temporary-urls. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.createBlobTemporaryUrl\"}" } } } ] } ] }, { "name": "did", "description": "Operations associated with the did guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-operations", "description": "did-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DIDs", "disabled": true, "request": { "description": "Returns a page of local DID records. Filters are applied before\npagination. `role` is parsed from `MANAGED` or `EXTERNAL`; `expand`\naccepts `document`, `keys`, or `all` as a comma-separated query value.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDids\"}" } } }, { "name": "Create a new DID", "disabled": true, "request": { "description": "Creates a MANAGED DID from caller-supplied public JWK material or an\nexisting same-tenant KMS key. `PUBLIC_JWK` never grants server-side\nsigning authority. `KMS` resolves the provider and key within the\nactive tenant and persists a server-side binding. Method-specific\noptions are passed in `options`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.createDid\"}" } } }, { "name": "Track an externally-managed DID", "disabled": true, "request": { "description": "Registers a reference to an externally-managed DID for local tracking.\nOnly the DID string (and optional alias) is persisted; the resolver\nfetches the document and the IDK CacheService holds it. The tracked\nDID always gets `role = EXTERNAL`. KMS key material is never bound to\nexternal DIDs; keys belong to MANAGED DIDs created locally via\n`POST /identifiers`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.trackExternalDid\"}" } } }, { "name": "Delete a DID", "disabled": true, "request": { "description": "Soft-deletes the local DID resource (sets deletedAt timestamp).\nDoes NOT deactivate the DID on the network/ledger. The DID can be\nrecovered by querying with includeDeleted=true. To deactivate a DID\non the network, use the deactivate action instead.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deleteDid\"}" } } }, { "name": "Get DID", "disabled": true, "request": { "description": "Returns a single DID. The default response is the lightweight `Did`\nsummary, the same shape as items in `GET /identifiers`. Use `?expand=document,keys`\n(or `?expand=all`) to include the resolved DID document and KMS key\nmappings inline on the returned object.\n\nSub-resource collections (controllers, also-known-as, equivalent-ids,\nverification methods, verification relationships, services) are\ndeliberately not folded into this response; fetch them via their\ndedicated sub-resource endpoints (`/identifiers/{did}/controllers`,\n`/identifiers/{did}/verification-methods`, etc.).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDid\"}" } } }, { "name": "Partially update a DID", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDid\"}" } } }, { "name": "Replace a DID", "disabled": true, "request": { "description": "Replaces the mutable declarative fields of a DID in one request.\nCollections in the body are full replacement sets. Verification\nmethods and key mappings are intentionally managed through their\ndedicated sub-resource endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.replaceDid\"}" } } }, { "name": "Deactivate a DID", "disabled": true, "request": { "description": "Publishes a deactivation operation to the DID method's network or\nledger. This is irreversible for most DID methods. Sets the\ndeactivated flag to true on the local DID. This is fundamentally\ndifferent from DELETE, which only soft-deletes the local DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deactivateDid\"}" } } }, { "name": "List also-known-as entries", "disabled": true, "request": { "description": "Lists alternative URIs for the DID subject in DID Core\n`alsoKnownAs` form.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listAlsoKnownAs\"}" } } }, { "name": "Add an also-known-as entry", "disabled": true, "request": { "description": "Adds an also-known-as URI. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `akaUri`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addAlsoKnownAs\"}" } } }, { "name": "Remove an also-known-as entry", "disabled": true, "request": { "description": "Removes one also-known-as entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeAlsoKnownAs\"}" } } }, { "name": "List controllers", "disabled": true, "request": { "description": "Lists controller DID entries for the DID. The response uses the\npublic controller view with row id, controller DID, ordering, and\ntimestamps.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listControllers\"}" } } }, { "name": "Add a controller", "disabled": true, "request": { "description": "Adds a controller DID to the DID. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response\nexposes the value as `controllerDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addController\"}" } } }, { "name": "Remove a controller", "disabled": true, "request": { "description": "Removes one controller entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeController\"}" } } }, { "name": "Get the resolved DID document", "disabled": true, "request": { "description": "Returns the DID document for the given DID. For MANAGED DIDs the document is\nrecomposed from the persisted graph; for EXTERNAL DIDs it is served from the IDK\nCacheService and re-resolved on cache miss.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidDocument\"}" } } }, { "name": "Invalidate the cached DID document", "disabled": true, "request": { "description": "Drops the cached DID document for the given DID, forcing the next\n`GET /identifiers/{did}/document` to re-resolve it from the network/source.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.invalidateDidDocument\"}" } } }, { "name": "Refresh cached DID document", "disabled": true, "request": { "description": "Triggers a fresh resolution of an EXTERNAL DID's document, repopulates the IDK\nCacheService entry, and returns the freshly resolved document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.refreshDidDocument\"}" } } }, { "name": "List equivalent-id entries", "disabled": true, "request": { "description": "Lists equivalent DID identifiers stored for the DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listEquivalentIds\"}" } } }, { "name": "Add an equivalent-id entry", "disabled": true, "request": { "description": "Adds an equivalent DID identifier. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `equivalentDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addEquivalentId\"}" } } }, { "name": "Remove an equivalent-id entry", "disabled": true, "request": { "description": "Removes one equivalent-id entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeEquivalentId\"}" } } }, { "name": "List key mappings", "disabled": true, "request": { "description": "Lists KMS key bindings for verification methods on this DID. These\nrows describe local signing key usage and are separate from the DID\ndocument's public verification material.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listKeyMappings\"}" } } }, { "name": "Add a key mapping", "disabled": true, "request": { "description": "Add a key mapping binding a verification method to a KMS-managed\nkey reference (`keyInfo.providerId` + `keyInfo.alias`/`keyInfo.kid`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addKeyMapping\"}" } } }, { "name": "Remove a key mapping", "disabled": true, "request": { "description": "Removes one local KMS key mapping by its mapping id. This does not\nremove the verification method from the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeKeyMapping\"}" } } }, { "name": "Resolve a DID or dereference a DID URL", "disabled": true, "request": { "description": "Resolves a locally managed DID or dereferences a DID URL.\nWhen a plain DID is provided, returns a ResolutionResult containing\nthe DID document with resolution and document metadata.\nWhen a DID URL with a fragment is provided (e.g.,\ndid:example:123#key-1), returns a DereferencingResult containing\nthe specific resource (verification method, service, etc.).\n\nThis performs a local DID lookup first. If the DID is not\nlocally managed, behavior depends on configuration (may fall\nthrough to remote resolution).\n\nFor DIF Universal Resolver interop, use the separate endpoint\nat /1.0/identifiers/{identifier}.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.resolveDid\"}" } } }, { "name": "List DID services", "disabled": true, "request": { "description": "Lists the DID document service entries currently stored for the DID.\nService entries use the DID Core wire shape: `id`, `type`, and\n`serviceEndpoint`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDidServices\"}" } } }, { "name": "Add a DID service", "disabled": true, "request": { "description": "Adds a DID Core service entry. `type` may be a string or an array of\nstrings; `serviceEndpoint` may be a URI string, object, or array.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addDidService\"}" } } }, { "name": "Remove a DID service", "disabled": true, "request": { "description": "Removes one service entry from the DID document model.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeDidService\"}" } } }, { "name": "Get a DID service", "disabled": true, "request": { "description": "Returns one service entry by the service id used in the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidService\"}" } } }, { "name": "Update a DID service", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDidService\"}" } } }, { "name": "List verification methods", "disabled": true, "request": { "description": "Lists verification methods persisted for the DID. Relationship\nmembership is carried on each method through\n`valueVerificationRelation` and `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationMethods\"}" } } }, { "name": "Add a verification method", "disabled": true, "request": { "description": "Adds a verification method backed by an existing KMS key reference.\nUse `valueVerificationRelation` to embed the method by value in one\nrelationship, and `referenceVerificationRelations` to reference it by\nDID URL from one or more relationships.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationMethod\"}" } } }, { "name": "Remove a verification method", "disabled": true, "request": { "description": "Removes the verification method from the DID and drops relationship\nbindings that point at it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationMethod\"}" } } }, { "name": "Get a verification method", "disabled": true, "request": { "description": "Returns one verification method by fragment or absolute DID URL. The\npath segment is percent-decoded before lookup.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getVerificationMethod\"}" } } }, { "name": "Update a verification method", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a nullable field to null removes it. `keyInfo` can\nbe partially supplied to rebind only selected KMS-key fields.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateVerificationMethod\"}" } } }, { "name": "List verification relationships (derived view)", "disabled": true, "request": { "description": "Returns the per-purpose view of verification relationships derived\nfrom the DID's verification methods. Read-only; to add or remove\na VM from a relationship, update the VM's\n`valueVerificationRelation` / `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationRelationships\"}" } } }, { "name": "Add a verification relationship", "disabled": true, "request": { "description": "Binds an existing verification method to a verification relationship\npurpose. The default is a referenced relationship; set `embed` to true\nto serialize the relationship as an inline verification method object.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationRelationship\"}" } } }, { "name": "Remove a verification relationship", "disabled": true, "request": { "description": "Removes one stored relationship binding by id. Use the id returned by\n`POST /identifiers/{did}/verification-relationships`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationRelationship\"}" } } }, { "name": "List supported DID methods", "disabled": true, "request": { "description": "Returns the capability snapshot for every DID method registered\nwith the deployment.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listSupportedMethods\"}" } } }, { "name": "Get capabilities for a DID method", "disabled": true, "request": { "description": "Returns the full capability profile registered for one DID method,\nincluding lifecycle support, key-management support, service support,\nrepresentation hints, caching behavior, and usage guidance.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilities\"}" } } }, { "name": "Get the capability summary for a DID method", "disabled": true, "request": { "description": "Returns a compact boolean capability summary for one DID method. This\nendpoint is intended for client feature gating.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilitySummary\"}" } } } ] } ] }, { "name": "did-hosting", "description": "Operations associated with the did-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-hosting-operations", "description": "did-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the hosted DID document for a path-less DID.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nwith no path (`did:web:` or the did:web companion of\n`did:webvh::`).\n", "method": "GET", "header": [], "url": "{{baseUrl}}/.well-known/did.json" } }, { "name": "Resolve the hosted DID document for a DID with a path.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nplus a path. `path` is one or more URL segments (the colon-delimited DID\npath segments rendered with slashes), up to the configured maximum depth.\nFor example `did:web:example.com:tenants:acme` is served at\n`/tenants/acme/did.json`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{path}/did.json" } } ] } ] }, { "name": "inbox", "description": "Operations associated with the inbox guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "inbox-operations", "description": "inbox-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Request a policy-filtered evidentiary export job", "disabled": true, "request": { "description": "The server derives export ID, tenant, requester, and request time from authenticated context. This asynchronous evidence archive is separate from management metrics and never returns unbounded correlations inline.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxEvidenceExport\"}" } } }, { "name": "Get an evidentiary export job", "disabled": true, "request": { "description": "GET /evidence-exports/{exportId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxEvidenceExportJob\"}" } } }, { "name": "Download a completed evidentiary export archive", "disabled": true, "request": { "description": "Reauthorizes inbox.export for the current tenant and requester, requires COMPLETED status, audits access, and serves the manifest-bound archive through a short-lived controlled download. It is not a management report.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.downloadInboxEvidenceExportArtifact\"}" } } }, { "name": "List authorized inboxes", "disabled": true, "request": { "description": "GET /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxes\"}" } } }, { "name": "Create an inbox", "disabled": true, "request": { "description": "POST /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInbox\"}" } } }, { "name": "Get an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInbox\"}" } } }, { "name": "Update an inbox", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInbox\"}" } } }, { "name": "List physical folders", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxFolders\"}" } } }, { "name": "Create a physical folder", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxFolder\"}" } } }, { "name": "Get a physical folder", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxFolder\"}" } } }, { "name": "Update a physical folder", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxFolder\"}" } } }, { "name": "List folder bindings", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listFolderBindings\"}" } } }, { "name": "Create a folder binding with a server-generated ID", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createFolderBinding\"}" } } }, { "name": "Update a folder binding", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}/bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateFolderBinding\"}" } } }, { "name": "List work queues for an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxWorkQueues\"}" } } }, { "name": "Create a versioned work queue", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxWorkQueue\"}" } } }, { "name": "Get a work queue", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxWorkQueue\"}" } } }, { "name": "Update a work queue with optimistic concurrency", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxWorkQueue\"}" } } }, { "name": "List inbox routing rules", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxRules\"}" } } }, { "name": "Create an inbox routing rule", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxRule\"}" } } }, { "name": "Delete an inbox routing rule", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteInboxRule\"}" } } }, { "name": "Get an inbox routing rule", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxRule\"}" } } }, { "name": "Update an inbox routing rule", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxRule\"}" } } }, { "name": "List saved inbox views", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listSavedInboxViews\"}" } } }, { "name": "Create a saved inbox view", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createSavedInboxView\"}" } } }, { "name": "Delete a saved inbox view", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteSavedInboxView\"}" } } }, { "name": "Get a saved inbox view", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getSavedInboxView\"}" } } }, { "name": "Update a saved inbox view", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateSavedInboxView\"}" } } }, { "name": "Query authorized inbox items", "disabled": true, "request": { "description": "Executes the versioned structured query across every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. Shared links carry this same `query` parameter as percent-encoded canonical JSON; clients must not translate it into a different filter language.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxItems\"}" } } }, { "name": "Apply tags to a bounded item set as one correlated operation", "disabled": true, "request": { "description": "Source-domain approve, reject, and complete are forbidden as bulk list operations.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkTagInboxItems\"}" } } }, { "name": "Get an inbox item", "disabled": true, "request": { "description": "GET /items/{itemId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItem\"}" } } }, { "name": "Read the latest durable revision of an action receipt", "disabled": true, "request": { "description": "GET /items/{itemId}/action-receipts/{receiptId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxActionReceipt\"}" } } }, { "name": "Submit an item action intent", "disabled": true, "request": { "description": "POST /items/{itemId}/actions/{actionKey}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.performInboxAction\"}" } } }, { "name": "Retrieve an authorized safe artifact", "disabled": true, "request": { "description": "Re-evaluates tenant and inbox.read policy and serves only SAFE content from the managed artifact store. It never proxies a client-supplied URL.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.retrieveInboxArtifact\"}" } } }, { "name": "Get item history", "disabled": true, "request": { "description": "GET /items/{itemId}/history. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemHistory\"}" } } }, { "name": "List auditable legal holds for an item", "disabled": true, "request": { "description": "GET /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxItemLegalHolds\"}" } } }, { "name": "Apply a legal hold that wins over a pending retention sweep", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.applyInboxItemLegalHold\"}" } } }, { "name": "Release a legal hold with optimistic concurrency", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds/{legalHoldId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseInboxItemLegalHold\"}" } } }, { "name": "Get the current user's item state", "disabled": true, "request": { "description": "GET /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemUserState\"}" } } }, { "name": "Update the current user's item state", "disabled": true, "request": { "description": "PUT /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxItemUserState\"}" } } }, { "name": "Stream resumable authorized inbox updates", "disabled": true, "request": { "description": "Streams every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.streamInboxUpdates\"}" } } }, { "name": "Get an authorization-filtered unified inbox summary", "disabled": true, "request": { "description": "Counts every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxSummary\"}" } } }, { "name": "List authorized append-only arrival and completion facts", "disabled": true, "request": { "description": "GET /throughput-facts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxThroughputFacts\"}" } } }, { "name": "Query authorized WORK items across the unified Inbox", "disabled": true, "request": { "description": "Returns WORK items from every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. This is a façade over the canonical Inbox item query.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryWorkItems\"}" } } }, { "name": "Reassign a bounded item set as one correlated operation", "disabled": true, "request": { "description": "POST /work-items/bulk/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkReassignWorkItems\"}" } } }, { "name": "Query authorization-filtered supervisor metrics", "disabled": true, "request": { "description": "POST /work-items/supervisor/query. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxSupervisorMetrics\"}" } } }, { "name": "Submit the fixed approve action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/approve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.approveWorkItem\"}" } } }, { "name": "Atomically claim a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/claim. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.claimWorkItem\"}" } } }, { "name": "Submit the fixed complete action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/complete. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.completeWorkItem\"}" } } }, { "name": "Atomically set bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.setWorkItemCover\"}" } } }, { "name": "Atomically clear bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover/clear. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.clearWorkItemCover\"}" } } }, { "name": "Commit an Inbox-owned SLA escalation synchronously", "disabled": true, "request": { "description": "POST /work-items/{itemId}/escalate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.escalateWorkItem\"}" } } }, { "name": "Explicitly extend a checkout lease; client activity never extends it implicitly", "disabled": true, "request": { "description": "POST /work-items/{itemId}/lease/extend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.extendWorkItemLease\"}" } } }, { "name": "Atomically reassign a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.reassignWorkItem\"}" } } }, { "name": "Submit the fixed reject action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reject. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.rejectWorkItem\"}" } } }, { "name": "Atomically release a work item assignment", "disabled": true, "request": { "description": "POST /work-items/{itemId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseWorkItem\"}" } } }, { "name": "Take over a held or expired checkout and record both holders", "disabled": true, "request": { "description": "POST /work-items/{itemId}/take-over. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.takeOverWorkItem\"}" } } } ] } ] }, { "name": "kms", "description": "Operations associated with the kms guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "kms-operations", "description": "kms-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List provider capabilities", "disabled": true, "request": { "description": "Returns the capability report for every configured provider. Disabled providers are excluded by default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCapabilities\"}" } } }, { "name": "List certificate-chain aliases", "disabled": true, "request": { "description": "GET /certificate-chains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateChainAliases\"}" } } }, { "name": "Delete a certificate chain", "disabled": true, "request": { "description": "Deletes the EDK certificate-chain reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteCertificateChain\"}" } } }, { "name": "Get a certificate chain", "disabled": true, "request": { "description": "GET /certificate-chains/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateChain\"}" } } }, { "name": "Store a certificate chain", "disabled": true, "request": { "description": "Associates the supplied leaf-to-root certificate chain with the key identified by the path alias. When that key already exists in the selected provider, omit keyInfo or supply public-only key metadata; private key material is neither required nor accepted for the association. The provider must expose certificate-store support.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeCertificateChain\"}" } } }, { "name": "List persisted tenant certificate references", "disabled": true, "request": { "description": "Lists only references in the authenticated tenant index. It never enumerates a provider's certificate inventory and returns public certificate and relationship metadata only.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateReferences\"}" } } }, { "name": "Get persisted tenant certificate-reference metadata", "disabled": true, "request": { "description": "Returns one public metadata projection from the authenticated tenant reference index.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateReference\"}" } } }, { "name": "List trusted certificate aliases", "disabled": true, "request": { "description": "GET /certificates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listTrustedCertificateAliases\"}" } } }, { "name": "Generate a certificate signing request", "disabled": true, "request": { "description": "POST /certificates/csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateCertificateSigningRequest\"}" } } }, { "name": "Issue a certificate", "disabled": true, "request": { "description": "POST /certificates/issue. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificate\"}" } } }, { "name": "Issue a certificate from a CSR", "disabled": true, "request": { "description": "POST /certificates/issue-from-csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificateFromCsr\"}" } } }, { "name": "Register a tenant-owned certificate reference", "disabled": true, "request": { "description": "Registers a provider-native certificate reference or stored public certificate material. Registration does not create/import key material. The stored_public_material source requires certificateChain, a non-empty list of Base64-encoded DER certificates, and rejects provider-native material. The provider_native source requires certificateChain to be omitted and resolves the certificate from provider capability. The key_certificate_chain kind requires linkedKeyAlias or linkedKeyKid and binds the leaf public key. providerCertificateId is optional and identifies a provider certificate when supplied. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. For a provider-native certificate reached through a platform-shared Azure Key Vault provider, the native certificate must carry `sphereon-tenant-id` set to the authenticated tenant id. AWS KMS has no provider-native certificate object API.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerCertificateReference\"}" } } }, { "name": "Delete a trusted certificate", "disabled": true, "request": { "description": "Deletes the EDK certificate reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteTrustedCertificate\"}" } } }, { "name": "Get a trusted certificate", "disabled": true, "request": { "description": "GET /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getTrustedCertificate\"}" } } }, { "name": "Store a trusted certificate", "disabled": true, "request": { "description": "POST /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeTrustedCertificate\"}" } } }, { "name": "Decrypt data", "disabled": true, "request": { "description": "POST /encryption/decrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.decrypt\"}" } } }, { "name": "Encrypt data", "disabled": true, "request": { "description": "POST /encryption/encrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.encrypt\"}" } } }, { "name": "Perform key agreement", "disabled": true, "request": { "description": "POST /encryption/key-agreement. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.performKeyAgreement\"}" } } }, { "name": "Unwrap a key", "disabled": true, "request": { "description": "POST /encryption/unwrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.unwrapKey\"}" } } }, { "name": "Wrap a key", "disabled": true, "request": { "description": "POST /encryption/wrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.wrapKey\"}" } } }, { "name": "List all managed cryptographic keys across all providers", "disabled": true, "request": { "description": "Lists key metadata across every provider configured for the calling tenant. Only metadata is returned (alias, kid, algorithm, type); private key material is never included. Pass the optional `providerId` query parameter to restrict the listing to a single provider. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeys\"}" } } }, { "name": "Generate a new key (provider chosen from body or default)", "disabled": true, "request": { "description": "Generates a new key. The request body selects the signature algorithm (for example `ECDSA_SHA256`) and may optionally include an `alias`, `use`, `keyOperations`, and a `providerId`. If `providerId` is omitted the default provider is used. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 400 if the requested algorithm or provider is not available.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateKey\"}" } } }, { "name": "Import externally supplied key material (provider taken from keyInfo)", "disabled": true, "request": { "description": "Imports a key you already hold into the KMS. The target provider is taken from the `providerId` inside the body's `keyInfo` (for example `testsoftware`), and the alias likewise comes from `keyInfo.alias`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 400 if the keyInfo is missing required fields or names an unknown provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.importKey\"}" } } }, { "name": "Register an existing provider key for platform use", "disabled": true, "request": { "description": "Explicitly onboards a key that already exists inside a provider into the platform's persistent key reference store, so the platform can discover and use it later. The body identifies the key by its `providerId` and exact provider-native `alias`, with an optional canonical `kid`. EDK stores that alias unchanged in the authenticated tenant's reference index; it does not add the backing-alias prefix used for platform-managed generated or imported keys. When the provider is a platform-shared AWS or Azure resource, the native key must carry `sphereon-tenant-id` set to the authenticated tenant id; the assignment is checked again before later use. A tenant-owned provider does not require that shared-provider tag. Registration does not create/import key material; the key must already live in the named provider. The response confirms registration and echoes the alias, providerId, and kid. Returns 400 if the provider or key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerKeyReference\"}" } } }, { "name": "Delete a key from the key store by alias or kid", "disabled": true, "request": { "description": "Removes the EDK key reference identified by `aliasOrKid` (its alias or kid). For an externally managed reference, Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible: deletion continues to follow the existing provider and key-store deletion rules. Pass the optional `providerId` query parameter to scope the deletion to a single provider. Returns 204 with no body on success, or 404 if no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key across the calling tenant's providers by its alias or kid. The `aliasOrKid` path parameter may be the alias (for example `my-signing-key`) or the kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Pass the optional `providerId` query parameter to disambiguate when the same alias exists in more than one provider. Returns 404 if no matching key is found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKey\"}" } } }, { "name": "List configured key providers", "disabled": true, "request": { "description": "Returns every non-internal key provider that is configured and available for the calling tenant. Providers are configured server-side (for example a `SOFTWARE`, `AWS_KMS`, or `AZURE_KEYVAULT` provider); this endpoint does not create them. Internal system providers such as `license` and `platform` are intentionally hidden from this regular KMS REST surface. Use the returned `providerId` (for example `testsoftware`) to scope key operations to a specific provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeyProviders\"}" } } }, { "name": "Query matching providers", "disabled": true, "request": { "description": "Returns all providers matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryProviders\"}" } } }, { "name": "Query the best matching provider", "disabled": true, "request": { "description": "Returns the best provider matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryBestProvider\"}" } } }, { "name": "Get key provider details", "disabled": true, "request": { "description": "Returns the configuration details of a single key provider identified by its `providerId` path parameter (for example `testsoftware`). Returns 404 if no provider with that id is configured for the calling tenant, or if the provider is an internal system provider such as `license` or `platform`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKeyProvider\"}" } } }, { "name": "Get capabilities for one provider", "disabled": true, "request": { "description": "GET /providers/{providerId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getProviderCapabilities\"}" } } }, { "name": "List all managed cryptographic keys for a provider", "disabled": true, "request": { "description": "Lists the keys managed by the provider identified by `providerId`. Only key metadata is returned (alias, kid, algorithm, type); private key material is never included. Returns 404 if the provider id is unknown for the calling tenant or if it is an internal system provider such as `license` or `platform`. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerListKeys\"}" } } }, { "name": "Generate a new key in a provider", "disabled": true, "request": { "description": "Generates a new key inside the provider identified by `providerId`. The request body selects the signature algorithm (for example `ECDSA_SHA256`), and optionally an `alias`, intended `use` (`sig`/`enc`), and `keyOperations`. If no alias is given the provider assigns one. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 404 if the provider id is unknown, or 400 if the requested algorithm is not supported.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGenerateKey\"}" } } }, { "name": "Import externally supplied key material into a provider", "disabled": true, "request": { "description": "Imports a key that you already hold (its key material is supplied in the request body as a JWK) into the provider identified by `providerId`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 404 if the provider id is unknown, or 400 if the supplied keyInfo is invalid.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerImportKey\"}" } } }, { "name": "Delete a key from a provider", "disabled": true, "request": { "description": "Permanently removes the key identified by `aliasOrKid` from the provider identified by `providerId`. The `aliasOrKid` may be the key's alias or its kid. Returns 204 with no body on success, or 404 if the provider id is unknown or no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerDeleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key in the provider identified by `providerId`. The `aliasOrKid` path parameter may be either the key's alias (for example `my-signing-key`) or its kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Returns 404 if the provider id is unknown or no key matches the alias or kid in that provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGetKey\"}" } } }, { "name": "List all configured key resolvers", "disabled": true, "request": { "description": "Returns every key resolver configured for the calling tenant. A key resolver turns a key reference (a JWK, kid, X.509 chain, or DID) into a concrete public key. Each resolver advertises which identifier methods and key types it supports. The default deployment exposes a resolver with id `jose_cose_resolver`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listResolvers\"}" } } }, { "name": "Get key resolver details", "disabled": true, "request": { "description": "Returns the configuration of a single key resolver identified by its `resolverId` path parameter (for example `jose_cose_resolver`), including the identifier methods and key types it supports. Returns 404 if no resolver with that id is configured for the calling tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getResolver\"}" } } }, { "name": "Resolve a public key", "disabled": true, "request": { "description": "Resolves a public key through the resolver identified by `resolverId` (for example `jose_cose_resolver`). The request body carries a `keyInfo` reference to resolve, an optional `identifierMethod` (for example `JWK`, `KID`, `DID`, `X5C`) hinting how to interpret it, optional `trustedCerts`, and an optional `verifyX509CertificateChain` flag. The response is a fully resolved key whose public `key` JWK is guaranteed to be present. Returns 404 if the resolver id is unknown, or 400 if the key reference cannot be resolved.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.resolveKey\"}" } } }, { "name": "Create a raw signature", "disabled": true, "request": { "description": "Produces a raw (detached) cryptographic signature over the supplied bytes using a managed key. The request body identifies the key with a `keyInfo` (by `providerId` plus either `alias` or `kid`) and carries the bytes to sign in `input` as a base64-encoded string; the signature algorithm is taken from the resolved key. The response returns the signature bytes, base64-encoded; only the signature is returned, not the input. Pass the same `input` and `keyInfo` to `/signatures/raw/verify`. Returns 400 if the key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.createRawSignature\"}" } } }, { "name": "Verify a raw signature", "disabled": true, "request": { "description": "Verifies a raw (detached) signature against the original bytes using a managed key. The request body carries the `keyInfo` identifying the verifying key, the original bytes in `input` (base64), and the candidate `signature` (base64). The response is `{ \"isValid\": true }` when the signature matches and `{ \"isValid\": false }` when it does not (for example when the input was tampered with). Verification failures due to a wrong signature return 200 with `isValid: false`, not an error status. Returns 400 only for malformed input.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.isValidRawSignature\"}" } } } ] } ] }, { "name": "oid4vci-issuer-session", "description": "Operations associated with the oid4vci-issuer-session guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuer-session-operations", "description": "oid4vci-issuer-session-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a credential offer and its issuance session", "disabled": true, "request": { "description": "Creates a new OID4VCI Credential Offer for the supplied credential configuration ids and\nopens a tracked issuance session for it. The response carries everything needed to start\nthe wallet flow and to follow the session afterwards: the offer URI, an optional QR code\ndata URI (returned only when `qr_code` options were supplied), the transaction code (when a\npre-authorized grant requested one), a `status_uri` for polling, and the `correlation_id`\nthat keys the session.\n\nGrant selection follows the request `grants`. When neither a pre-authorized nor an\nauthorization code grant is given, a pre-authorized code grant is used by default. Supply a\n`correlation_id` to use your own business key, otherwise the server generates one. This\nendpoint is meant to be called from the issuer backend, not from a browser or wallet.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.createCredentialOffer\"}" } } }, { "name": "Delete a credential offer session", "disabled": true, "request": { "description": "Removes all state associated with the credential-offer session identified by its\n`correlation_id`. Use it to clean up after the session completes, after it times out, or to\ncancel an outstanding offer. Returns `204 No Content` on success.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.deleteCredentialOffer\"}" } } }, { "name": "Get credential offer session status", "disabled": true, "request": { "description": "Returns the current status of a credential-offer session identified by its\n`correlation_id`. The response always carries the status and a `last_updated` timestamp.\nWhen the session has reached `credential_issued`, the response also includes\n`issuance_data` (the issued credential configuration ids and credential identifiers). When\nthe session has reached `error`, the response includes an `error` object with a code and\nmessage. Poll this endpoint to follow the session across the issuance lifecycle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.getCredentialOfferStatus\"}" } } } ] } ] }, { "name": "oid4vp-dcql", "description": "Operations associated with the oid4vp-dcql guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-dcql-operations", "description": "oid4vp-dcql-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DCQL query configurations", "disabled": true, "request": { "description": "Returns every DCQL query configuration belonging to the calling tenant, ordered by `queryId`. Returns an empty array when the tenant has no configurations. Only the calling tenant's configurations are visible.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlQueries\"}" } } }, { "name": "Create a DCQL query configuration", "disabled": true, "request": { "description": "Creates a new DCQL query configuration for the calling tenant. The `queryId` you supply becomes the stable handle used to reference, update, and delete the configuration later. Fails with `409` if a configuration with the same `queryId` already exists for the tenant, and with `400` if the DCQL query is malformed (for example a query that has neither `credentials` nor `credential_sets`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.createDcqlQuery\"}" } } }, { "name": "Delete a DCQL query configuration", "disabled": true, "request": { "description": "Permanently deletes the configuration identified by `{queryId}` for the calling tenant. Returns `204` with no body on success and `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.deleteDcqlQuery\"}" } } }, { "name": "Get a DCQL query configuration", "disabled": true, "request": { "description": "Returns the single DCQL query configuration identified by `{queryId}` for the calling tenant. Fails with `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getDcqlQuery\"}" } } }, { "name": "Partially update a DCQL query configuration", "disabled": true, "request": { "description": "Partially updates the configuration identified by `{queryId}`. Only the fields present (and non-null) in the body are changed; every omitted field keeps its stored value. The merge behaviour matches `PUT`, but `PATCH` is the idiomatic verb when changing one or two fields (for example flipping `enabled` to `false` without resending the DCQL query). The `queryId` is taken from the path, never the body. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.patchDcqlQuery\"}" } } }, { "name": "Replace a DCQL query configuration", "disabled": true, "request": { "description": "Replaces the configuration identified by `{queryId}`. A `PUT` caller supplies every mutable field (`name`, `description`, `dcqlQuery`, `enabled`). The `queryId` is taken from the path and is never read from the body. Any field omitted or sent as `null` leaves the stored value unchanged, so to clear `description` send an empty string rather than `null`. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.replaceDcqlQuery\"}" } } } ] } ] }, { "name": "oid4vp-universal", "description": "Operations associated with the oid4vp-universal guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-universal-operations", "description": "oid4vp-universal-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create authorization request and session", "disabled": true, "request": { "description": "Creates a new OID4VP authorization request that can be used to request digital credentials\nfrom a wallet. Returns the URIs needed to start the flow and check its status. The supplied\n`queryId` must be configured on the Relying Party agent.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.create-authorization-request\"}" } } }, { "name": "Remove authorization request state", "disabled": true, "request": { "description": "Deletes all state associated with an authorization request. Use for cleanup after completion or timeout.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.delete-authorization-request\"}" } } }, { "name": "Get authorization session status", "disabled": true, "request": { "description": "Checks the current status of an Authorization Request session. Can optionally include verified credential data\nin the response when the status is 'verified'.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.get-authorization-status\"}" } } } ] } ] }, { "name": "statuslist-hosting", "description": "Operations associated with the statuslist-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "statuslist-hosting-operations", "description": "statuslist-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the signed status-list token by correlation id", "request": { "description": "Returns the raw signed status-list token for the list with business correlation id\n`{correlationId}`. This is the stable, externally referenced address that issued credentials\nembed, since the correlation id is operator-chosen and does not change across upgrades. The\nbody is the bare signed token with the token's own `Content-Type` and a\n`Cache-Control: public, max-age=`\nheader (falling back to `public, max-age=300`). Returns `404` when no list has this correlation\nid.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{correlationId}" } } ] } ] }, { "name": "vault", "description": "Operations associated with the vault guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "vault-operations", "description": "vault-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a vault", "disabled": true, "request": { "description": "POST /vaults. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVault\"}" } } }, { "name": "Delete a vault conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVault\"}" } } }, { "name": "Get a vault descriptor", "disabled": true, "request": { "description": "GET /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVault\"}" } } }, { "name": "Stream a recipient-scoped TDF export", "disabled": true, "request": { "description": "Object export is TDF. Folder/vault export is deterministic BagIt 1.0 carried in TDF. Normal export excludes private keys, PINs, live tokens, cookies, KMS recovery data, secret zones, and unrelated grant topology.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.exportVaultContent\"}" } } }, { "name": "Stream plaintext by mutable path", "disabled": true, "request": { "description": "Never returns protected bytes as plaintext.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileByPath\"}" } } }, { "name": "Stream a plaintext file through an approved protection provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS. That profile must use `/protected-files` so the service never receives plaintext and never bypasses client-controlled protection.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultPlaintextFile\"}" } } }, { "name": "Create an explicit folder", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultFolder\"}" } } }, { "name": "List grants", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultGrants\"}" } } }, { "name": "Create or replace a grant conditionally", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultGrant\"}" } } }, { "name": "Revoke a grant conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/grants/{grantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.revokeVaultGrant\"}" } } }, { "name": "Stream and verify a recipient-scoped TDF export", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/imports. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.importVaultContent\"}" } } }, { "name": "List path entries", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjects\"}" } } }, { "name": "Delete a file or folder conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVaultObject\"}" } } }, { "name": "Get object, path binding, and current version metadata", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVaultObject\"}" } } }, { "name": "Replace object metadata", "disabled": true, "request": { "description": "PATCH /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultObjectMetadata\"}" } } }, { "name": "Stream plaintext by stable object identity", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileById\"}" } } }, { "name": "Stream protected content and its ZERO_ACCESS descriptor", "disabled": true, "request": { "description": "Returns protected bytes, record, plaintext digest/size, package reference, protection parameters, and canonical AAD. This is distinct from plaintext read and never unwraps.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultProtectedFile\"}" } } }, { "name": "Store a client-protected immutable version", "disabled": true, "request": { "description": "The body objectId must match the path objectId and the new client-selected versionId must be unused. The canonical AAD is validated before the authoritative manifest commit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultProtectedVersion\"}" } } }, { "name": "List immutable versions", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/versions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjectVersions\"}" } } }, { "name": "Stream a new plaintext version through an approved provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS; use `/protected-versions` for that profile.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultPlaintextVersion\"}" } } }, { "name": "Copy into a new object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.copyVaultObject\"}" } } }, { "name": "Move or rename without changing object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.moveVaultObject\"}" } } }, { "name": "Replace the vault policy reference", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultPolicy\"}" } } }, { "name": "Store a client-protected ZERO_ACCESS file", "disabled": true, "request": { "description": "Requires client-selected objectId and versionId before upload. The server validates the canonical AAD binding and atomically rejects identifier collision or reuse.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultProtectedFile\"}" } } }, { "name": "Search bounded metadata projections", "disabled": true, "request": { "description": "Implementations must not scan and decrypt object bodies.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.searchVaultMetadata\"}" } } } ] } ] }, { "name": "wallet-credential", "description": "Operations associated with the wallet-credential guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-credential-operations", "description": "wallet-credential-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List wallet credentials", "disabled": true, "request": { "description": "Lists the credential metadata sidecars of one wallet unit. The query\nparameters mirror the credential metadata filter exactly: type\nreferences, formats, issuer reference, subject reference, credential\nconfiguration id, lifecycle states, and deleted-record inclusion.\n\nThe two set-valued enum filters, formats and lifecycleStates, are sent\nas a single comma-separated value each rather than as repeated query\nparameters, because the server reads one value per parameter name.\n\nThere are no paging parameters; the full filtered set is returned in\none response. Paging arrives later as a compatible extension of this\noperation. Raw credential bodies are never part of the result.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.listWalletCredentials\"}" } } }, { "name": "Delete a wallet credential", "disabled": true, "request": { "description": "Deletes one stored credential after verifying the supplied activation\ngrant. The referenced activation decision is single-use and\noperation-bound to operationType wallet.credentials.delete with the\nexact operation hash, nonce, and audience in the request body. The\nserver consumes the decision before performing the deletion, so a\nsecond attempt with the same decision fails even if the first attempt\ndid not complete. A missing, expired, already consumed, or wrong-hash\ndecision is rejected with 403 and nothing is deleted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.deleteWalletCredential\"}" } } }, { "name": "Get a wallet credential", "disabled": true, "request": { "description": "Returns the display projection for one stored credential: the metadata\nsidecar, the issuer party derived inside the authoritative profile\nboundary, tags, the canonical sanitized claim tree with localized\nlabels, and referenced external resources.\n\nThe raw credential body is never exposed by this API. The claim tree\nis a sanitized projection; hidden values are absent rather than\nmasked, and external resources are returned as link references that\nclients decide whether to open.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.getWalletCredential\"}" } } }, { "name": "Refresh wallet credential status", "disabled": true, "request": { "description": "Re-resolves the revocation and validity status of one stored\ncredential against its configured status mechanism and persists the\noutcome. The response carries the updated credential metadata sidecar\nplus the latest status snapshot when one is available.\n\nThis operation is unattended-safe: it requires no activation grant,\ndiscloses nothing beyond the metadata sidecar, and can run from\nbackground jobs and sync loops.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.refreshWalletCredentialStatus\"}" } } } ] } ] }, { "name": "wallet-interaction", "description": "Operations associated with the wallet-interaction guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-interaction-operations", "description": "wallet-interaction-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Bind a screen to a live session", "disabled": true, "request": { "description": "Binds the authenticated screen (bearer screen credential issued by its owning\nauthorization server for the hand-off audience) to the named live session with the\nrole carried by the token and returns the role projection. Binding records presence so\nother screens see the join.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.bindHandoffScreen\"}" } } }, { "name": "Send a screen presence heartbeat", "disabled": true, "request": { "description": "Refreshes last-seen for the authenticated screen within the named session. Screens whose\nheartbeats stop stay visible in operator projections marked stale rather than silently\ndisappearing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.heartbeatHandoffScreen\"}" } } }, { "name": "Start a credential hand-off session", "disabled": true, "request": { "description": "Starts a hand-off session wrapping one offer or request run for a business wallet unit\nand returns the snapshot for the starting caller's role. Protocol execution stays owned\nby the backend; this surface captures, initiates and drives interaction only. The single\ndurable expiry timer is scheduled from the resolved session lifetime.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startHandoffSession\"}" } } }, { "name": "Get the role-scoped hand-off session snapshot", "disabled": true, "request": { "description": "Returns the current point-in-time snapshot from the session store read model, projected\nfor the caller's role. Enforcement is by omission server side: a display projection\ncarries no link text, no email action channel, and no result claim data, and the raw\nexchange URI appears in no projection at any role.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionSnapshot\"}" } } }, { "name": "Replay hand-off session events", "disabled": true, "request": { "description": "Returns recorded hand-off session events in the server-sent-events wire format. Each\nevent uses the event name handoff-session-event, the id field carries the per-session\nsequence used as the replay cursor, and the data field carries the HandoffSessionEvent\nJSON document. When the Last-Event-ID request header is present, only events with a\nsequence greater than that value are replayed. Events are served from the session store\nread model only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionEvents\"}" } } }, { "name": "Consume the guarded hand-off exchange URI", "disabled": true, "request": { "description": "Returns the guarded exchange URI held server side for this session to an eligible\nauthenticated screen or operator. This is the ONLY path on which the URI leaves the\nserver: it exists so it can be fed straight into the QR encoder or clipboard path.\nIt never appears in any projection, any stream event, or any log line. Display-role\nscreens use it to feed their encoder without ever receiving link text.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeHandoffExchangeUri\"}" } } }, { "name": "Regenerate the hand-off session", "disabled": true, "request": { "description": "Start over as a distinct action from retry and resume. Cancels the current run,\ninvalidates its correlation id upstream, and starts a successor workflow. The returned\nsnapshot belongs to the successor session; bound screens learn the successor through the\nterminal_reached event and the successorSessionId field. Regeneration after expiry is\nthe expected recovery path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.regenerateHandoffSession\"}" } } }, { "name": "List wallet interaction activity", "disabled": true, "request": { "description": "Lists the interaction activity log projection for a wallet unit in\nascending sequence order. Use afterSequence with the nextSequence\nvalue of the previous page to fetch the next page.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.listWalletInteractionActivity\"}" } } }, { "name": "Start a wallet interaction", "disabled": true, "request": { "description": "Starts a wallet interaction session from a captured entry point and\nreturns the session with its initial state. The walletUnitId inside\nthe request input must equal the walletUnitId path parameter; a\nmismatch is rejected. The execution owner recorded at start is locked\nbefore semantic interpretation and stays immutable for the lifetime\nof the interaction.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startWalletInteraction\"}" } } }, { "name": "Cancel a wallet interaction", "disabled": true, "request": { "description": "Cancels the interaction session and returns the terminal state. All\noutstanding sensitive inputs registered for the session are removed\nwhen the interaction terminates.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.cancelWalletInteraction\"}" } } }, { "name": "Dispatch a wallet interaction action", "disabled": true, "request": { "description": "Dispatches one user or client action into the interaction state\nmachine and returns the resulting state. Sensitive values such as\ntransaction codes and security grants are passed by sensitive-input\nreference, never inline.\n\nOPTIMISTIC CONCURRENCY. A client that sends expectedRevision in the\nrequest body makes the dispatch a conditional write: the server reads\nthe session state first and answers 409 with a\nWalletInteractionRevisionConflict, applying nothing, unless the session\nis still at exactly that revision. This is what keeps an approval the\nuser gave against a screen that has since moved on -- a consent decided\non a stale render, or a retry of an action that already applied -- from\nbeing applied against a state nobody looked at. The conflict body\ncarries the current state so the client can re-render immediately.\nOmitting expectedRevision applies the action unconditionally.\n\nThere are no concurrency-control HTTP headers on this operation. The\nprecondition travels in the body, the way the frame transport already\ncarries lastRevision, so no gateway can strip it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.dispatchWalletInteractionAction\"}" } } }, { "name": "Consume the issuer authorization handoff", "disabled": true, "request": { "description": "Returns the issuer authorization URL held behind authorizationHandoffRef, then spends the\nreference. Public interaction state never carries the URL: this is the one-shot path a\nbrowser host uses to open the issuer sign-in page. A second call with the same reference\nis not found. After the holder returns, register the callback through the sensitive-input\nendpoint and dispatch auth_callback.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeWalletInteractionAuthorizationHandoff\"}" } } }, { "name": "Replay wallet interaction state events", "disabled": true, "request": { "description": "Returns recorded interaction state events in the server-sent-events\nwire format. Each event uses the event name wallet-interaction-state,\nthe id field carries the state revision, and the data field carries\nthe WalletInteractionStateEvent JSON document. When the Last-Event-ID\nrequest header is present, only events with a revision greater than\nthat value are replayed.\n\nThe current implementation returns a bounded replay of the events\nrecorded so far and then closes the response; it does not hold the\nconnection open for live updates. Live streaming is a later server\nenhancement behind this same contract, and remains available today\nthrough the neutral server-streaming command transport.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionEvents\"}" } } }, { "name": "Handle a wallet interaction frame", "disabled": true, "request": { "description": "Multiplexed request/response frame transport over one endpoint. A\nRESUME, DISPATCH_ACTION, or CANCEL client frame is executed against\nthe session and answered with a STATE server frame carrying the\nresulting state and revision; a PING frame is answered with PONG. The\nsessionId inside the frame must equal the sessionId path parameter; a\nmismatch is rejected.\n\nA DISPATCH_ACTION frame that carries lastRevision is a conditional\nwrite on exactly the terms the actions endpoint uses for\nexpectedRevision: it is answered with 409 and an ERROR server frame\ncarrying the current state, applying nothing, unless the session is\nstill at that revision. lastRevision is ignored on RESUME, CANCEL, and\nPING. A RESUME frame of a Failed session with disposition RESUMABLE\nstarts a new phase and advances revision; GET /state is the re-attach\npath that does not. This operation declares no header parameters; the\nprecondition travels in the frame body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.handleWalletInteractionFrame\"}" } } }, { "name": "Resume a wallet interaction", "disabled": true, "request": { "description": "Picks a Failed interaction up where it stopped when error.disposition\nis RESUMABLE: starts a new phase of the same session and returns the\nrestored waiting state. Failed sessions with any other disposition\nare rejected. Live sessions are rehydrated without starting a new\nphase. Re-attaching after restart without changing a Failed session\nis GET /state, not this endpoint. This endpoint takes no request body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.resumeWalletInteraction\"}" } } }, { "name": "Register sensitive interaction input", "disabled": true, "request": { "description": "Registers client-supplied sensitive protocol input for this\ninteraction session and returns an opaque one-time reference. The\ncaller then passes the reference in a subsequent action such as\nsubmit_tx_code, auth_callback, or approve_security_challenge. The\nregistered value is bound to this session and purpose, is consumable\nat most once, is removed when the interaction terminates, is never\nechoed back in any response or interaction state, and is never\nlogged. Only purposes whose value originates at the wallet client are\naccepted: OID4VCI_TRANSACTION_CODE, OID4VCI_AUTHORIZATION_CALLBACK,\nand INTERACTION_SECURITY_GRANT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.registerWalletInteractionSensitiveInput\"}" } } }, { "name": "Get wallet interaction state", "disabled": true, "request": { "description": "Returns the current point-in-time state snapshot of the interaction\nsession, including the revision used for event replay and frame\nreconciliation. This is the re-attach path after restart: it\nrehydrates the session without starting a new phase, so a Failed\nsession stays Failed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionState\"}" } } } ] } ] } ] }, { "name": "vdx", "description": "VDX operations exposed by the deployment's policy-filtered OpenAPI catalog.", "item": [ { "name": "account-action", "description": "Operations associated with the account-action guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "account-action-operations", "description": "account-action-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Complete and consume an account action", "disabled": true, "request": { "description": "POST /complete. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"account-action.completeAccountAction\"}" } } }, { "name": "Request a password-change email", "disabled": true, "request": { "description": "Always returns the same accepted response. Only an eligible identity with a verified primary email and an existing password credential is sent a message.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"account-action.initiatePasswordChange\"}" } } }, { "name": "Send a password-change email to the authenticated identity", "disabled": true, "request": { "description": "POST /password-change/self. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"account-action.initiateSelfPasswordChange\"}" } } }, { "name": "Resolve an account action without consuming it", "disabled": true, "request": { "description": "POST /resolve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"account-action.resolveAccountAction\"}" } } } ] } ] }, { "name": "application-bff-oauth-client", "description": "Operations associated with the application-bff-oauth-client guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "application-bff-oauth-client-operations", "description": "application-bff-oauth-client-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Complete an OAuth authorization response", "disabled": true, "request": { "description": "Atomically consumes the one-time state, validates the exact RFC 9207 response\nissuer, redirect URI, nonce, selected binding, ID token, and signed access\ntoken, then attaches or replaces the selected resource grant. The owner handle is\nrecovered from encrypted server-side state correlation, so no browser cookie is\nrequired on a cross-site form_post callback.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.completeBffOAuthAuthorization\"}" } } }, { "name": "Resolve a short-lived access token", "disabled": true, "request": { "description": "Returns only a currently valid short-lived access token to the authenticated\nBFF. Refresh is performed backend-side and cross-node serialized. Refresh\ntokens and ID tokens are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.resolveBffOAuthAccessToken\"}" } } }, { "name": "Revoke one exact resource grant", "disabled": true, "request": { "description": "Revokes only the grant bound to the registered public origin, resource kind, instance, and opaque owner.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.revokeBffOAuthGrant\"}" } } }, { "name": "Start an OAuth authorization transaction", "disabled": true, "request": { "description": "Resolves the canonical testing-console AS/client binding for the selected\nissuer or verifier instance. If ownerHandle is absent, creates a new opaque\nbrowser owner handle. The authorization state, nonce, PKCE verifier, metadata,\nand binding remain backend-side.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.startBffOAuthAuthorization\"}" } } }, { "name": "Get one exact resource grant", "disabled": true, "request": { "description": "Returns only the grant bound to the registered public origin, resource kind, instance, and opaque owner.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application-bff-oauth-client.getBffOAuthStatus\"}" } } } ] } ] }, { "name": "asset", "description": "Operations associated with the asset guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "asset-operations", "description": "asset-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List assets", "disabled": true, "request": { "description": "Lists the caller-tenant's assets in the namespace as a plain array. The optional `contentType` filter restricts to assets whose content type starts with the given value (for example `image/`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.listAssets\"}" } } }, { "name": "Upload an asset", "disabled": true, "request": { "description": "Uploads an asset into the caller-tenant's library as raw bytes. The stored content type is taken from the request `Content-Type` header, which is authoritative. The asset is content-addressed by the SHA-256 hash of its bytes and deduplicated within the tenant and namespace: re-uploading identical bytes returns a reference to the already-stored asset instead of creating a new one. Returns an [AssetReference] whose `uri` is the stable public hosting path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.uploadAsset\"}" } } }, { "name": "Delete an asset", "disabled": true, "request": { "description": "Deletes a stored asset by its SHA-256 content hash and returns no response body when successful. The public hosting URL stops resolving for this tenant and namespace.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.deleteAsset\"}" } } }, { "name": "Get an asset", "disabled": true, "request": { "description": "Returns the descriptor of one stored asset by its SHA-256 content hash. The asset bytes themselves are served from the public hosting path in the descriptor's `uri`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"asset.getAsset\"}" } } }, { "name": "Download a public asset", "request": { "description": "Serves the raw bytes of a stored asset from its stable tenant-scoped, content-addressed\npublic URL. The response `Content-Type` is whatever the asset was stored as. Because the\nasset id is the SHA-256 content hash, the body can never change for a given URL, so the\nresponse is served with `Cache-Control: public, max-age=31536000, immutable`. Returns 404\nfor an unknown tenant, namespace, or asset.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/assets/{tenantId}/{namespace}/{asset}" } } ] } ] }, { "name": "audit", "description": "Operations associated with the audit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "audit-operations", "description": "audit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List audit events", "disabled": true, "request": { "description": "Returns immutable EDK audit events for the requested tenant. The query\nfields mirror `AuditQueryFilter` and are AND-combined by the audit query\nservice. Events are ordered newest first by the underlying store.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"audit.listAuditEvents\"}" } } } ] } ] }, { "name": "blob-store", "description": "Operations associated with the blob-store guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "blob-store-operations", "description": "blob-store-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Copy a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.copyBlob\"}" } } }, { "name": "Move a blob within or across configured stores", "disabled": true, "request": { "description": "POST /blobs:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.moveBlob\"}" } } }, { "name": "Search indexed blob metadata", "disabled": true, "request": { "description": "POST /blobs:search. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.searchBlobs\"}" } } }, { "name": "List blobs and common prefixes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.listBlobs\"}" } } }, { "name": "Delete a blob conditionally", "disabled": true, "request": { "description": "When `If-Match` or `X-Expected-Revision` is supplied, deletion is atomic and fails rather than deleting a newer object. An unconditional request retains BlobService delete behavior.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.deleteBlob\"}" } } }, { "name": "Stream blob bytes", "disabled": true, "request": { "description": "GET /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.streamBlob\"}" } } }, { "name": "Get blob metadata without content", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/blobs/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobInfo\"}" } } }, { "name": "Stream a blob into a store", "disabled": true, "request": { "description": "Writes or atomically replaces an opaque object. `If-None-Match: *` is create-only; `If-Match` or `X-Expected-Revision` performs compare-and-set. The service verifies the optional Digest header while consuming the stream and rejects partial writes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.putBlob\"}" } } }, { "name": "Verify a blob against an expected content address", "disabled": true, "request": { "description": "Reads the selected object through the backend integrity path without returning its bytes.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyBlobIntegrity\"}" } } }, { "name": "Get store capabilities", "disabled": true, "request": { "description": "GET /stores/{storeId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getBlobStoreCapabilities\"}" } } }, { "name": "Store content by digest", "disabled": true, "request": { "description": "POST /stores/{storeId}/cas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.storeContentAddressedBlob\"}" } } }, { "name": "Stream content by digest", "disabled": true, "request": { "description": "GET /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.getContentAddressedBlob\"}" } } }, { "name": "Verify content exists and matches its address", "disabled": true, "request": { "description": "HEAD /stores/{storeId}/cas/{algorithm}/{digest}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.verifyContentAddressedBlob\"}" } } }, { "name": "Create a temporary provider URL", "disabled": true, "request": { "description": "POST /stores/{storeId}/temporary-urls. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"blob-store.createBlobTemporaryUrl\"}" } } } ] } ] }, { "name": "business-conduit", "description": "Operations associated with the business-conduit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "business-conduit-operations", "description": "business-conduit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Discover assignments visible to the current operator", "disabled": true, "request": { "description": "GET /assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.discoverBusinessConduitAssignments\"}" } } }, { "name": "Create a business conduit assignment from a server-authorized offer", "disabled": true, "request": { "description": "POST /assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.createBusinessConduitAssignment\"}" } } }, { "name": "Activate an offered business conduit assignment", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/activation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.activateBusinessConduitAssignment\"}" } } }, { "name": "Initiate an interaction from a single-use opaque capture", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/interactions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.initiateBusinessConduitInteraction\"}" } } }, { "name": "Revalidate an assignment against current Party and policy authority", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/revalidation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.revalidateBusinessConduitAssignment\"}" } } }, { "name": "Revoke an assignment and its active interactions", "disabled": true, "request": { "description": "POST /assignments/{assignmentRef}/revocation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.revokeBusinessConduitAssignment\"}" } } }, { "name": "Get a UI-safe interaction projection", "disabled": true, "request": { "description": "GET /interactions/{interactionRef}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.getBusinessConduitInteraction\"}" } } }, { "name": "Select an eligible business account", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/account. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.selectBusinessConduitAccount\"}" } } }, { "name": "Submit an approval decision bound to the current interaction revision", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/approval. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.submitBusinessConduitApproval\"}" } } }, { "name": "Execute an approved interaction in the target business wallet", "disabled": true, "request": { "description": "POST /interactions/{interactionRef}/execution. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"business-conduit.executeBusinessConduitInteraction\"}" } } } ] } ] }, { "name": "catalog", "description": "Operations associated with the catalog guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "catalog-operations", "description": "catalog-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List catalogs", "disabled": true, "request": { "description": "GET /catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.listCatalogs\"}" } } }, { "name": "Create a catalog", "disabled": true, "request": { "description": "POST /catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.createCatalog\"}" } } }, { "name": "Get a catalog", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.getCatalog\"}" } } }, { "name": "Update a catalog", "disabled": true, "request": { "description": "PUT /catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.updateCatalog\"}" } } }, { "name": "Disable a catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/disable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.disableCatalog\"}" } } }, { "name": "Import a remote TS 11 catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/imports/remote. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.importRemoteCatalog\"}" } } }, { "name": "Import a rulebook-catalog tree", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/imports/rulebooks. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.importRulebooks\"}" } } }, { "name": "Publish a catalog", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.publishCatalog\"}" } } }, { "name": "List SchemaMeta entries in a catalog", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}/schemas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.listSchemas\"}" } } }, { "name": "Author a SchemaMeta", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/schemas. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.createSchema\"}" } } }, { "name": "Link a hosted VCT or credential design", "disabled": true, "request": { "description": "POST /catalogs/{catalogId}/schemas/link. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.linkSchema\"}" } } }, { "name": "Delete a SchemaMeta", "disabled": true, "request": { "description": "DELETE /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.deleteSchema\"}" } } }, { "name": "Get SchemaMeta", "disabled": true, "request": { "description": "GET /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.getSchema\"}" } } }, { "name": "Update a SchemaMeta", "disabled": true, "request": { "description": "PUT /catalogs/{catalogId}/schemas/{schemaId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"catalog.updateSchema\"}" } } } ] } ] }, { "name": "connector", "description": "Operations associated with the connector guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "connector-operations", "description": "connector-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List connector instances", "disabled": true, "request": { "description": "Lists connector instances registered for the tenant. Use this endpoint to find durable\nintegration endpoints by connector family, data-flow role, or logical operation support.\nA connector instance is not itself a resource shape; resource descriptors and operation\nbindings describe what the connector can read or write.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorInstances\"}" } } }, { "name": "Create a connector instance", "disabled": true, "request": { "description": "Creates the connector instance. The create body carries no identity assignments;\nconnector Party identities are managed separately through the connector identity\nendpoints and the Party APIs.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorInstance\"}" } } }, { "name": "Delete a connector instance", "disabled": true, "request": { "description": "Deletes or tombstones the connector registration according to the runtime implementation.\nThis removes the connector registry entry, but implementations should treat Party,\nIdentity, Identifier, audit, and historical run data according to their own retention rules.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.deleteConnectorInstance\"}" } } }, { "name": "Get a connector instance", "disabled": true, "request": { "description": "Reads one connector instance, including its backing Party id, assigned identities,\nendpoint references, credential references, settings bindings, and default policies.\nSecret values are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getConnectorInstance\"}" } } }, { "name": "Update a connector instance", "disabled": true, "request": { "description": "Updates connector instance metadata, lifecycle state, supported operations, and default\npolicies. Use lifecycleStatus=SUSPENDED to stop new route runs without deleting durable\nconfiguration or Party identity information.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.updateConnectorInstance\"}" } } }, { "name": "Discover connector resources", "disabled": true, "request": { "description": "Runs connector discovery and returns suggested resource descriptors and operation hints.\nDiscovery results are advisory; callers must create resource descriptors and operation\nbindings explicitly before routes can use them.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorDiscoveryRun\"}" } } }, { "name": "Check connector health", "disabled": true, "request": { "description": "Performs a health check for the connector instance and optionally its dependencies, such as\nendpoint reachability, credentials, contract availability, or operation-specific readiness.\nThe health result is observational and does not change connector lifecycle status.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorHealthCheck\"}" } } }, { "name": "List connector identities", "disabled": true, "request": { "description": "Lists identities assigned to the connector's backing Party. Identifiers are returned nested\nunder each identity, preserving the Party -> Identity -> Identifier model.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorIdentities\"}" } } }, { "name": "List resources attached to a connector", "disabled": true, "request": { "description": "Lists resource descriptors attached to a connector instance for source and destination use.\nThe attached resource adds connector-local access details such as external resource name,\nendpoint id, and access protocol; the descriptor remains the reusable logical data shape.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorResources\"}" } } }, { "name": "Attach a resource descriptor to a connector", "disabled": true, "request": { "description": "Attaches a reusable resource descriptor to a connector instance. For example, the same\nemployee profile descriptor can be attached to an HTTP/OpenAPI connector over HTTPS, a CSV\nresource accessed over VAULT, and a SQL connector accessed over JDBC without changing the descriptor.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.attachConnectorResource\"}" } } }, { "name": "List connector data product descriptors", "disabled": true, "request": { "description": "Lists connector data product descriptors. These registry records connect a logical binding\nand physical connector instance to dataset resource descriptors, selected field scopes,\ntransfer types, provider and consumer Party references, governance scope, and catalog offer\nreferences. This is the Phase 5 dataspace/data-use-contract readiness surface; it does not\nimplement DSP/DCAT runtime behavior by itself.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listDataProductDescriptors\"}" } } }, { "name": "Create a connector data product descriptor", "disabled": true, "request": { "description": "Creates or replaces a connector data product descriptor. The descriptor must reference an\nexisting logical connection binding, matching physical connector instance, known dataset\nresource descriptors, at least one transfer type, and at least one catalog offer policy ref.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createDataProductDescriptor\"}" } } }, { "name": "Get a connector data product descriptor", "disabled": true, "request": { "description": "Reads one connector data product descriptor by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getDataProductDescriptor\"}" } } }, { "name": "List connector invocation bindings", "disabled": true, "request": { "description": "Lists persisted invocation bindings that connect product or protocol lifecycle stages to\nconnector routes, operations, logical connection bindings, subset mappings, governance, and\nexecution policies. These records are the registry surface used when an issuer, verifier,\nform, portal, or workflow needs a durable connector action at a named stage.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorInvocationBindings\"}" } } }, { "name": "Create a connector invocation binding", "disabled": true, "request": { "description": "Creates or replaces a durable invocation binding for a product or protocol lifecycle stage.\nThe stored binding carries the physical or logical connector target, subset mapping,\ngovernance metadata, Party anchors, materialization policy, and execution policy that the\nruntime will attach to resulting connector runs.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorInvocationBinding\"}" } } }, { "name": "Get a connector invocation binding", "disabled": true, "request": { "description": "Reads one persisted invocation binding by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getConnectorInvocationBinding\"}" } } }, { "name": "List logical connection bindings", "disabled": true, "request": { "description": "Lists logical usage bindings for physical connector instances. Logical bindings let one\nconnector instance be safely reused across tenants, organization units, brands, legal\nentities, channels, and caller contexts while keeping discriminator, auth overlay,\ngovernance, and catalog projection metadata explicit.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listLogicalConnectionBindings\"}" } } }, { "name": "Create a logical connection binding", "disabled": true, "request": { "description": "Creates or replaces a logical connection binding for a physical connector instance. Use this\nresource to declare tenant, OU, brand, channel, caller, auth overlay, grant, governance, and\nsystem-catalog projection metadata without duplicating the physical connector registration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createLogicalConnectionBinding\"}" } } }, { "name": "Get a logical connection binding", "disabled": true, "request": { "description": "Reads one logical connection binding by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getLogicalConnectionBinding\"}" } } }, { "name": "List operation bindings", "disabled": true, "request": { "description": "Lists connector operation bindings. Operation bindings connect connector instances,\nattached resources, logical operation kinds, connector-local operation names, protocols,\ntransformations, delivery behavior, and egress policies.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listOperationBindings\"}" } } }, { "name": "Create an operation binding", "disabled": true, "request": { "description": "Creates a source or destination operation binding. A source READ binding can later be\npaired with a destination WRITE binding in a route, optionally with a transformation\nbetween their resource descriptors.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createOperationBinding\"}" } } }, { "name": "Delete an operation binding", "disabled": true, "request": { "description": "Deletes an operation binding. Implementations should reject deletion while active routes\nstill depend on the binding, or require those routes to be updated first.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.deleteOperationBinding\"}" } } }, { "name": "Get an operation binding", "disabled": true, "request": { "description": "Reads one operation binding, including connector-local operation name, protocol, request\nand response descriptors, transformation reference, delivery settings, and egress policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getOperationBinding\"}" } } }, { "name": "Update an operation binding", "disabled": true, "request": { "description": "Updates an operation binding without changing unrelated connector or resource descriptor\nstate. Use this for contract changes, renamed operation ids, updated delivery policies,\nor new transformation references.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.updateOperationBinding\"}" } } }, { "name": "List resource descriptors", "disabled": true, "request": { "description": "Lists reusable resource descriptors. Descriptors describe the logical resource, data\nrepresentation, structural contract, fields, semantic bindings, sensitivity, and retention\nhints independently from connector transport.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listResourceDescriptors\"}" } } }, { "name": "Create a resource descriptor", "disabled": true, "request": { "description": "Creates a reusable descriptor for data that can flow through connectors. Use this for CSV\nrows, REST payloads, OIDC claim sets, SQL tables, vault objects, forms, workflow payloads,\ncredentials, presentations, and future resource types.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createResourceDescriptor\"}" } } }, { "name": "Get a resource descriptor", "disabled": true, "request": { "description": "Reads one resource descriptor including field metadata, contract reference, representation,\nand semantic/governance hints. The descriptor does not contain connector credentials or\ntransport endpoint details.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getResourceDescriptor\"}" } } }, { "name": "Update a resource descriptor", "disabled": true, "request": { "description": "Updates descriptor metadata, resource classification, representation, contract reference,\nor governance metadata. Field-level changes are managed through the fields subresource.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.updateResourceDescriptor\"}" } } }, { "name": "List resource descriptor fields", "disabled": true, "request": { "description": "Lists fields declared for a resource descriptor. Fields carry path/column names, value\ntype hints, required/multi-valued semantics, business-term references, sensitivity,\nand optional retention metadata.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listFieldDescriptors\"}" } } }, { "name": "Add a field descriptor", "disabled": true, "request": { "description": "Adds a field to a descriptor. Use this to document a CSV column, JSON path, SQL column,\nOIDC claim, form field, credential claim, or presentation attribute that can be validated,\nmapped, governed, or transformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createFieldDescriptor\"}" } } }, { "name": "List route exposure descriptors", "disabled": true, "request": { "description": "Lists externally callable route exposure descriptors. Exposure descriptors are registry\nrecords for external read/write capabilities, including accepted auth methods, caller Party\nand relationship constraints, schemas, subset mapping, payload/rate limits, and audit category.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listRouteExposureDescriptors\"}" } } }, { "name": "Create a route exposure descriptor", "disabled": true, "request": { "description": "Creates or replaces a route exposure descriptor for an externally initiated connector\ncapability. This registers the externally callable surface but does not by itself implement\nthe runtime endpoint for the external caller.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createRouteExposureDescriptor\"}" } } }, { "name": "Get a route exposure descriptor", "disabled": true, "request": { "description": "Reads one route exposure descriptor by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getRouteExposureDescriptor\"}" } } }, { "name": "List route exposure grants", "disabled": true, "request": { "description": "GET /route/exposures/{exposureDescriptorId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listRouteExposureGrants\"}" } } }, { "name": "Create a route exposure grant", "disabled": true, "request": { "description": "POST /route/exposures/{exposureDescriptorId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createRouteExposureGrant\"}" } } }, { "name": "Get a route exposure grant", "disabled": true, "request": { "description": "GET /route/exposures/{exposureDescriptorId}/grants/{grantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getRouteExposureGrant\"}" } } }, { "name": "Execute an externally initiated route exposure read", "disabled": true, "request": { "description": "Executes an explicitly registered external-read route exposure. The caller supplies the\nauthenticated Party context, governed canonical fields already eligible for projection,\ngovernance metadata and optional cursor state. VDX evaluates policy server-side before\nany grant or throttle consumption. The response is an\napproved governed view with manifest, policy lineage, selected fields, and cursor state.\nThis endpoint does not expose internal connector records, Party tables, vault rows, or\nsemantic stores directly.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.executeRouteExposureRead\"}" } } }, { "name": "Execute an externally initiated route exposure write", "disabled": true, "request": { "description": "Executes an explicitly registered external-write route exposure. The caller supplies the\nauthenticated Party context, governed payload envelope, field mappings, governance metadata,\ngovernance metadata, optional idempotency key, and optional Party projection candidates.\nVDX evaluates policy server-side before any grant or throttle consumption. The\nresponse is an accepted, minimized, redacted, quarantined, or rejected governed-ingress\nreceipt with canonical-field mapping, projection-candidate ids, policy lineage, idempotency\nresult, payload hash, and later-use availability scope.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.executeRouteExposureWrite\"}" } } }, { "name": "List connector routes", "disabled": true, "request": { "description": "Lists routes that compose source bindings, destination bindings, optional transformations,\ntriggers, delivery policy, materialization policy, and atomicity. Routes are the durable\nregistry shape for import/export, issuance enrichment, form capture, and workflow\ndata movement.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorRoutes\"}" } } }, { "name": "Create a connector route", "disabled": true, "request": { "description": "Creates a route from one or more source operation bindings to one or more destination operation bindings.\nThe route can be on-demand, scheduled, event-triggered, webhook-triggered, or started by a\nhigher-level platform pipeline.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorRoute\"}" } } }, { "name": "Delete a connector route", "disabled": true, "request": { "description": "Deletes a route definition. Historical runs, events, and dead letters should remain subject\nto audit and retention policies even when the route definition is removed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.deleteConnectorRoute\"}" } } }, { "name": "Get a connector route", "disabled": true, "request": { "description": "Reads one route definition. Use this before starting a run when a UI or orchestrator needs\nto show the effective source, destination, transformation, trigger, materialization, and\natomicity policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getConnectorRoute\"}" } } }, { "name": "Update a connector route", "disabled": true, "request": { "description": "Updates a route definition. Implementations should avoid mutating routes that are currently\nrunning unless they snapshot the effective route definition into each run.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.updateConnectorRoute\"}" } } }, { "name": "List connector route runs", "disabled": true, "request": { "description": "Lists execution history for one connector route. Use this route-scoped view when a route\ndetail screen or orchestrator needs only runs belonging to the selected route. Tenant-wide\noperational dashboards should use `/runs` and its filters.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorRouteRuns\"}" } } }, { "name": "Start a connector route run", "disabled": true, "request": { "description": "Starts a route run and returns the accepted execution record. The optional input can carry\nlookup keys, batch references, dry-run flags, or caller metadata. Long-running execution is\nobserved through the runs, events, and dead-letter endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createConnectorRouteRun\"}" } } }, { "name": "List connector runs", "disabled": true, "request": { "description": "Lists route and operation runs across the tenant. Use this direct tenant-wide run resource\nfor operational dashboards, customer support, audit trails, retry decisions, and monitoring\nfailed or partially failed imports and exports. Use `/routes/{routeId}/runs` for\nroute-scoped history.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorRuns\"}" } } }, { "name": "Get a connector run", "disabled": true, "request": { "description": "Reads one connector execution record, including status, timestamps, counts, correlation id,\nand error summary. Detailed logs are exposed as run events.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getConnectorRun\"}" } } }, { "name": "List connector dead letters", "disabled": true, "request": { "description": "Lists failed items captured for a run after validation, transformation, or destination\ndelivery failure. Dead letters should reference retained payloads rather than embedding\nthem by default so retention and sensitivity policy can control access.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorDeadLetters\"}" } } }, { "name": "List connector run events", "disabled": true, "request": { "description": "Lists timestamped run events emitted by the connector runtime. Events should contain enough\ndetail for support and audit without embedding sensitive payloads unless policy permits it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listConnectorRunEvents\"}" } } }, { "name": "List semantic connector bindings", "disabled": true, "request": { "description": "Lists semantic bindings for connector resources and fields. These bindings let the platform\nunderstand that an external field represents an employee email, SSN, customer id, supplier\nrelationship, policy classification, or other semantic concept.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listSemanticConnectorBindings\"}" } } }, { "name": "Create a semantic connector binding", "disabled": true, "request": { "description": "Creates a semantic binding for a connector resource or field. This is the link that allows\nvalidation, documentation, mapping, and future policy checks to reason over external data\nusing the same semantic model as credential designs, forms, parties, and relationships.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createSemanticConnectorBinding\"}" } } }, { "name": "List transformations", "disabled": true, "request": { "description": "Lists reusable transformations between resource descriptors. Transformations can represent\nexisting attribute mappers, expression-based mappings, template mappings, redaction steps,\nlookup steps, or future workflow-specific transformation engines.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.listTransformations\"}" } } }, { "name": "Create a transformation", "disabled": true, "request": { "description": "Creates a transformation definition. Use this when a route must map a source representation\nto a destination representation, such as CSV employee rows to credential claims, REST HR\nprofiles to invitation payloads, or OIDC claims to a semantic profile.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.createTransformation\"}" } } }, { "name": "Get a transformation", "disabled": true, "request": { "description": "Reads one transformation definition, including source and target descriptors, step-based\nmappings, expression text, and metadata used by the runtime mapper.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.getTransformation\"}" } } }, { "name": "Update a transformation", "disabled": true, "request": { "description": "Updates transformation metadata, descriptor references, steps, or expression text. Route\nimplementations should version or snapshot transformations when repeatable historical\nexecution is required.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector.updateTransformation\"}" } } } ] } ] }, { "name": "connector-integration", "description": "Operations associated with the connector-integration guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "connector-integration-operations", "description": "connector-integration-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List connector instances", "disabled": true, "request": { "description": "Lists connector instances registered for the tenant. Use this endpoint to find durable\nintegration endpoints by connector family, data-flow role, or logical operation support.\nA connector instance is not itself a resource shape; resource descriptors and operation\nbindings describe what the connector can read or write.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorInstances\"}" } } }, { "name": "Create a connector instance", "disabled": true, "request": { "description": "Creates the connector instance. The create body carries no identity assignments;\nconnector Party identities are managed separately through the connector identity\nendpoints and the Party APIs.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorInstance\"}" } } }, { "name": "Delete a connector instance", "disabled": true, "request": { "description": "Deletes or tombstones the connector registration according to the runtime implementation.\nThis removes the connector registry entry, but implementations should treat Party,\nIdentity, Identifier, audit, and historical run data according to their own retention rules.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.deleteConnectorInstance\"}" } } }, { "name": "Get a connector instance", "disabled": true, "request": { "description": "Reads one connector instance, including its backing Party id, assigned identities,\nendpoint references, credential references, settings bindings, and default policies.\nSecret values are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getConnectorInstance\"}" } } }, { "name": "Update a connector instance", "disabled": true, "request": { "description": "Updates connector instance metadata, lifecycle state, supported operations, and default\npolicies. Use lifecycleStatus=SUSPENDED to stop new route runs without deleting durable\nconfiguration or Party identity information.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.updateConnectorInstance\"}" } } }, { "name": "Discover connector resources", "disabled": true, "request": { "description": "Runs connector discovery and returns suggested resource descriptors and operation hints.\nDiscovery results are advisory; callers must create resource descriptors and operation\nbindings explicitly before routes can use them.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorDiscoveryRun\"}" } } }, { "name": "Check connector health", "disabled": true, "request": { "description": "Performs a health check for the connector instance and optionally its dependencies, such as\nendpoint reachability, credentials, contract availability, or operation-specific readiness.\nThe health result is observational and does not change connector lifecycle status.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorHealthCheck\"}" } } }, { "name": "List resources attached to a connector", "disabled": true, "request": { "description": "Lists resource descriptors attached to a connector instance for source and destination use.\nThe attached resource adds connector-local access details such as external resource name,\nendpoint id, and access protocol; the descriptor remains the reusable logical data shape.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorResources\"}" } } }, { "name": "Attach a resource descriptor to a connector", "disabled": true, "request": { "description": "Attaches a reusable resource descriptor to a connector instance. For example, the same\nemployee profile descriptor can be attached to an HTTP/OpenAPI connector over HTTPS, a CSV\nresource accessed over VAULT, and a SQL connector accessed over JDBC without changing the descriptor.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.attachConnectorResource\"}" } } }, { "name": "List connector data product descriptors", "disabled": true, "request": { "description": "Lists connector data product descriptors. These registry records connect a logical binding\nand physical connector instance to dataset resource descriptors, selected field scopes,\ntransfer types, provider and consumer Party references, governance scope, and catalog offer\nreferences. This is the Phase 5 dataspace/data-use-contract readiness surface; it does not\nimplement DSP/DCAT runtime behavior by itself.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listDataProductDescriptors\"}" } } }, { "name": "Create a connector data product descriptor", "disabled": true, "request": { "description": "Creates or replaces a connector data product descriptor. The descriptor must reference an\nexisting logical connection binding, matching physical connector instance, known dataset\nresource descriptors, at least one transfer type, and at least one catalog offer policy ref.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createDataProductDescriptor\"}" } } }, { "name": "Get a connector data product descriptor", "disabled": true, "request": { "description": "Reads one connector data product descriptor by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getDataProductDescriptor\"}" } } }, { "name": "List connector invocation bindings", "disabled": true, "request": { "description": "Lists persisted invocation bindings that connect product or protocol lifecycle stages to\nconnector routes, operations, logical connection bindings, subset mappings, governance, and\nexecution policies. These records are the registry surface used when an issuer, verifier,\nform, portal, or workflow needs a durable connector action at a named stage.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorInvocationBindings\"}" } } }, { "name": "Create a connector invocation binding", "disabled": true, "request": { "description": "Creates or replaces a durable invocation binding for a product or protocol lifecycle stage.\nThe stored binding carries the physical or logical connector target, subset mapping,\ngovernance metadata, Party anchors, materialization policy, and execution policy that the\nruntime will attach to resulting connector runs.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorInvocationBinding\"}" } } }, { "name": "Get a connector invocation binding", "disabled": true, "request": { "description": "Reads one persisted invocation binding by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getConnectorInvocationBinding\"}" } } }, { "name": "List logical connection bindings", "disabled": true, "request": { "description": "Lists logical usage bindings for physical connector instances. Logical bindings let one\nconnector instance be safely reused across tenants, organization units, brands, legal\nentities, channels, and caller contexts while keeping discriminator, auth overlay,\ngovernance, and catalog projection metadata explicit.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listLogicalConnectionBindings\"}" } } }, { "name": "Create a logical connection binding", "disabled": true, "request": { "description": "Creates or replaces a logical connection binding for a physical connector instance. Use this\nresource to declare tenant, OU, brand, channel, caller, auth overlay, grant, governance, and\nsystem-catalog projection metadata without duplicating the physical connector registration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createLogicalConnectionBinding\"}" } } }, { "name": "Get a logical connection binding", "disabled": true, "request": { "description": "Reads one logical connection binding by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getLogicalConnectionBinding\"}" } } }, { "name": "List operation bindings", "disabled": true, "request": { "description": "Lists connector operation bindings. Operation bindings connect connector instances,\nattached resources, logical operation kinds, connector-local operation names, protocols,\ntransformations, delivery behavior, and egress policies.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listOperationBindings\"}" } } }, { "name": "Create an operation binding", "disabled": true, "request": { "description": "Creates a source or destination operation binding. A source READ binding can later be\npaired with a destination WRITE binding in a route, optionally with a transformation\nbetween their resource descriptors.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createOperationBinding\"}" } } }, { "name": "Delete an operation binding", "disabled": true, "request": { "description": "Deletes an operation binding. Implementations should reject deletion while active routes\nstill depend on the binding, or require those routes to be updated first.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.deleteOperationBinding\"}" } } }, { "name": "Get an operation binding", "disabled": true, "request": { "description": "Reads one operation binding, including connector-local operation name, protocol, request\nand response descriptors, transformation reference, delivery settings, and egress policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getOperationBinding\"}" } } }, { "name": "Update an operation binding", "disabled": true, "request": { "description": "Updates an operation binding without changing unrelated connector or resource descriptor\nstate. Use this for contract changes, renamed operation ids, updated delivery policies,\nor new transformation references.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.updateOperationBinding\"}" } } }, { "name": "List resource descriptors", "disabled": true, "request": { "description": "Lists reusable resource descriptors. Descriptors describe the logical resource, data\nrepresentation, structural contract, fields, semantic bindings, sensitivity, and retention\nhints independently from connector transport.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listResourceDescriptors\"}" } } }, { "name": "Create a resource descriptor", "disabled": true, "request": { "description": "Creates a reusable descriptor for data that can flow through connectors. Use this for CSV\nrows, REST payloads, OIDC claim sets, SQL tables, vault objects, forms, workflow payloads,\ncredentials, presentations, and future resource types.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createResourceDescriptor\"}" } } }, { "name": "Get a resource descriptor", "disabled": true, "request": { "description": "Reads one resource descriptor including field metadata, contract reference, representation,\nand semantic/governance hints. The descriptor does not contain connector credentials or\ntransport endpoint details.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getResourceDescriptor\"}" } } }, { "name": "Update a resource descriptor", "disabled": true, "request": { "description": "Updates descriptor metadata, resource classification, representation, contract reference,\nor governance metadata. Field-level changes are managed through the fields subresource.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.updateResourceDescriptor\"}" } } }, { "name": "List resource descriptor fields", "disabled": true, "request": { "description": "Lists fields declared for a resource descriptor. Fields carry path/column names, value\ntype hints, required/multi-valued semantics, business-term references, sensitivity,\nand optional retention metadata.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listFieldDescriptors\"}" } } }, { "name": "Add a field descriptor", "disabled": true, "request": { "description": "Adds a field to a descriptor. Use this to document a CSV column, JSON path, SQL column,\nOIDC claim, form field, credential claim, or presentation attribute that can be validated,\nmapped, governed, or transformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createFieldDescriptor\"}" } } }, { "name": "List route exposure descriptors", "disabled": true, "request": { "description": "Lists externally callable route exposure descriptors. Exposure descriptors are registry\nrecords for external read/write capabilities, including accepted auth methods, caller Party\nand relationship constraints, schemas, subset mapping, payload/rate limits, and audit category.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listRouteExposureDescriptors\"}" } } }, { "name": "Create a route exposure descriptor", "disabled": true, "request": { "description": "Creates or replaces a route exposure descriptor for an externally initiated connector\ncapability. This registers the externally callable surface but does not by itself implement\nthe runtime endpoint for the external caller.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createRouteExposureDescriptor\"}" } } }, { "name": "Get a route exposure descriptor", "disabled": true, "request": { "description": "Reads one route exposure descriptor by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getRouteExposureDescriptor\"}" } } }, { "name": "List route exposure grants", "disabled": true, "request": { "description": "GET /route/exposures/{exposureDescriptorId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listRouteExposureGrants\"}" } } }, { "name": "Create a route exposure grant", "disabled": true, "request": { "description": "POST /route/exposures/{exposureDescriptorId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createRouteExposureGrant\"}" } } }, { "name": "Get a route exposure grant", "disabled": true, "request": { "description": "GET /route/exposures/{exposureDescriptorId}/grants/{grantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getRouteExposureGrant\"}" } } }, { "name": "Execute an externally initiated route exposure read", "disabled": true, "request": { "description": "Executes an explicitly registered external-read route exposure. The caller supplies the\nauthenticated Party context, governed canonical fields already eligible for projection,\ngovernance metadata and optional cursor state. VDX evaluates policy server-side before\nany grant or throttle consumption. The response is an\napproved governed view with manifest, policy lineage, selected fields, and cursor state.\nThis endpoint does not expose internal connector records, Party tables, vault rows, or\nsemantic stores directly.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.executeRouteExposureRead\"}" } } }, { "name": "Execute an externally initiated route exposure write", "disabled": true, "request": { "description": "Executes an explicitly registered external-write route exposure. The caller supplies the\nauthenticated Party context, governed payload envelope, field mappings, governance metadata,\ngovernance metadata, optional idempotency key, and optional Party projection candidates.\nVDX evaluates policy server-side before any grant or throttle consumption. The\nresponse is an accepted, minimized, redacted, quarantined, or rejected governed-ingress\nreceipt with canonical-field mapping, projection-candidate ids, policy lineage, idempotency\nresult, payload hash, and later-use availability scope.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.executeRouteExposureWrite\"}" } } }, { "name": "List connector routes", "disabled": true, "request": { "description": "Lists routes that compose source bindings, destination bindings, optional transformations,\ntriggers, delivery policy, materialization policy, and atomicity. Routes are the durable\nregistry shape for import/export, issuance enrichment, form capture, and workflow\ndata movement.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorRoutes\"}" } } }, { "name": "Create a connector route", "disabled": true, "request": { "description": "Creates a route from one or more source operation bindings to one or more destination operation bindings.\nThe route can be on-demand, scheduled, event-triggered, webhook-triggered, or started by a\nhigher-level platform pipeline.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorRoute\"}" } } }, { "name": "Delete a connector route", "disabled": true, "request": { "description": "Deletes a route definition. Historical runs, events, and dead letters should remain subject\nto audit and retention policies even when the route definition is removed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.deleteConnectorRoute\"}" } } }, { "name": "Get a connector route", "disabled": true, "request": { "description": "Reads one route definition. Use this before starting a run when a UI or orchestrator needs\nto show the effective source, destination, transformation, trigger, materialization, and\natomicity policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getConnectorRoute\"}" } } }, { "name": "Update a connector route", "disabled": true, "request": { "description": "Updates a route definition. Implementations should avoid mutating routes that are currently\nrunning unless they snapshot the effective route definition into each run.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.updateConnectorRoute\"}" } } }, { "name": "List connector route runs", "disabled": true, "request": { "description": "Lists execution history for one connector route. Use this route-scoped view when a route\ndetail screen or orchestrator needs only runs belonging to the selected route. Tenant-wide\noperational dashboards should use `/runs` and its filters.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorRouteRuns\"}" } } }, { "name": "Start a connector route run", "disabled": true, "request": { "description": "Starts a route run and returns the accepted execution record. The optional input can carry\nlookup keys, batch references, dry-run flags, or caller metadata. Long-running execution is\nobserved through the runs, events, and dead-letter endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createConnectorRouteRun\"}" } } }, { "name": "List connector runs", "disabled": true, "request": { "description": "Lists route and operation runs across the tenant. Use this direct tenant-wide run resource\nfor operational dashboards, customer support, audit trails, retry decisions, and monitoring\nfailed or partially failed imports and exports. Use `/routes/{routeId}/runs` for\nroute-scoped history.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorRuns\"}" } } }, { "name": "Get a connector run", "disabled": true, "request": { "description": "Reads one connector execution record, including status, timestamps, counts, correlation id,\nand error summary. Detailed logs are exposed as run events.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getConnectorRun\"}" } } }, { "name": "List connector dead letters", "disabled": true, "request": { "description": "Lists failed items captured for a run after validation, transformation, or destination\ndelivery failure. Dead letters should reference retained payloads rather than embedding\nthem by default so retention and sensitivity policy can control access.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorDeadLetters\"}" } } }, { "name": "List connector run events", "disabled": true, "request": { "description": "Lists timestamped run events emitted by the connector runtime. Events should contain enough\ndetail for support and audit without embedding sensitive payloads unless policy permits it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listConnectorRunEvents\"}" } } }, { "name": "List semantic connector bindings", "disabled": true, "request": { "description": "Lists semantic bindings for connector resources and fields. These bindings let the platform\nunderstand that an external field represents an employee email, SSN, customer id, supplier\nrelationship, policy classification, or other semantic concept.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listSemanticConnectorBindings\"}" } } }, { "name": "Create a semantic connector binding", "disabled": true, "request": { "description": "Creates a semantic binding for a connector resource or field. This is the link that allows\nvalidation, documentation, mapping, and future policy checks to reason over external data\nusing the same semantic model as credential designs, forms, parties, and relationships.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createSemanticConnectorBinding\"}" } } }, { "name": "List transformations", "disabled": true, "request": { "description": "Lists reusable transformations between resource descriptors. Transformations can represent\nexisting attribute mappers, expression-based mappings, template mappings, redaction steps,\nlookup steps, or future workflow-specific transformation engines.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.listTransformations\"}" } } }, { "name": "Create a transformation", "disabled": true, "request": { "description": "Creates a transformation definition. Use this when a route must map a source representation\nto a destination representation, such as CSV employee rows to credential claims, REST HR\nprofiles to invitation payloads, or OIDC claims to a semantic profile.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.createTransformation\"}" } } }, { "name": "Get a transformation", "disabled": true, "request": { "description": "Reads one transformation definition, including source and target descriptors, step-based\nmappings, expression text, and metadata used by the runtime mapper.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.getTransformation\"}" } } }, { "name": "Update a transformation", "disabled": true, "request": { "description": "Updates transformation metadata, descriptor references, steps, or expression text. Route\nimplementations should version or snapshot transformations when repeatable historical\nexecution is required.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"connector-integration.updateTransformation\"}" } } } ] } ] }, { "name": "credential-design", "description": "Operations associated with the credential-design guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "credential-design-operations", "description": "credential-design-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List tenant design assets", "disabled": true, "request": { "description": "Lists the caller-tenant's content-addressed, design-agnostic design asset blobs. Optional `assetType` and `contentType` query filters narrow the result. Note that a content-addressed asset stores no asset-type segment, so `assetType` is applied loosely by content-type family (`PDF_TEMPLATE` -> `application/pdf`, `SVG_TEMPLATE` -> `image/svg+xml`, `LOGO` / `BACKGROUND_IMAGE` -> any `image/*`); `contentType` matches by content-type prefix.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listDesignAssets\"}" } } }, { "name": "Upload a tenant design asset", "disabled": true, "request": { "description": "Uploads a design-agnostic, tenant-scoped branding asset as raw bytes. The asset is content-addressed (SHA-256) and deduped within the tenant; the stored content type is taken from the request `Content-Type` header. The `assetType` path segment is informational and does not affect the storage key. Returns a reference to the stored asset.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.uploadTenantAsset\"}" } } }, { "name": "List credential designs", "disabled": true, "request": { "description": "Returns every credential design in the caller's tenant that matches the optional filters, as a plain array.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listCredentialDesigns\"}" } } }, { "name": "Create a credential design", "disabled": true, "request": { "description": "Creates a credential design in the caller's tenant. Fails with `409` if a binding already maps to a design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createCredentialDesign\"}" } } }, { "name": "Find credential designs by binding key", "disabled": true, "request": { "description": "Returns the credential designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findCredentialDesignsByBindingKey\"}" } } }, { "name": "Find credential designs by binding", "disabled": true, "request": { "description": "Returns the credential designs whose bindings match the supplied binding object across every set dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findCredentialDesignsByBinding\"}" } } }, { "name": "Import a credential design", "disabled": true, "request": { "description": "Fetches an external credential design from `sourceUrl`, snapshots the response, maps it for the declared `sourceType`, and persists the canonical design with `hostingMode` set to `CACHED_EXTERNAL`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importCredentialDesign\"}" } } }, { "name": "Resolve a credential design", "disabled": true, "request": { "description": "Resolves a credential design selected by `designId`, a full `binding`, or a `bindingKey` + `bindingValue` pair, returning the merged design with its issuer and verifier designs, render variants, derived hints, applied layers, locked fields, and an ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveCredentialDesign\"}" } } }, { "name": "Delete a credential design", "disabled": true, "request": { "description": "Deletes a credential design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteCredentialDesign\"}" } } }, { "name": "Get a credential design", "disabled": true, "request": { "description": "Returns one credential design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getCredentialDesign\"}" } } }, { "name": "Update a credential design", "disabled": true, "request": { "description": "Updates a credential design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateCredentialDesign\"}" } } }, { "name": "Download a design asset", "disabled": true, "request": { "description": "Returns the raw bytes of a stored branding asset. The response `Content-Type` is whatever the asset was stored as (for example `image/png`, `image/svg+xml`, or `application/pdf`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getDesignAsset\"}" } } }, { "name": "Upload a design asset", "disabled": true, "request": { "description": "Uploads a branding asset for a credential design as raw bytes. The asset slot is set by `assetType` and the locale by `locale`; the stored content type is taken from the request `Content-Type` header. Returns a reference to the stored asset.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.uploadDesignAsset\"}" } } }, { "name": "Refresh an imported credential design", "disabled": true, "request": { "description": "Re-fetches an imported credential design from its source and re-applies the mapper, returning the updated design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshCredentialDesign\"}" } } }, { "name": "List credential design versions", "disabled": true, "request": { "description": "Lists immutable snapshots for a credential design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listCredentialDesignVersions\"}" } } }, { "name": "Get credential design version content", "disabled": true, "request": { "description": "Returns the immutable credential design content stored for the requested version.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getCredentialDesignVersion\"}" } } }, { "name": "Restore credential design version", "disabled": true, "request": { "description": "Restores the selected immutable version by copying its content into the credential design and appending a new current version.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.restoreCredentialDesignVersion\"}" } } }, { "name": "List issuer designs", "disabled": true, "request": { "description": "Returns the issuer designs in the caller's tenant matching the optional filters.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listIssuerDesigns\"}" } } }, { "name": "Create an issuer design", "disabled": true, "request": { "description": "Creates an issuer design in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createIssuerDesign\"}" } } }, { "name": "Find issuer designs by binding key", "disabled": true, "request": { "description": "Returns the issuer designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findIssuerDesignsByBindingKey\"}" } } }, { "name": "Find issuer designs by binding", "disabled": true, "request": { "description": "Returns the issuer designs whose bindings match the supplied binding object.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findIssuerDesignsByBinding\"}" } } }, { "name": "Import an issuer design", "disabled": true, "request": { "description": "Fetches an external issuer design from `sourceUrl`, snapshots and maps it, and persists the canonical issuer design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importIssuerDesign\"}" } } }, { "name": "Resolve an issuer design", "disabled": true, "request": { "description": "Resolves an issuer design selected by id or binding, returning the merged design with its render variants, applied layers, and locked fields.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveIssuerDesign\"}" } } }, { "name": "Delete an issuer design", "disabled": true, "request": { "description": "Deletes an issuer design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteIssuerDesign\"}" } } }, { "name": "Get an issuer design", "disabled": true, "request": { "description": "Returns one issuer design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getIssuerDesign\"}" } } }, { "name": "Update an issuer design", "disabled": true, "request": { "description": "Updates an issuer design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateIssuerDesign\"}" } } }, { "name": "Refresh an imported issuer design", "disabled": true, "request": { "description": "Re-fetches an imported issuer design from its source and re-applies the mapper.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshIssuerDesign\"}" } } }, { "name": "List render variants", "disabled": true, "request": { "description": "Returns the render variants in the caller's tenant, optionally narrowed by alias substring.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listRenderVariants\"}" } } }, { "name": "Create a render variant", "disabled": true, "request": { "description": "Creates a reusable render variant in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createRenderVariant\"}" } } }, { "name": "Delete a render variant", "disabled": true, "request": { "description": "Deletes a render variant and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteRenderVariant\"}" } } }, { "name": "Get a render variant", "disabled": true, "request": { "description": "Returns one render variant by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getRenderVariant\"}" } } }, { "name": "Update a render variant", "disabled": true, "request": { "description": "Replaces a render variant's content. The body is the same shape used to create one.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateRenderVariant\"}" } } }, { "name": "Get a source snapshot", "disabled": true, "request": { "description": "Returns the metadata and stored payload reference for the snapshot captured when a design was imported.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getSourceSnapshot\"}" } } }, { "name": "Refresh a source snapshot", "disabled": true, "request": { "description": "Re-fetches the snapshot's source, using its stored ETag for a conditional request, and returns the updated snapshot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshSourceSnapshot\"}" } } }, { "name": "List verifier designs", "disabled": true, "request": { "description": "Returns the verifier designs in the caller's tenant matching the optional filters.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.listVerifierDesigns\"}" } } }, { "name": "Create a verifier design", "disabled": true, "request": { "description": "Creates a verifier design in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.createVerifierDesign\"}" } } }, { "name": "Find verifier designs by binding key", "disabled": true, "request": { "description": "Returns the verifier designs whose binding has the given value for a single binding dimension.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findVerifierDesignsByBindingKey\"}" } } }, { "name": "Find verifier designs by binding", "disabled": true, "request": { "description": "Returns the verifier designs whose bindings match the supplied binding object.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.findVerifierDesignsByBinding\"}" } } }, { "name": "Import a verifier design", "disabled": true, "request": { "description": "Fetches an external verifier design from `sourceUrl`, snapshots and maps it, and persists the canonical verifier design.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.importVerifierDesign\"}" } } }, { "name": "Resolve a verifier design", "disabled": true, "request": { "description": "Resolves a verifier design selected by id or binding, returning the merged design with its render variants, applied layers, and locked fields.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.resolveVerifierDesign\"}" } } }, { "name": "Delete a verifier design", "disabled": true, "request": { "description": "Deletes a verifier design and returns no response body when successful.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.deleteVerifierDesign\"}" } } }, { "name": "Get a verifier design", "disabled": true, "request": { "description": "Returns one verifier design by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.getVerifierDesign\"}" } } }, { "name": "Update a verifier design", "disabled": true, "request": { "description": "Updates a verifier design. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.updateVerifierDesign\"}" } } }, { "name": "Refresh an imported verifier design", "disabled": true, "request": { "description": "Re-fetches an imported verifier design from its source and re-applies the mapper.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"credential-design.refreshVerifierDesign\"}" } } }, { "name": "Download a public design asset", "request": { "description": "Serves content-addressed design assets referenced from OID4VCI display metadata and\nSD-JWT VC type metadata, such as logo and background images. The `{asset}` value is the\nhash leaf produced by the design asset upload flow and may include a file extension.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/assets/design/{asset}" } } ] } ] }, { "name": "developer-console", "description": "Operations associated with the developer-console guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "developer-console-runtime", "description": "developer-console-runtime operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get the policy-filtered Postman collection.", "request": { "description": "GET /api/developer-console/v1/artifacts/postman/collection. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/artifacts/postman/collection" } }, { "name": "Get the secret-free Postman environment.", "request": { "description": "GET /api/developer-console/v1/artifacts/postman/environment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/artifacts/postman/environment" } }, { "name": "Forward one allowlisted same-origin Developer Console request.", "disabled": true, "request": { "description": "Resolves route identity and target authority server-side, then forwards only approved request headers and the server-held downstream credential. A prior owner cookie is used when a browser grant session is available; read-only bearer fallback remains host-protected, while mutating calls require the cookie-backed CSRF session. The response is the upstream status/body with a safe response-header allowlist; upstream cookies, redirects, authorization headers, and other hop-by-hop headers are not exposed.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.forwardDeveloperConsoleRequest\"}" } } }, { "name": "Complete and rotate a server-held Developer Console OAuth session.", "disabled": true, "request": { "description": "Completes the allowlisted authorization callback and rotates the opaque server session cookies. Callback data is bounded form data; it never contains caller credentials supplied by this API. The owner cookie is downstream session state from start and is sent automatically when present; it is not a substitute for protected caller authentication.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.completeDeveloperConsoleBffSession\"}" } } }, { "name": "Start a server-held Developer Console OAuth session.", "disabled": true, "request": { "description": "Starts an authorization-code session for an allowlisted mounted route. The server owns the downstream authority, resource, audience, scopes, and opaque session state; the protected host authenticates the caller. This operation creates the downstream owner cookie, so that cookie cannot be the caller-authentication requirement for start.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"application.developer-console.startDeveloperConsoleBffSession\"}" } } }, { "name": "Get safe Developer Console bootstrap metadata.", "request": { "description": "GET /api/developer-console/v1/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/bootstrap" } }, { "name": "Get the policy-filtered mounted API catalog.", "request": { "description": "GET /api/developer-console/v1/catalog. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/catalog" } }, { "name": "Get enabled related testing surfaces.", "request": { "description": "GET /api/developer-console/v1/related-surfaces. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/related-surfaces" } }, { "name": "Get one policy-filtered mounted OpenAPI document.", "request": { "description": "GET /api/developer-console/v1/specs/{specId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/developer-console/v1/specs/{specId}" } } ] } ] }, { "name": "did", "description": "Operations associated with the did guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-operations", "description": "did-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DIDs", "disabled": true, "request": { "description": "Returns a page of local DID records. Filters are applied before\npagination. `role` is parsed from `MANAGED` or `EXTERNAL`; `expand`\naccepts `document`, `keys`, or `all` as a comma-separated query value.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDids\"}" } } }, { "name": "Create a new DID", "disabled": true, "request": { "description": "Creates a MANAGED DID from caller-supplied public JWK material or an\nexisting same-tenant KMS key. `PUBLIC_JWK` never grants server-side\nsigning authority. `KMS` resolves the provider and key within the\nactive tenant and persists a server-side binding. Method-specific\noptions are passed in `options`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.createDid\"}" } } }, { "name": "Track an externally-managed DID", "disabled": true, "request": { "description": "Registers a reference to an externally-managed DID for local tracking.\nOnly the DID string (and optional alias) is persisted; the resolver\nfetches the document and the IDK CacheService holds it. The tracked\nDID always gets `role = EXTERNAL`. KMS key material is never bound to\nexternal DIDs; keys belong to MANAGED DIDs created locally via\n`POST /identifiers`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.trackExternalDid\"}" } } }, { "name": "Delete a DID", "disabled": true, "request": { "description": "Soft-deletes the local DID resource (sets deletedAt timestamp).\nDoes NOT deactivate the DID on the network/ledger. The DID can be\nrecovered by querying with includeDeleted=true. To deactivate a DID\non the network, use the deactivate action instead.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deleteDid\"}" } } }, { "name": "Get DID", "disabled": true, "request": { "description": "Returns a single DID. The default response is the lightweight `Did`\nsummary, the same shape as items in `GET /identifiers`. Use `?expand=document,keys`\n(or `?expand=all`) to include the resolved DID document and KMS key\nmappings inline on the returned object.\n\nSub-resource collections (controllers, also-known-as, equivalent-ids,\nverification methods, verification relationships, services) are\ndeliberately not folded into this response; fetch them via their\ndedicated sub-resource endpoints (`/identifiers/{did}/controllers`,\n`/identifiers/{did}/verification-methods`, etc.).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDid\"}" } } }, { "name": "Partially update a DID", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDid\"}" } } }, { "name": "Replace a DID", "disabled": true, "request": { "description": "Replaces the mutable declarative fields of a DID in one request.\nCollections in the body are full replacement sets. Verification\nmethods and key mappings are intentionally managed through their\ndedicated sub-resource endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.replaceDid\"}" } } }, { "name": "Deactivate a DID", "disabled": true, "request": { "description": "Publishes a deactivation operation to the DID method's network or\nledger. This is irreversible for most DID methods. Sets the\ndeactivated flag to true on the local DID. This is fundamentally\ndifferent from DELETE, which only soft-deletes the local DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.deactivateDid\"}" } } }, { "name": "List also-known-as entries", "disabled": true, "request": { "description": "Lists alternative URIs for the DID subject in DID Core\n`alsoKnownAs` form.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listAlsoKnownAs\"}" } } }, { "name": "Add an also-known-as entry", "disabled": true, "request": { "description": "Adds an also-known-as URI. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `akaUri`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addAlsoKnownAs\"}" } } }, { "name": "Remove an also-known-as entry", "disabled": true, "request": { "description": "Removes one also-known-as entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeAlsoKnownAs\"}" } } }, { "name": "List controllers", "disabled": true, "request": { "description": "Lists controller DID entries for the DID. The response uses the\npublic controller view with row id, controller DID, ordering, and\ntimestamps.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listControllers\"}" } } }, { "name": "Add a controller", "disabled": true, "request": { "description": "Adds a controller DID to the DID. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response\nexposes the value as `controllerDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addController\"}" } } }, { "name": "Remove a controller", "disabled": true, "request": { "description": "Removes one controller entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeController\"}" } } }, { "name": "Get the resolved DID document", "disabled": true, "request": { "description": "Returns the DID document for the given DID. For MANAGED DIDs the document is\nrecomposed from the persisted graph; for EXTERNAL DIDs it is served from the IDK\nCacheService and re-resolved on cache miss.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidDocument\"}" } } }, { "name": "Invalidate the cached DID document", "disabled": true, "request": { "description": "Drops the cached DID document for the given DID, forcing the next\n`GET /identifiers/{did}/document` to re-resolve it from the network/source.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.invalidateDidDocument\"}" } } }, { "name": "Refresh cached DID document", "disabled": true, "request": { "description": "Triggers a fresh resolution of an EXTERNAL DID's document, repopulates the IDK\nCacheService entry, and returns the freshly resolved document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.refreshDidDocument\"}" } } }, { "name": "List equivalent-id entries", "disabled": true, "request": { "description": "Lists equivalent DID identifiers stored for the DID.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listEquivalentIds\"}" } } }, { "name": "Add an equivalent-id entry", "disabled": true, "request": { "description": "Adds an equivalent DID identifier. The request body is the shared\nsingle-string body `{ \"value\": \"\" }`; the response exposes the\nvalue as `equivalentDid`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addEquivalentId\"}" } } }, { "name": "Remove an equivalent-id entry", "disabled": true, "request": { "description": "Removes one equivalent-id entry by its row id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeEquivalentId\"}" } } }, { "name": "List key mappings", "disabled": true, "request": { "description": "Lists KMS key bindings for verification methods on this DID. These\nrows describe local signing key usage and are separate from the DID\ndocument's public verification material.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listKeyMappings\"}" } } }, { "name": "Add a key mapping", "disabled": true, "request": { "description": "Add a key mapping binding a verification method to a KMS-managed\nkey reference (`keyInfo.providerId` + `keyInfo.alias`/`keyInfo.kid`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addKeyMapping\"}" } } }, { "name": "Remove a key mapping", "disabled": true, "request": { "description": "Removes one local KMS key mapping by its mapping id. This does not\nremove the verification method from the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeKeyMapping\"}" } } }, { "name": "Resolve a DID or dereference a DID URL", "disabled": true, "request": { "description": "Resolves a locally managed DID or dereferences a DID URL.\nWhen a plain DID is provided, returns a ResolutionResult containing\nthe DID document with resolution and document metadata.\nWhen a DID URL with a fragment is provided (e.g.,\ndid:example:123#key-1), returns a DereferencingResult containing\nthe specific resource (verification method, service, etc.).\n\nThis performs a local DID lookup first. If the DID is not\nlocally managed, behavior depends on configuration (may fall\nthrough to remote resolution).\n\nFor DIF Universal Resolver interop, use the separate endpoint\nat /1.0/identifiers/{identifier}.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.resolveDid\"}" } } }, { "name": "List DID services", "disabled": true, "request": { "description": "Lists the DID document service entries currently stored for the DID.\nService entries use the DID Core wire shape: `id`, `type`, and\n`serviceEndpoint`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listDidServices\"}" } } }, { "name": "Add a DID service", "disabled": true, "request": { "description": "Adds a DID Core service entry. `type` may be a string or an array of\nstrings; `serviceEndpoint` may be a URI string, object, or array.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addDidService\"}" } } }, { "name": "Remove a DID service", "disabled": true, "request": { "description": "Removes one service entry from the DID document model.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeDidService\"}" } } }, { "name": "Get a DID service", "disabled": true, "request": { "description": "Returns one service entry by the service id used in the DID document.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getDidService\"}" } } }, { "name": "Update a DID service", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a field to null removes it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateDidService\"}" } } }, { "name": "List verification methods", "disabled": true, "request": { "description": "Lists verification methods persisted for the DID. Relationship\nmembership is carried on each method through\n`valueVerificationRelation` and `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationMethods\"}" } } }, { "name": "Add a verification method", "disabled": true, "request": { "description": "Adds a verification method backed by an existing KMS key reference.\nUse `valueVerificationRelation` to embed the method by value in one\nrelationship, and `referenceVerificationRelations` to reference it by\nDID URL from one or more relationships.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationMethod\"}" } } }, { "name": "Remove a verification method", "disabled": true, "request": { "description": "Removes the verification method from the DID and drops relationship\nbindings that point at it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationMethod\"}" } } }, { "name": "Get a verification method", "disabled": true, "request": { "description": "Returns one verification method by fragment or absolute DID URL. The\npath segment is percent-decoded before lookup.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getVerificationMethod\"}" } } }, { "name": "Update a verification method", "disabled": true, "request": { "description": "Follows JSON Merge Patch semantics: absent fields are ignored, and\nexplicitly setting a nullable field to null removes it. `keyInfo` can\nbe partially supplied to rebind only selected KMS-key fields.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.updateVerificationMethod\"}" } } }, { "name": "List verification relationships (derived view)", "disabled": true, "request": { "description": "Returns the per-purpose view of verification relationships derived\nfrom the DID's verification methods. Read-only; to add or remove\na VM from a relationship, update the VM's\n`valueVerificationRelation` / `referenceVerificationRelations`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listVerificationRelationships\"}" } } }, { "name": "Add a verification relationship", "disabled": true, "request": { "description": "Binds an existing verification method to a verification relationship\npurpose. The default is a referenced relationship; set `embed` to true\nto serialize the relationship as an inline verification method object.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.addVerificationRelationship\"}" } } }, { "name": "Remove a verification relationship", "disabled": true, "request": { "description": "Removes one stored relationship binding by id. Use the id returned by\n`POST /identifiers/{did}/verification-relationships`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.removeVerificationRelationship\"}" } } }, { "name": "List supported DID methods", "disabled": true, "request": { "description": "Returns the capability snapshot for every DID method registered\nwith the deployment.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.listSupportedMethods\"}" } } }, { "name": "Get capabilities for a DID method", "disabled": true, "request": { "description": "Returns the full capability profile registered for one DID method,\nincluding lifecycle support, key-management support, service support,\nrepresentation hints, caching behavior, and usage guidance.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilities\"}" } } }, { "name": "Get the capability summary for a DID method", "disabled": true, "request": { "description": "Returns a compact boolean capability summary for one DID method. This\nendpoint is intended for client feature gating.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"did.getMethodCapabilitySummary\"}" } } } ] } ] }, { "name": "did-hosting", "description": "Operations associated with the did-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "did-hosting-operations", "description": "did-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the hosted DID document for a path-less DID.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nwith no path (`did:web:` or the did:web companion of\n`did:webvh::`).\n", "method": "GET", "header": [], "url": "{{baseUrl}}/.well-known/did.json" } }, { "name": "Resolve the hosted DID document for a DID with a path.", "request": { "description": "Returns the `did.json` for the DID whose web location is the request host\nplus a path. `path` is one or more URL segments (the colon-delimited DID\npath segments rendered with slashes), up to the configured maximum depth.\nFor example `did:web:example.com:tenants:acme` is served at\n`/tenants/acme/did.json`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{path}/did.json" } } ] } ] }, { "name": "eidas-signature", "description": "Operations associated with the eidas-signature guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "eidas-signature-operations", "description": "eidas-signature-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List signature configurations", "disabled": true, "request": { "description": "GET /configs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.listConfigs\"}" } } }, { "name": "Create a signature configuration", "disabled": true, "request": { "description": "Creates a reusable signature configuration that can be referenced when signing.\nConfigurations define signature level, format parameters, timestamp settings, etc.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.createConfig\"}" } } }, { "name": "Delete a signature configuration", "disabled": true, "request": { "description": "DELETE /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.deleteConfig\"}" } } }, { "name": "Get a signature configuration", "disabled": true, "request": { "description": "GET /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.getConfig\"}" } } }, { "name": "Update a signature configuration", "disabled": true, "request": { "description": "PUT /configs/{configId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.updateConfig\"}" } } }, { "name": "Simple PDF signing with visual signature", "disabled": true, "request": { "description": "Signs a PDF document with a simple visual signature (blue bar style).\nThis is a convenience endpoint for quick PDF signing with sensible defaults.\n\nSupports both JSON (Base64 content) and multipart form data uploads.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.ezDocSealSign\"}" } } }, { "name": "Complete signature with external value (step 2 of 2)", "disabled": true, "request": { "description": "Completes a signature using an externally computed signature value.\nUse the session ID from the `/signatures/digest` response.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.completeSignature\"}" } } }, { "name": "Create digest for external signing (step 1 of 2)", "disabled": true, "request": { "description": "Creates a digest/hash of the document that can be signed externally (e.g., by HSM, smartcard, or remote signing service).\n\nReturns a session ID and the digest bytes. The digest should be signed using the external system,\nthen the signature should be submitted via `/signatures/complete`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.createDigest\"}" } } }, { "name": "Sign a document (one-step)", "disabled": true, "request": { "description": "Signs a document in a single step - determines input, creates digest, signs, and merges in one call.\n\nFor scenarios where the signature must be computed externally (HSM, smartcard, remote signing service),\nuse the two-step workflow with `/signatures/digest` and `/signatures/complete`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.signDocument\"}" } } }, { "name": "Request a timestamp", "disabled": true, "request": { "description": "Requests an RFC 3161 timestamp from a Time Stamp Authority (TSA).\nCan be used standalone or as part of a signing workflow.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.requestTimestamp\"}" } } }, { "name": "Validate a signed document", "disabled": true, "request": { "description": "Validates the signatures in a signed document against EU Trusted Lists.\nSupports CAdES, PAdES, JAdES, and XAdES signed documents.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.validateSignature\"}" } } }, { "name": "Validate a raw signature", "disabled": true, "request": { "description": "Validates a raw cryptographic signature against the original input data.\nUses the referenced key from the KMS to verify the signature.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"eidas-signature.validateRawSignature\"}" } } } ] } ] }, { "name": "email", "description": "Operations associated with the email guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "email-operations", "description": "email-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Send a raw email", "disabled": true, "request": { "description": "Resolves one sender for the registered email type and sends the caller-authored message. Provide an HTML body, a plain-text body, or both.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"email.sendEmail\"}" } } }, { "name": "Resolve a published catalog template and send it", "disabled": true, "request": { "description": "Validates typed variables, resolves locale and live application or tenant branding, renders the server-controlled shell, and sends through the sender resolved for the registered email type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"email.sendTemplatedEmail\"}" } } }, { "name": "Report email-service configuration and health", "request": { "description": "Reports whether the calling tenant has a usable route for the requested email type and whether the transport is reachable. Unauthenticated and always `200`; configuration problems are reported in the body, not as an HTTP error.", "method": "GET", "header": [], "url": "{{baseUrl}}/status" } }, { "name": "Send a diagnostic email", "disabled": true, "request": { "description": "Sends a diagnostic message through the explicitly selected account.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"email.testSendEmail\"}" } } } ] } ] }, { "name": "enableu-v1", "description": "Operations associated with the enableu-v1 guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "enableu-v1-operations", "description": "enableu-v1-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Check current company representative authority", "disabled": true, "request": { "description": "Checks the identified person's current role and capacity for exactly one KVK or VES company\nidentifier and the stated purpose. Technical failure never produces NOT_CONFIRMED.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enableu-v1.CheckCompanyRepresentativeAuthority\"}" } } }, { "name": "Retrieve explicitly requested company fields", "disabled": true, "request": { "description": "Accepts exactly one KVK or VES search variant and returns only requested company fields.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enableu-v1.GetCompany\"}" } } }, { "name": "Retrieve explicitly requested person fields", "disabled": true, "request": { "description": "Returns only fields named in requestedFields. Omitted fields are not inferred or expanded.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enableu-v1.GetPerson\"}" } } } ] } ] }, { "name": "enterprise-lifecycle", "description": "Operations associated with the enterprise-lifecycle guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "enterprise-lifecycle-operations", "description": "enterprise-lifecycle-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Start a governed workflow definition revision", "disabled": true, "request": { "description": "POST /executions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-lifecycle.startLifecycleExecution\"}" } } }, { "name": "Inspect lifecycle execution status", "disabled": true, "request": { "description": "GET /executions/{executionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-lifecycle.inspectLifecycleExecution\"}" } } }, { "name": "Deliver a governed signal carrying protected object references", "disabled": true, "request": { "description": "POST /executions/{executionId}/signals. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-lifecycle.signalLifecycleExecution\"}" } } }, { "name": "Retry one failed governed operation", "disabled": true, "request": { "description": "POST /executions/{executionId}:retry. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-lifecycle.retryLifecycleExecution\"}" } } }, { "name": "Translate a reference-only form notice into a server-owned lifecycle input", "disabled": true, "request": { "description": "POST /form-completions:translate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-lifecycle.translateFormCompletion\"}" } } } ] } ] }, { "name": "enterprise-modeling", "description": "Operations associated with the enterprise-modeling guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "enterprise-modeling-operations", "description": "enterprise-modeling-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Report only installed semantic interchange processors", "disabled": true, "request": { "description": "GET /capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.getSemanticCapabilities\"}" } } }, { "name": "Apply an approved preview to a new draft revision", "disabled": true, "request": { "description": "POST /changes:apply. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.applySemanticChange\"}" } } }, { "name": "Normalize and validate a guided or expert semantic change", "disabled": true, "request": { "description": "POST /changes:preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.previewSemanticChange\"}" } } }, { "name": "List Evidence Requirements", "disabled": true, "request": { "description": "GET /evidence-requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.listEvidenceRequirements\"}" } } }, { "name": "Create Evidence Requirement", "disabled": true, "request": { "description": "POST /evidence-requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.createEvidenceRequirement\"}" } } }, { "name": "Read Evidence Requirement", "disabled": true, "request": { "description": "GET /evidence-requirements/{requirementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readEvidenceRequirement\"}" } } }, { "name": "Publish Evidence Requirement", "disabled": true, "request": { "description": "POST /evidence-requirements/{requirementId}:publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.publishEvidenceRequirement\"}" } } }, { "name": "Revise Evidence Requirement", "disabled": true, "request": { "description": "POST /evidence-requirements/{requirementId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.reviseEvidenceRequirement\"}" } } }, { "name": "Apply an approved import preview to a new draft revision", "disabled": true, "request": { "description": "POST /imports:apply. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.applySemanticImport\"}" } } }, { "name": "Normalize an import into the shared typed change-set model", "disabled": true, "request": { "description": "POST /imports:preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.previewSemanticImport\"}" } } }, { "name": "Validate bounded semantic interchange input", "disabled": true, "request": { "description": "POST /interchange:validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.validateSemanticInterchange\"}" } } }, { "name": "List Interpretations", "disabled": true, "request": { "description": "GET /interpretations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.listInterpretations\"}" } } }, { "name": "Create Interpretation", "disabled": true, "request": { "description": "POST /interpretations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.createInterpretation\"}" } } }, { "name": "Read Interpretation", "disabled": true, "request": { "description": "GET /interpretations/{interpretationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readInterpretation\"}" } } }, { "name": "Approve Interpretation", "disabled": true, "request": { "description": "POST /interpretations/{interpretationId}:approve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.approveInterpretation\"}" } } }, { "name": "Reject Interpretation", "disabled": true, "request": { "description": "POST /interpretations/{interpretationId}:reject. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.rejectInterpretation\"}" } } }, { "name": "Revise Interpretation", "disabled": true, "request": { "description": "POST /interpretations/{interpretationId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.reviseInterpretation\"}" } } }, { "name": "Submit Interpretation", "disabled": true, "request": { "description": "POST /interpretations/{interpretationId}:submit. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.submitInterpretation\"}" } } }, { "name": "Supersede Interpretation", "disabled": true, "request": { "description": "POST /interpretations/{interpretationId}:supersede. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.supersedeInterpretation\"}" } } }, { "name": "Preview policy binding", "disabled": true, "request": { "description": "POST /models/{modelId}/policy-bindings:preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.previewPolicyBinding\"}" } } }, { "name": "Read RDF, Turtle, OCA, mappings, namespaces, and installed constraints", "disabled": true, "request": { "description": "GET /models/{modelId}/revisions/{revision}/expert. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.getExpertSemanticProjection\"}" } } }, { "name": "Read a business-language projection without RDF or OCA syntax", "disabled": true, "request": { "description": "GET /models/{modelId}/revisions/{revision}/guided. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.getGuidedSemanticProjection\"}" } } }, { "name": "Read Policy Binding", "disabled": true, "request": { "description": "GET /policy-bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readPolicyBinding\"}" } } }, { "name": "Publish Policy Binding", "disabled": true, "request": { "description": "POST /policy-bindings:publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.publishPolicyBinding\"}" } } }, { "name": "Export a pinned RDF and OCA semantic release", "disabled": true, "request": { "description": "POST /releases:export. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.exportSemanticRelease\"}" } } }, { "name": "List Requirements", "disabled": true, "request": { "description": "GET /requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.listRequirements\"}" } } }, { "name": "Create Requirement", "disabled": true, "request": { "description": "POST /requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.createRequirement\"}" } } }, { "name": "Read Requirement", "disabled": true, "request": { "description": "GET /requirements/{requirementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readRequirement\"}" } } }, { "name": "Approve Requirement", "disabled": true, "request": { "description": "POST /requirements/{requirementId}:approve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.approveRequirement\"}" } } }, { "name": "Publish Requirement", "disabled": true, "request": { "description": "POST /requirements/{requirementId}:publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.publishRequirement\"}" } } }, { "name": "Revise Requirement", "disabled": true, "request": { "description": "POST /requirements/{requirementId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.reviseRequirement\"}" } } }, { "name": "Supersede Requirement", "disabled": true, "request": { "description": "POST /requirements/{requirementId}:supersede. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.supersedeRequirement\"}" } } }, { "name": "Read Resource Lineage", "disabled": true, "request": { "description": "GET /resources/{resourceId}/lineage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readResourceLineage\"}" } } }, { "name": "Read Legal Source", "disabled": true, "request": { "description": "GET /sources/{sourceId}/snapshots/{snapshotId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readLegalSource\"}" } } }, { "name": "List Legal Clauses", "disabled": true, "request": { "description": "GET /sources/{sourceId}/snapshots/{snapshotId}/clauses. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.listLegalClauses\"}" } } }, { "name": "Import Legal Source", "disabled": true, "request": { "description": "POST /sources:import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.importLegalSource\"}" } } }, { "name": "Read Template Installation", "disabled": true, "request": { "description": "GET /template-installations/{installationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.readTemplateInstallation\"}" } } }, { "name": "Install Case Template", "disabled": true, "request": { "description": "POST /templates:install. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-modeling.installCaseTemplate\"}" } } } ] } ] }, { "name": "enterprise-organization", "description": "Operations associated with the enterprise-organization guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "enterprise-organization-operations", "description": "enterprise-organization-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Initialize a model event stream from a pinned semantic model", "disabled": true, "request": { "description": "POST /models. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.initializeOrganizationModel\"}" } } }, { "name": "Organization agreement establish", "disabled": true, "request": { "description": "POST /models/{modelId}/agreements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAgreementEstablish\"}" } } }, { "name": "Organization agreement activate", "disabled": true, "request": { "description": "POST /models/{modelId}/agreements/{recordId}:activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAgreementActivate\"}" } } }, { "name": "Organization agreement end", "disabled": true, "request": { "description": "POST /models/{modelId}/agreements/{recordId}:end. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAgreementEnd\"}" } } }, { "name": "Organization agreement revise", "disabled": true, "request": { "description": "POST /models/{modelId}/agreements/{recordId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAgreementRevise\"}" } } }, { "name": "Organization agreement suspend", "disabled": true, "request": { "description": "POST /models/{modelId}/agreements/{recordId}:suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAgreementSuspend\"}" } } }, { "name": "Organization asset register", "disabled": true, "request": { "description": "POST /models/{modelId}/assets. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssetRegister\"}" } } }, { "name": "Organization resource revise", "disabled": true, "request": { "description": "PUT /models/{modelId}/assets/{recordId}/resource. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationResourceRevise\"}" } } }, { "name": "Organization assignment create", "disabled": true, "request": { "description": "POST /models/{modelId}/assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssignmentCreate\"}" } } }, { "name": "Organization assignment activate", "disabled": true, "request": { "description": "POST /models/{modelId}/assignments/{recordId}:activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssignmentActivate\"}" } } }, { "name": "Organization assignment expire", "disabled": true, "request": { "description": "POST /models/{modelId}/assignments/{recordId}:expire. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssignmentExpire\"}" } } }, { "name": "Organization assignment revise", "disabled": true, "request": { "description": "POST /models/{modelId}/assignments/{recordId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssignmentRevise\"}" } } }, { "name": "Organization assignment revoke", "disabled": true, "request": { "description": "POST /models/{modelId}/assignments/{recordId}:revoke. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationAssignmentRevoke\"}" } } }, { "name": "Organization capability grant", "disabled": true, "request": { "description": "POST /models/{modelId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationCapabilityGrant\"}" } } }, { "name": "Organization capability resume", "disabled": true, "request": { "description": "POST /models/{modelId}/capabilities/{recordId}:resume. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationCapabilityResume\"}" } } }, { "name": "Organization capability revoke", "disabled": true, "request": { "description": "POST /models/{modelId}/capabilities/{recordId}:revoke. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationCapabilityRevoke\"}" } } }, { "name": "Organization capability suspend", "disabled": true, "request": { "description": "POST /models/{modelId}/capabilities/{recordId}:suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationCapabilitySuspend\"}" } } }, { "name": "Create Case", "disabled": true, "request": { "description": "POST /models/{modelId}/cases. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.createCase\"}" } } }, { "name": "Read Case", "disabled": true, "request": { "description": "GET /models/{modelId}/cases/{caseId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.readCase\"}" } } }, { "name": "Submit Case Action", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/actions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.submitCaseAction\"}" } } }, { "name": "Record Case Confirmation", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/confirmations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.recordCaseConfirmation\"}" } } }, { "name": "Record Evidence", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/evidence. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.recordEvidence\"}" } } }, { "name": "Dispose Evidence", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/evidence/{submissionId}:dispose. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.disposeEvidence\"}" } } }, { "name": "Validate Evidence", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/evidence/{submissionId}:validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.validateEvidence\"}" } } }, { "name": "Activate Lifecycle Plan", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/lifecycle-plans:activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.activateLifecyclePlan\"}" } } }, { "name": "Attach Lifecycle Receipt", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/lifecycle-receipts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.attachLifecycleReceipt\"}" } } }, { "name": "Read Case Lineage", "disabled": true, "request": { "description": "GET /models/{modelId}/cases/{caseId}/lineage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.readCaseLineage\"}" } } }, { "name": "Attach Integration Receipt", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/receipts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.attachIntegrationReceipt\"}" } } }, { "name": "Read Case Timeline", "disabled": true, "request": { "description": "GET /models/{modelId}/cases/{caseId}/timeline. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.readCaseTimeline\"}" } } }, { "name": "Apply Case Transition", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/transitions:apply. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.applyCaseTransition\"}" } } }, { "name": "Evaluate Case Transition", "disabled": true, "request": { "description": "POST /models/{modelId}/cases/{caseId}/transitions:evaluate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.evaluateCaseTransition\"}" } } }, { "name": "Organization decision read", "disabled": true, "request": { "description": "GET /models/{modelId}/decisions/{recordId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationDecisionRead\"}" } } }, { "name": "Organization decision supersede", "disabled": true, "request": { "description": "POST /models/{modelId}/decisions/{recordId}:supersede. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationDecisionSupersede\"}" } } }, { "name": "Organization policy evaluate", "disabled": true, "request": { "description": "POST /models/{modelId}/decisions:evaluate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationPolicyEvaluate\"}" } } }, { "name": "Organization graph read", "disabled": true, "request": { "description": "GET /models/{modelId}/graph. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationGraphRead\"}" } } }, { "name": "Organization identifier bind", "disabled": true, "request": { "description": "POST /models/{modelId}/identifiers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationIdentifierBind\"}" } } }, { "name": "Organization identifier remove", "disabled": true, "request": { "description": "DELETE /models/{modelId}/identifiers/{recordId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationIdentifierRemove\"}" } } }, { "name": "Organization identifier supersede", "disabled": true, "request": { "description": "POST /models/{modelId}/identifiers/{recordId}:supersede. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationIdentifierSupersede\"}" } } }, { "name": "Organization identifier verify", "disabled": true, "request": { "description": "POST /models/{modelId}/identifiers/{recordId}:verify. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationIdentifierVerify\"}" } } }, { "name": "Organization party register", "disabled": true, "request": { "description": "POST /models/{modelId}/parties. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationPartyRegister\"}" } } }, { "name": "Organization party revise", "disabled": true, "request": { "description": "PUT /models/{modelId}/parties/{recordId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationPartyRevise\"}" } } }, { "name": "Organization party bind semantic", "disabled": true, "request": { "description": "POST /models/{modelId}/parties/{recordId}:bind-semantic. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationPartyBindSemantic\"}" } } }, { "name": "Organization projection inspect", "disabled": true, "request": { "description": "GET /models/{modelId}/projection. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationProjectionInspect\"}" } } }, { "name": "Organization record list", "disabled": true, "request": { "description": "GET /models/{modelId}/records. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRecordList\"}" } } }, { "name": "Organization record read", "disabled": true, "request": { "description": "GET /models/{modelId}/records/{recordType}/{recordId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRecordRead\"}" } } }, { "name": "Organization relationship establish", "disabled": true, "request": { "description": "POST /models/{modelId}/relationships. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRelationshipEstablish\"}" } } }, { "name": "Organization relationship end", "disabled": true, "request": { "description": "POST /models/{modelId}/relationships/{recordId}:end. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRelationshipEnd\"}" } } }, { "name": "Organization relationship revise", "disabled": true, "request": { "description": "POST /models/{modelId}/relationships/{recordId}:revise. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRelationshipRevise\"}" } } }, { "name": "Organization relationship suspend", "disabled": true, "request": { "description": "POST /models/{modelId}/relationships/{recordId}:suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationRelationshipSuspend\"}" } } }, { "name": "Replay typed events into a staged projection revision", "disabled": true, "request": { "description": "POST /models/{modelId}/replays. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.startOrganizationReplay\"}" } } }, { "name": "Inspect a staged or active replay", "disabled": true, "request": { "description": "GET /models/{modelId}/replays/{projectionRevision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.inspectOrganizationReplay\"}" } } }, { "name": "Verify and atomically activate a staged projection revision", "disabled": true, "request": { "description": "POST /models/{modelId}/replays/{projectionRevision}:activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.activateOrganizationReplay\"}" } } }, { "name": "Organization source inspect", "disabled": true, "request": { "description": "GET /models/{modelId}/source-assertions/{recordId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationSourceInspect\"}" } } }, { "name": "Organization source refresh", "disabled": true, "request": { "description": "POST /models/{modelId}/source-assertions/{recordId}:refresh. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationSourceRefresh\"}" } } }, { "name": "Organization source supersede", "disabled": true, "request": { "description": "POST /models/{modelId}/source-assertions/{recordId}:supersede. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationSourceSupersede\"}" } } }, { "name": "Organization source record", "disabled": true, "request": { "description": "POST /models/{modelId}/source-assertions:record. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationSourceRecord\"}" } } }, { "name": "Organization source request", "disabled": true, "request": { "description": "POST /models/{modelId}/source-assertions:request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.organizationSourceRequest\"}" } } }, { "name": "Read stream and active projection metadata", "disabled": true, "request": { "description": "GET /models/{modelId}/stream. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"enterprise-organization.readOrganizationStream\"}" } } } ] } ] }, { "name": "forms", "description": "Operations associated with the forms guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "forms-operations", "description": "forms-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List form definitions", "disabled": true, "request": { "description": "Returns a page of form definitions matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.listForms\"}" } } }, { "name": "Create a form definition", "disabled": true, "request": { "description": "POST /forms. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.createForm\"}" } } }, { "name": "Create a new form family as a draft", "disabled": true, "request": { "description": "POST /forms/drafts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.createFormDraft\"}" } } }, { "name": "Resolve a form draft for preview without persisting it", "disabled": true, "request": { "description": "Resolves the draft into a renderer-ready form. Nothing is persisted and no semantic lineage\nis written.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.previewFormDraft\"}" } } }, { "name": "Get the full session", "disabled": true, "request": { "description": "GET /forms/sessions/{sessionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.getFormSession\"}" } } }, { "name": "Cancel a form session", "disabled": true, "request": { "description": "Transitions the session to `CANCELLED`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.cancelFormSession\"}" } } }, { "name": "List session events", "disabled": true, "request": { "description": "Returns appended session events in monotonically increasing `sequence` order. Use\n`afterSequence` to tail events past a known cursor; `limit` is clamped to `[1, 1000]`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.listFormSessionEvents\"}" } } }, { "name": "Mark a field as needing re-validation", "disabled": true, "request": { "description": "POST /forms/sessions/{sessionId}/fields/invalidate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.invalidateFormSessionField\"}" } } }, { "name": "Force a remote validation result on a field", "disabled": true, "request": { "description": "Empty `errors` marks the field as remotely valid; non-empty marks it remotely invalid\nand stamps the session phase as `FAILED`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.forceFormSessionFieldValidation\"}" } } }, { "name": "Clear forced remote validation on a field", "disabled": true, "request": { "description": "POST /forms/sessions/{sessionId}/fields/remotevalidation/clear. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.clearFormSessionFieldForcedValidation\"}" } } }, { "name": "Validate a single field", "disabled": true, "request": { "description": "POST /forms/sessions/{sessionId}/fields/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.validateFormSessionField\"}" } } }, { "name": "Apply server-side field errors in bulk", "disabled": true, "request": { "description": "Stamps the session phase as `FAILED`. The next accepted user update to a targeted field\nclears its remote errors via the existing field lifecycle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.applyFormSessionServerErrors\"}" } } }, { "name": "Get the session snapshot", "disabled": true, "request": { "description": "Returns the client-oriented snapshot: state, progress, allowed commands, and revision.\nSnapshots omit raw field values, fetch the full session for those.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.getFormSessionSnapshot\"}" } } }, { "name": "Cancel a step action", "disabled": true, "request": { "description": "Terminal state with optional reason recorded for audit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.cancelFormStepAction\"}" } } }, { "name": "Complete a step action", "disabled": true, "request": { "description": "The `result` variant must match the declared `StepAction` variant on the resolved form.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.completeFormStepAction\"}" } } }, { "name": "Start a step action", "disabled": true, "request": { "description": "Transitions a step action from `PENDING` -> `IN_PROGRESS` and returns the prompt the\nclient must fulfill (presentation request, evidence upload target, signature challenge,\nartifact handle, or `None` for synchronous actions).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.startFormStepAction\"}" } } }, { "name": "Navigate to a step", "disabled": true, "request": { "description": "Navigates the session to the step at `stepIndex`. Forward navigation is gated on the\ntarget step's required actions being satisfied; backward navigation is unconditional\nwithin mutable session states.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.navigateFormSessionStep\"}" } } }, { "name": "Validate every field within a step", "disabled": true, "request": { "description": "POST /forms/sessions/{sessionId}/steps/{stepIndex}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.validateFormSessionStep\"}" } } }, { "name": "Submit a form session", "disabled": true, "request": { "description": "Validates all steps, applies final values, and transitions the session to `SUBMITTED`.\nRejected when the session status forbids submission (see `FormSessionStatus.canSubmit`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.submitFormSession\"}" } } }, { "name": "Update session field values", "disabled": true, "request": { "description": "Applies the supplied field-value map to the session and returns the resulting mutation\nwith a per-field diff. Field paths must exist in the session's current `resolvedForm`;\nHIDDEN-by-policy fields are absent from the resolved tree and are rejected.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.updateFormSessionValues\"}" } } }, { "name": "Validate a form draft without persisting it", "disabled": true, "request": { "description": "Returns an authoring-violation report rather than rejecting the request, so an editor can\nrender per-field errors while a draft is still being authored.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.validateFormDraft\"}" } } }, { "name": "Soft-delete a form definition", "disabled": true, "request": { "description": "DELETE /forms/{formId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.deleteForm\"}" } } }, { "name": "Get one form definition", "disabled": true, "request": { "description": "GET /forms/{formId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.getForm\"}" } } }, { "name": "Update a form definition", "disabled": true, "request": { "description": "Null fields in the input are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.updateForm\"}" } } }, { "name": "Clone a form into a new family", "disabled": true, "request": { "description": "POST /forms/{formId}/clones. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.cloneForm\"}" } } }, { "name": "Publish a draft form definition", "disabled": true, "request": { "description": "Transitions a DRAFT to PUBLISHED, stamps approval, and freezes the row. The only path that\ntransitions a form to PUBLISHED. Publishing a form that is not in DRAFT is a state conflict\nand returns `409`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.publishForm\"}" } } }, { "name": "Resolve a form definition", "disabled": true, "request": { "description": "Returns the form's runtime tree resolved for the given locale, principal, and roles.\nSteps and elements are filtered by access policy and locale-keyed labels are\ncollapsed to the requested locale.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.resolveForm\"}" } } }, { "name": "Create a form session", "disabled": true, "request": { "description": "Creates a new runtime session bound to the form version identified by `formId`. The\nsession inherits the resolved form tree for the supplied locale/principal/roles and\nstarts at `currentStepIndex = 0`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.createFormSession\"}" } } }, { "name": "Create a new draft version of an existing form", "disabled": true, "request": { "description": "Copies the selected PUBLISHED version into a new DRAFT (same family, incremented version\nsequence). Rejected with `409` when a mutable draft already exists for the family.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"forms.createFormVersion\"}" } } } ] } ] }, { "name": "identity-auth", "description": "Operations associated with the identity-auth guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "identity-auth-operations", "description": "identity-auth-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a login credential", "disabled": true, "request": { "description": "Operator operation. Hashes the plaintext password and stores a new credential keyed on the tenant and username, linked to an existing Identity. Fails with `409` when a credential for that username already exists (`AUTH_CREDENTIAL_ALREADY_EXISTS`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.createCredential\"}" } } }, { "name": "Clear lockout state", "disabled": true, "request": { "description": "Operator operation. Resets the failed-attempts counter and clears a time-based lockout. Does not change a `DISABLED` status, which is a separate operator action.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.unlockCredential\"}" } } }, { "name": "Complete a redirect-flow authentication", "request": { "description": "Callback from the external authentication method. Completes the flow, upserts the resulting Identity, writes the session, and returns the authenticated user. The flow is dispatched by `executionId` and `sessionId`, so this one path serves every configured method. This endpoint does not require a bearer token: it is bound to the one-shot `executionId` issued by the initiate call. A verification that produced no verified identifiers fails with `401` (`AUTH_INVALID_CREDENTIALS`); an unknown or expired execution fails with `404` (`AUTH_SESSION_NOT_FOUND`).", "method": "POST", "header": [], "url": "{{baseUrl}}/callback" } }, { "name": "Change a password", "disabled": true, "request": { "description": "Rotates the stored password hash. The caller must present the current password, which the server re-verifies before rotating. A wrong current password fails with `401` (`AUTH_INVALID_CREDENTIALS`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.updatePassword\"}" } } }, { "name": "OpenID Connect RP-Initiated Logout", "disabled": true, "request": { "description": "Terminates one or many sessions per OpenID Connect RP-Initiated Logout (section 3) and fires back-channel notifications. Supply at least one of `idTokenHint`, `sessionId`, or `identityId`; omitting all three fails with `400` (`AUTH_END_SESSION_ARGUMENT_MISSING`). An `idTokenHint` that cannot be validated fails with `400` (`AUTH_INVALID_ID_TOKEN_HINT`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.endSession\"}" } } }, { "name": "Start a redirect-flow authentication", "disabled": true, "request": { "description": "Starts an external authentication challenge and returns the dispatch URL the user agent should be redirected to. The method is resolved from `methodId`, or the tenant default when `methodId` is null. A configured method that is not a redirect-flow method fails with `400` (`AUTH_METHOD_TYPE_MISMATCH`); a method that is absent or disabled fails with `503` (`AUTH_METHOD_NOT_CONFIGURED`).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.initiateAuthentication\"}" } } }, { "name": "Log out a session", "disabled": true, "request": { "description": "Terminates a single Authorization-Server session. Idempotent; logging out an unknown or expired session returns `loggedOut` false without error.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.logoutSession\"}" } } }, { "name": "Get the authenticated user for a session", "disabled": true, "request": { "description": "Returns the authenticated user bound to an Authorization-Server session id, or `user: null` when the session is unknown, expired, or not yet authenticated. The session id is carried in the body because it is bearer-equivalent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-auth.getAuthenticatedSession\"}" } } } ] } ] }, { "name": "identity-manager", "description": "Operations associated with the identity-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "identity-manager-operations", "description": "identity-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Soft-delete an identity identifier", "disabled": true, "request": { "description": "Marks the identifier as deleted. Deleted identifiers are not returned in\nordinary reads and lists.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.deleteIdentityIdentifier\"}" } } }, { "name": "Get an identity identifier", "disabled": true, "request": { "description": "Returns one identifier by ID. Use this direct route when the identifier\nID is already known and the parent identity does not need to be part of\nthe request path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.getIdentityIdentifier\"}" } } }, { "name": "Update an identity identifier", "disabled": true, "request": { "description": "Updates mutable identifier metadata such as primary status, verification\nstatus, verification time, and expiry. The identifier value itself is\nnot changed through this endpoint.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.updateIdentityIdentifier\"}" } } }, { "name": "List identities", "disabled": true, "request": { "description": "Returns a paginated list of identities in the caller's tenant. Use\nfilters to narrow by credential role, default flag, or deletion state.\nSet `includeIdentityIdentifiers=true` only when identifiers are needed\nin the same response. When identifiers are inlined, use `valueMode` to\nchoose whether their values are returned as lookup keys, masked display\nvalues, or revealed values where policy and authorization allow it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.listIdentities\"}" } } }, { "name": "Create an identity", "disabled": true, "request": { "description": "Creates an identity for credential, login, or matching workflows. The\nidentity can be created without any identifiers; identifiers can be\nattached later through `/identities/{identityId}/identifiers`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.createIdentity\"}" } } }, { "name": "Soft-delete an identity", "disabled": true, "request": { "description": "Marks the identity as deleted. Deleted identities are omitted from list\nresponses unless `includeDeleted=true` is requested.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.deleteIdentity\"}" } } }, { "name": "Get an identity", "disabled": true, "request": { "description": "Returns one identity by ID. Optional include flags control whether\nidentifiers and identifier extension data are returned inline.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.getIdentity\"}" } } }, { "name": "Update an identity", "disabled": true, "request": { "description": "Updates mutable identity settings such as role, default status, and\nprivacy mode. This endpoint does not create, update, or remove\nidentifiers.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.updateIdentity\"}" } } }, { "name": "List identifiers for an identity", "disabled": true, "request": { "description": "Returns the identifiers attached to a known identity. Use `valueMode` to\nchoose whether values are returned as lookup keys, masked display values,\nor revealed values where policy and authorization allow it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.listIdentityIdentifiers\"}" } } }, { "name": "Create an identifier for an identity", "disabled": true, "request": { "description": "Creates an identifier from a raw value such as an email address, DID,\nVAT number, LEI, or certificate identifier. The service applies tenant\npolicy before storing and returning the identifier.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"identity-manager.createIdentityIdentifier\"}" } } } ] } ] }, { "name": "inbox", "description": "Operations associated with the inbox guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "inbox-operations", "description": "inbox-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Request a policy-filtered evidentiary export job", "disabled": true, "request": { "description": "The server derives export ID, tenant, requester, and request time from authenticated context. This asynchronous evidence archive is separate from management metrics and never returns unbounded correlations inline.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxEvidenceExport\"}" } } }, { "name": "Get an evidentiary export job", "disabled": true, "request": { "description": "GET /evidence-exports/{exportId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxEvidenceExportJob\"}" } } }, { "name": "Download a completed evidentiary export archive", "disabled": true, "request": { "description": "Reauthorizes inbox.export for the current tenant and requester, requires COMPLETED status, audits access, and serves the manifest-bound archive through a short-lived controlled download. It is not a management report.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.downloadInboxEvidenceExportArtifact\"}" } } }, { "name": "List authorized inboxes", "disabled": true, "request": { "description": "GET /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxes\"}" } } }, { "name": "Create an inbox", "disabled": true, "request": { "description": "POST /inboxes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInbox\"}" } } }, { "name": "Get an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInbox\"}" } } }, { "name": "Update an inbox", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInbox\"}" } } }, { "name": "List physical folders", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxFolders\"}" } } }, { "name": "Create a physical folder", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxFolder\"}" } } }, { "name": "Get a physical folder", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxFolder\"}" } } }, { "name": "Update a physical folder", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxFolder\"}" } } }, { "name": "List folder bindings", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listFolderBindings\"}" } } }, { "name": "Create a folder binding with a server-generated ID", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/folders/{folderId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createFolderBinding\"}" } } }, { "name": "Update a folder binding", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/folders/{folderId}/bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateFolderBinding\"}" } } }, { "name": "List work queues for an inbox", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxWorkQueues\"}" } } }, { "name": "Create a versioned work queue", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/queues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxWorkQueue\"}" } } }, { "name": "Get a work queue", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxWorkQueue\"}" } } }, { "name": "Update a work queue with optimistic concurrency", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/queues/{queueId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxWorkQueue\"}" } } }, { "name": "List inbox routing rules", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxRules\"}" } } }, { "name": "Create an inbox routing rule", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createInboxRule\"}" } } }, { "name": "Delete an inbox routing rule", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteInboxRule\"}" } } }, { "name": "Get an inbox routing rule", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxRule\"}" } } }, { "name": "Update an inbox routing rule", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/rules/{ruleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxRule\"}" } } }, { "name": "List saved inbox views", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listSavedInboxViews\"}" } } }, { "name": "Create a saved inbox view", "disabled": true, "request": { "description": "POST /inboxes/{inboxId}/saved-views. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.createSavedInboxView\"}" } } }, { "name": "Delete a saved inbox view", "disabled": true, "request": { "description": "DELETE /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.deleteSavedInboxView\"}" } } }, { "name": "Get a saved inbox view", "disabled": true, "request": { "description": "GET /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getSavedInboxView\"}" } } }, { "name": "Update a saved inbox view", "disabled": true, "request": { "description": "PATCH /inboxes/{inboxId}/saved-views/{savedViewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateSavedInboxView\"}" } } }, { "name": "Query authorized inbox items", "disabled": true, "request": { "description": "Executes the versioned structured query across every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. Shared links carry this same `query` parameter as percent-encoded canonical JSON; clients must not translate it into a different filter language.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxItems\"}" } } }, { "name": "Apply tags to a bounded item set as one correlated operation", "disabled": true, "request": { "description": "Source-domain approve, reject, and complete are forbidden as bulk list operations.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkTagInboxItems\"}" } } }, { "name": "Get an inbox item", "disabled": true, "request": { "description": "GET /items/{itemId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItem\"}" } } }, { "name": "Read the latest durable revision of an action receipt", "disabled": true, "request": { "description": "GET /items/{itemId}/action-receipts/{receiptId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxActionReceipt\"}" } } }, { "name": "Submit an item action intent", "disabled": true, "request": { "description": "POST /items/{itemId}/actions/{actionKey}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.performInboxAction\"}" } } }, { "name": "Retrieve an authorized safe artifact", "disabled": true, "request": { "description": "Re-evaluates tenant and inbox.read policy and serves only SAFE content from the managed artifact store. It never proxies a client-supplied URL.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.retrieveInboxArtifact\"}" } } }, { "name": "Get item history", "disabled": true, "request": { "description": "GET /items/{itemId}/history. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemHistory\"}" } } }, { "name": "List auditable legal holds for an item", "disabled": true, "request": { "description": "GET /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxItemLegalHolds\"}" } } }, { "name": "Apply a legal hold that wins over a pending retention sweep", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.applyInboxItemLegalHold\"}" } } }, { "name": "Release a legal hold with optimistic concurrency", "disabled": true, "request": { "description": "POST /items/{itemId}/legal-holds/{legalHoldId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseInboxItemLegalHold\"}" } } }, { "name": "Get the current user's item state", "disabled": true, "request": { "description": "GET /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxItemUserState\"}" } } }, { "name": "Update the current user's item state", "disabled": true, "request": { "description": "PUT /items/{itemId}/user-state. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.updateInboxItemUserState\"}" } } }, { "name": "Stream resumable authorized inbox updates", "disabled": true, "request": { "description": "Streams every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.streamInboxUpdates\"}" } } }, { "name": "Get an authorization-filtered unified inbox summary", "disabled": true, "request": { "description": "Counts every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.getInboxSummary\"}" } } }, { "name": "List authorized append-only arrival and completion facts", "disabled": true, "request": { "description": "GET /throughput-facts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.listInboxThroughputFacts\"}" } } }, { "name": "Query authorized WORK items across the unified Inbox", "disabled": true, "request": { "description": "Returns WORK items from every inbox the current actor may access when no inboxId values are supplied. Repeated inboxId values only narrow that authorized set. This is a façade over the canonical Inbox item query.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryWorkItems\"}" } } }, { "name": "Reassign a bounded item set as one correlated operation", "disabled": true, "request": { "description": "POST /work-items/bulk/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.bulkReassignWorkItems\"}" } } }, { "name": "Query authorization-filtered supervisor metrics", "disabled": true, "request": { "description": "POST /work-items/supervisor/query. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.queryInboxSupervisorMetrics\"}" } } }, { "name": "Submit the fixed approve action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/approve. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.approveWorkItem\"}" } } }, { "name": "Atomically claim a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/claim. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.claimWorkItem\"}" } } }, { "name": "Submit the fixed complete action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/complete. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.completeWorkItem\"}" } } }, { "name": "Atomically set bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.setWorkItemCover\"}" } } }, { "name": "Atomically clear bounded cover for a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/cover/clear. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.clearWorkItemCover\"}" } } }, { "name": "Commit an Inbox-owned SLA escalation synchronously", "disabled": true, "request": { "description": "POST /work-items/{itemId}/escalate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.escalateWorkItem\"}" } } }, { "name": "Explicitly extend a checkout lease; client activity never extends it implicitly", "disabled": true, "request": { "description": "POST /work-items/{itemId}/lease/extend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.extendWorkItemLease\"}" } } }, { "name": "Atomically reassign a work item", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reassign. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.reassignWorkItem\"}" } } }, { "name": "Submit the fixed reject action through the shared receipt engine", "disabled": true, "request": { "description": "POST /work-items/{itemId}/reject. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.rejectWorkItem\"}" } } }, { "name": "Atomically release a work item assignment", "disabled": true, "request": { "description": "POST /work-items/{itemId}/release. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.releaseWorkItem\"}" } } }, { "name": "Take over a held or expired checkout and record both holders", "disabled": true, "request": { "description": "POST /work-items/{itemId}/take-over. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"inbox.takeOverWorkItem\"}" } } } ] } ] }, { "name": "invitation", "description": "Operations associated with the invitation guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "invitation-operations", "description": "invitation-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List invitations", "disabled": true, "request": { "description": "Returns a page of invitations in the caller's tenant, narrowed by the optional\nfilters. Default sort is newest first (`createdAt` descending).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.listInvitations\"}" } } }, { "name": "Mint a single invitation, optionally delivering via a channel", "disabled": true, "request": { "description": "Mints one invitation in the caller's tenant and returns the raw token. This is\nthe low-level entry point the feature flows build on; use it for direct\nintegrations that own their own delivery, or supply a `recipient` to have the\nserver mint and deliver in one call.\n\nThe result is flat and discriminated by `type`:\n\n - `MINT_ONLY`: no `recipient` was supplied. `minted` carries the invitation\n and its token, and this call sends nothing. The invitation is recorded as\n NOT_REQUESTED when `channelPreferences` is empty and PENDING otherwise.\n - `MINT_AND_DELIVER`: a `recipient` was supplied. `created` carries the same\n minted invitation plus the delivery outcome. A delivery failure does not\n fail the request, because the token is already valid, so inspect\n `created.delivered` and `created.deliveryError` and retry delivery\n separately with the resend action.\n\n`minted.token` is the one and only place the raw token appears in any response.\nThe server keeps only its hash and cannot return it a second time.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.mintInvitation\"}" } } }, { "name": "List invitation batches", "disabled": true, "request": { "description": "Returns a page of invitation batches in the caller's tenant. A batch groups the invitations minted in one operator action, for example one credential issuance run. Default sort is newest first (`createdAt` descending).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.listInvitationBatches\"}" } } }, { "name": "Mint and deliver a batch of invitations from a source", "disabled": true, "request": { "description": "Mints one invitation per item produced by `source` and delivers each along the\nsupplied channel preferences, recording the whole run as one batch. The\nresponse reports the aggregate mint counters and, when the run was small enough\nto complete synchronously, the delivery counters as well; per-recipient detail\nis read back from the batch endpoints.\n\n`source` is an open extension point. Its required `type` selects the registered\nsource parser and the rest of the object is that parser's own shape. See\n[InvitationBatchSource] for the source types shipped today and for how to send\none this specification does not describe.\n\nRaw tokens are never returned here. Each minted token goes to its recipient over\nthe delivery channel only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.createInvitationBatch\"}" } } }, { "name": "Get an invitation batch", "disabled": true, "request": { "description": "Returns the full detail of a single invitation batch, including its source descriptor and progress counts.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.getInvitationBatch\"}" } } }, { "name": "Resolve a presented invitation token", "disabled": true, "request": { "description": "Exchanges a presented token for the invitation it is bound to. The server hashes\nthe token, looks the record up in the caller's tenant, validates expiry and\nrevocation, and emits an `invitation-opened` event on the first resolve.\n\nThe token travels in the request body, never in the URL. The response describes\nthe invitation but does not echo the token back.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.resolveInvitation\"}" } } }, { "name": "Revoke an invitation by token", "disabled": true, "request": { "description": "Revokes the invitation the presented token is bound to, so it can no longer be redeemed. Idempotent: revoking an already-revoked or otherwise terminal invitation succeeds and changes nothing. Use the cancel action instead when the caller holds the record id rather than the token.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.revokeInvitation\"}" } } }, { "name": "Get an invitation", "disabled": true, "request": { "description": "Returns the full detail of a single invitation, including its mint context, delivery info, and redemption outcome. The invitation token is never returned.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.getInvitation\"}" } } }, { "name": "Cancel an invitation", "disabled": true, "request": { "description": "Revokes an invitation so it can no longer be redeemed. The operation is idempotent: cancelling an already-cancelled invitation returns its current detail without error.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.cancelInvitation\"}" } } }, { "name": "Resend an invitation", "disabled": true, "request": { "description": "Re-delivers an invitation. Because the raw token is never stored, a resend\ncurrently mints a fresh invitation, delivers it, and revokes the original,\nlinking the two. The response reports the mode that was applied (`REISSUED`\ntoday) and returns the effective invitation. A future `RETRIED` mode will\nre-deliver the same token without minting a replacement.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.resendInvitation\"}" } } }, { "name": "List an invitation's events", "disabled": true, "request": { "description": "Returns the append-only audit timeline for one invitation: lifecycle transitions, delivery attempts, and operator actions, in the order they occurred.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"invitation.listInvitationEvents\"}" } } }, { "name": "Redeem an invitation token", "request": { "description": "Public endpoint that the recipient's invite page posts the\ntoken to. The server validates the token, loads the bound batch row, and\nreturns the next step as a flat result discriminated by `type`:\n\n - `RENDER_QR`: issuance is ready. Render a QR for `credentialOfferUrl` (an\n `openid-credential-offer://` URI) for the wallet to scan. `correlationId`\n and `credentialType` are included so the page can poll issuance progress\n and name the credential without re-parsing the URI.\n - `IDV_REDIRECT`: identity verification is required first. Navigate the\n user-agent to `dispatchUrl`.\n - `ERROR`: the flow halted with a message safe to show the recipient in\n `publicMessage`.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/redeem" } }, { "name": "Complete the identity-verification step", "request": { "description": "Public callback invoked by the identity-verification engine after its graph completes. The server stores the verification result against the token and returns a `resumeUrl` so the user-agent can re-enter `POST /redeem` with the verified attributes available.", "method": "POST", "header": [], "url": "{{baseUrl}}/redeem/idv-callback" } } ] } ] }, { "name": "issuance-batch", "description": "Operations associated with the issuance-batch guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "issuance-batch-operations", "description": "issuance-batch-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Run a batch invite", "disabled": true, "request": { "description": "Ingests a recipient table, mints one invitation per row, and hands each\ninvitation to delivery, in a single call.\n\n`mode` selects issuance (default) or verification. Issuance requires\n`credentialConfigurationId`. Verification requires `verifierInstanceId`,\n`clientId`, `dcqlQuery`, and a `responseUri` or `redirectUri`; those values\nare copied onto every row through the tabular source's `sharedContext`,\nbecause a batch row's target is `sourceId:batchId:rowId` and cannot also\nname the verifier.\n\nThe run creates or reuses the tabular source, ingests its rows, creates,\nprepares, and starts the batch, then mints and delivers the invitations. Rows\nthat cannot be minted are rejected individually and reported in\n`rejectedRecipients`; the run itself still succeeds as long as the batch was\nsubmitted. Tenant and caller identity come from the authenticated session.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"issuance-batch.runBatchInvite\"}" } } } ] } ] }, { "name": "kms", "description": "Operations associated with the kms guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "kms-operations", "description": "kms-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List provider capabilities", "disabled": true, "request": { "description": "Returns the capability report for every configured provider. Disabled providers are excluded by default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCapabilities\"}" } } }, { "name": "List certificate-chain aliases", "disabled": true, "request": { "description": "GET /certificate-chains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateChainAliases\"}" } } }, { "name": "Delete a certificate chain", "disabled": true, "request": { "description": "Deletes the EDK certificate-chain reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteCertificateChain\"}" } } }, { "name": "Get a certificate chain", "disabled": true, "request": { "description": "GET /certificate-chains/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateChain\"}" } } }, { "name": "Store a certificate chain", "disabled": true, "request": { "description": "Associates the supplied leaf-to-root certificate chain with the key identified by the path alias. When that key already exists in the selected provider, omit keyInfo or supply public-only key metadata; private key material is neither required nor accepted for the association. The provider must expose certificate-store support.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeCertificateChain\"}" } } }, { "name": "List persisted tenant certificate references", "disabled": true, "request": { "description": "Lists only references in the authenticated tenant index. It never enumerates a provider's certificate inventory and returns public certificate and relationship metadata only.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listCertificateReferences\"}" } } }, { "name": "Get persisted tenant certificate-reference metadata", "disabled": true, "request": { "description": "Returns one public metadata projection from the authenticated tenant reference index.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getCertificateReference\"}" } } }, { "name": "List trusted certificate aliases", "disabled": true, "request": { "description": "GET /certificates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listTrustedCertificateAliases\"}" } } }, { "name": "Generate a certificate signing request", "disabled": true, "request": { "description": "POST /certificates/csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateCertificateSigningRequest\"}" } } }, { "name": "Issue a certificate", "disabled": true, "request": { "description": "POST /certificates/issue. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificate\"}" } } }, { "name": "Issue a certificate from a CSR", "disabled": true, "request": { "description": "POST /certificates/issue-from-csr. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.issueCertificateFromCsr\"}" } } }, { "name": "Register a tenant-owned certificate reference", "disabled": true, "request": { "description": "Registers a provider-native certificate reference or stored public certificate material. Registration does not create/import key material. The stored_public_material source requires certificateChain, a non-empty list of Base64-encoded DER certificates, and rejects provider-native material. The provider_native source requires certificateChain to be omitted and resolves the certificate from provider capability. The key_certificate_chain kind requires linkedKeyAlias or linkedKeyKid and binds the leaf public key. providerCertificateId is optional and identifies a provider certificate when supplied. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. For a provider-native certificate reached through a platform-shared Azure Key Vault provider, the native certificate must carry `sphereon-tenant-id` set to the authenticated tenant id. AWS KMS has no provider-native certificate object API.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerCertificateReference\"}" } } }, { "name": "Delete a trusted certificate", "disabled": true, "request": { "description": "Deletes the EDK certificate reference. Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible with the existing provider and key-store deletion rules.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteTrustedCertificate\"}" } } }, { "name": "Get a trusted certificate", "disabled": true, "request": { "description": "GET /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getTrustedCertificate\"}" } } }, { "name": "Store a trusted certificate", "disabled": true, "request": { "description": "POST /certificates/{alias}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.storeTrustedCertificate\"}" } } }, { "name": "Decrypt data", "disabled": true, "request": { "description": "POST /encryption/decrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.decrypt\"}" } } }, { "name": "Encrypt data", "disabled": true, "request": { "description": "POST /encryption/encrypt. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.encrypt\"}" } } }, { "name": "Perform key agreement", "disabled": true, "request": { "description": "POST /encryption/key-agreement. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.performKeyAgreement\"}" } } }, { "name": "Unwrap a key", "disabled": true, "request": { "description": "POST /encryption/unwrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.unwrapKey\"}" } } }, { "name": "Wrap a key", "disabled": true, "request": { "description": "POST /encryption/wrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.wrapKey\"}" } } }, { "name": "List all managed cryptographic keys across all providers", "disabled": true, "request": { "description": "Lists key metadata across every provider configured for the calling tenant. Only metadata is returned (alias, kid, algorithm, type); private key material is never included. Pass the optional `providerId` query parameter to restrict the listing to a single provider. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeys\"}" } } }, { "name": "Generate a new key (provider chosen from body or default)", "disabled": true, "request": { "description": "Generates a new key. The request body selects the signature algorithm (for example `ECDSA_SHA256`) and may optionally include an `alias`, `use`, `keyOperations`, and a `providerId`. If `providerId` is omitted the default provider is used. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 400 if the requested algorithm or provider is not available.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.generateKey\"}" } } }, { "name": "Import externally supplied key material (provider taken from keyInfo)", "disabled": true, "request": { "description": "Imports a key you already hold into the KMS. The target provider is taken from the `providerId` inside the body's `keyInfo` (for example `testsoftware`), and the alias likewise comes from `keyInfo.alias`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 400 if the keyInfo is missing required fields or names an unknown provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.importKey\"}" } } }, { "name": "Register an existing provider key for platform use", "disabled": true, "request": { "description": "Explicitly onboards a key that already exists inside a provider into the platform's persistent key reference store, so the platform can discover and use it later. The body identifies the key by its `providerId` and exact provider-native `alias`, with an optional canonical `kid`. EDK stores that alias unchanged in the authenticated tenant's reference index; it does not add the backing-alias prefix used for platform-managed generated or imported keys. When the provider is a platform-shared AWS or Azure resource, the native key must carry `sphereon-tenant-id` set to the authenticated tenant id; the assignment is checked again before later use. A tenant-owned provider does not require that shared-provider tag. Registration does not create/import key material; the key must already live in the named provider. The response confirms registration and echoes the alias, providerId, and kid. Returns 400 if the provider or key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.registerKeyReference\"}" } } }, { "name": "Delete a key from the key store by alias or kid", "disabled": true, "request": { "description": "Removes the EDK key reference identified by `aliasOrKid` (its alias or kid). For an externally managed reference, Externally managed DELETE removes only the EDK reference. The provider resource remains untouched. Repeating DELETE for an already deleted externally managed local reference is idempotent and returns 204. Platform-managed behavior remains backward compatible: deletion continues to follow the existing provider and key-store deletion rules. Pass the optional `providerId` query parameter to scope the deletion to a single provider. Returns 204 with no body on success, or 404 if no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.deleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key across the calling tenant's providers by its alias or kid. The `aliasOrKid` path parameter may be the alias (for example `my-signing-key`) or the kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Pass the optional `providerId` query parameter to disambiguate when the same alias exists in more than one provider. Returns 404 if no matching key is found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKey\"}" } } }, { "name": "List configured key providers", "disabled": true, "request": { "description": "Returns every non-internal key provider that is configured and available for the calling tenant. Providers are configured server-side (for example a `SOFTWARE`, `AWS_KMS`, or `AZURE_KEYVAULT` provider); this endpoint does not create them. Internal system providers such as `license` and `platform` are intentionally hidden from this regular KMS REST surface. Use the returned `providerId` (for example `testsoftware`) to scope key operations to a specific provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listKeyProviders\"}" } } }, { "name": "Query matching providers", "disabled": true, "request": { "description": "Returns all providers matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryProviders\"}" } } }, { "name": "Query the best matching provider", "disabled": true, "request": { "description": "Returns the best provider matching the supplied capability criteria.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.queryBestProvider\"}" } } }, { "name": "Get key provider details", "disabled": true, "request": { "description": "Returns the configuration details of a single key provider identified by its `providerId` path parameter (for example `testsoftware`). Returns 404 if no provider with that id is configured for the calling tenant, or if the provider is an internal system provider such as `license` or `platform`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getKeyProvider\"}" } } }, { "name": "Get capabilities for one provider", "disabled": true, "request": { "description": "GET /providers/{providerId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getProviderCapabilities\"}" } } }, { "name": "List all managed cryptographic keys for a provider", "disabled": true, "request": { "description": "Lists the keys managed by the provider identified by `providerId`. Only key metadata is returned (alias, kid, algorithm, type); private key material is never included. Returns 404 if the provider id is unknown for the calling tenant or if it is an internal system provider such as `license` or `platform`. Results are scoped to the calling tenant only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerListKeys\"}" } } }, { "name": "Generate a new key in a provider", "disabled": true, "request": { "description": "Generates a new key inside the provider identified by `providerId`. The request body selects the signature algorithm (for example `ECDSA_SHA256`), and optionally an `alias`, intended `use` (`sig`/`enc`), and `keyOperations`. If no alias is given the provider assigns one. The response contains the generated key pair including its `kid`, `alias`, and the public JWK. Returns 404 if the provider id is unknown, or 400 if the requested algorithm is not supported.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGenerateKey\"}" } } }, { "name": "Import externally supplied key material into a provider", "disabled": true, "request": { "description": "Imports a key that you already hold (its key material is supplied in the request body as a JWK) into the provider identified by `providerId`. The body must carry a fully resolved `keyInfo` (the `key` JWK is required). Returns 404 if the provider id is unknown, or 400 if the supplied keyInfo is invalid.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerImportKey\"}" } } }, { "name": "Delete a key from a provider", "disabled": true, "request": { "description": "Permanently removes the key identified by `aliasOrKid` from the provider identified by `providerId`. The `aliasOrKid` may be the key's alias or its kid. Returns 204 with no body on success, or 404 if the provider id is unknown or no matching key exists. Returns 409 when the key protects active or rollback-retained secrets, has an active assignment, or participates in a migration. There is no force-delete path for an in-use key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerDeleteKey\"}" } } }, { "name": "Get a specific managed key by alias or kid", "disabled": true, "request": { "description": "Looks up a single key in the provider identified by `providerId`. The `aliasOrKid` path parameter may be either the key's alias (for example `my-signing-key`) or its kid (for example `00-qTBov6GxjPSuMNxnk876cMP0JKjbwl4ZyN_sY2tE`). Returns 404 if the provider id is unknown or no key matches the alias or kid in that provider.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.providerGetKey\"}" } } }, { "name": "List all configured key resolvers", "disabled": true, "request": { "description": "Returns every key resolver configured for the calling tenant. A key resolver turns a key reference (a JWK, kid, X.509 chain, or DID) into a concrete public key. Each resolver advertises which identifier methods and key types it supports. The default deployment exposes a resolver with id `jose_cose_resolver`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.listResolvers\"}" } } }, { "name": "Get key resolver details", "disabled": true, "request": { "description": "Returns the configuration of a single key resolver identified by its `resolverId` path parameter (for example `jose_cose_resolver`), including the identifier methods and key types it supports. Returns 404 if no resolver with that id is configured for the calling tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.getResolver\"}" } } }, { "name": "Resolve a public key", "disabled": true, "request": { "description": "Resolves a public key through the resolver identified by `resolverId` (for example `jose_cose_resolver`). The request body carries a `keyInfo` reference to resolve, an optional `identifierMethod` (for example `JWK`, `KID`, `DID`, `X5C`) hinting how to interpret it, optional `trustedCerts`, and an optional `verifyX509CertificateChain` flag. The response is a fully resolved key whose public `key` JWK is guaranteed to be present. Returns 404 if the resolver id is unknown, or 400 if the key reference cannot be resolved.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.resolveKey\"}" } } }, { "name": "Create a raw signature", "disabled": true, "request": { "description": "Produces a raw (detached) cryptographic signature over the supplied bytes using a managed key. The request body identifies the key with a `keyInfo` (by `providerId` plus either `alias` or `kid`) and carries the bytes to sign in `input` as a base64-encoded string; the signature algorithm is taken from the resolved key. The response returns the signature bytes, base64-encoded; only the signature is returned, not the input. Pass the same `input` and `keyInfo` to `/signatures/raw/verify`. Returns 400 if the key cannot be found.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.createRawSignature\"}" } } }, { "name": "Verify a raw signature", "disabled": true, "request": { "description": "Verifies a raw (detached) signature against the original bytes using a managed key. The request body carries the `keyInfo` identifying the verifying key, the original bytes in `input` (base64), and the candidate `signature` (base64). The response is `{ \"isValid\": true }` when the signature matches and `{ \"isValid\": false }` when it does not (for example when the input was tampered with). Verification failures due to a wrong signature return 200 with `isValid: false`, not an error status. Returns 400 only for malformed input.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"kms.isValidRawSignature\"}" } } } ] } ] }, { "name": "license-portal", "description": "Operations associated with the license-portal guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "license-portal-operations", "description": "license-portal-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get the portal dashboard snapshot", "disabled": true, "request": { "description": "GET /. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.licensePortalSnapshot\"}" } } }, { "name": "Get license issuer status", "disabled": true, "request": { "description": "GET /ca. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.licenseIssuerStatus\"}" } } }, { "name": "List contacts", "disabled": true, "request": { "description": "GET /contacts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseContacts\"}" } } }, { "name": "Create a contact", "disabled": true, "request": { "description": "POST /contacts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.createLicenseContact\"}" } } }, { "name": "Update a contact", "disabled": true, "request": { "description": "PUT /contacts/{contactId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.updateLicenseContact\"}" } } }, { "name": "Enable login for a contact", "disabled": true, "request": { "description": "POST /contacts/{contactId}/enable-login. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.enableLicenseContactLogin\"}" } } }, { "name": "List customers", "disabled": true, "request": { "description": "GET /customers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseCustomers\"}" } } }, { "name": "Create a customer", "disabled": true, "request": { "description": "POST /customers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.createLicenseCustomer\"}" } } }, { "name": "Update a customer", "disabled": true, "request": { "description": "PUT /customers/{partyId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.updateLicenseCustomer\"}" } } }, { "name": "Disable a customer", "disabled": true, "request": { "description": "POST /customers/{partyId}/disable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.disableLicenseCustomer\"}" } } }, { "name": "List deployments", "disabled": true, "request": { "description": "GET /deployments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseDeployments\"}" } } }, { "name": "Register a deployment", "disabled": true, "request": { "description": "POST /deployments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.registerLicenseDeployment\"}" } } }, { "name": "Update a deployment", "disabled": true, "request": { "description": "PUT /deployments/{installationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.updateLicenseDeployment\"}" } } }, { "name": "Disable a deployment", "disabled": true, "request": { "description": "POST /deployments/{installationId}/disable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.disableLicenseDeployment\"}" } } }, { "name": "List issued licenses", "disabled": true, "request": { "description": "GET /licenses. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listIssuedLicenses\"}" } } }, { "name": "Issue a license", "disabled": true, "request": { "description": "POST /licenses. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.issueLicense\"}" } } }, { "name": "Issue a protected setup bundle", "disabled": true, "request": { "description": "Issues a license and returns a protected setup bundle. When `requestId`\nis supplied, recipient key and platform certificate data come from\nthe imported license request. When `requestId` is omitted, the portal\ncreates the recipient keypair, certificate, and license in one\noperation and places the activation files in the protected bundle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.issueLicenseBundle\"}" } } }, { "name": "Verify a license artifact", "disabled": true, "request": { "description": "POST /licenses/verify. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.verifyIssuedLicense\"}" } } }, { "name": "Get an issued license", "disabled": true, "request": { "description": "GET /licenses/{licenseId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.getIssuedLicense\"}" } } }, { "name": "Download an issued license", "disabled": true, "request": { "description": "Returns a protected setup bundle ZIP for importing the issued license.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.downloadIssuedLicense\"}" } } }, { "name": "Revoke an issued license", "disabled": true, "request": { "description": "POST /licenses/{licenseId}/revoke. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.revokeIssuedLicense\"}" } } }, { "name": "Get the authenticated portal operator", "disabled": true, "request": { "description": "GET /me. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.getLicensePortalOperator\"}" } } }, { "name": "Assign a partner CA", "disabled": true, "request": { "description": "POST /partner-ca. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.assignLicensePartnerCa\"}" } } }, { "name": "List partners", "disabled": true, "request": { "description": "GET /partners. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicensePartners\"}" } } }, { "name": "Create a partner", "disabled": true, "request": { "description": "POST /partners. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.createLicensePartner\"}" } } }, { "name": "Update a partner", "disabled": true, "request": { "description": "PUT /partners/{partyId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.updateLicensePartner\"}" } } }, { "name": "Create or import a license request", "disabled": true, "request": { "description": "Creates a portal license request. For licensee-initiated issuance,\ninclude the signed platform request artifact generated by the target\nplatform. The artifact is validated by the portal before it is used for\ncertificate and license issuance.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.createLicenseRequest\"}" } } }, { "name": "Preview a license request", "disabled": true, "request": { "description": "POST /requests/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.previewLicenseRequest\"}" } } }, { "name": "List signing assignments", "disabled": true, "request": { "description": "GET /signing-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseSigningAssignments\"}" } } }, { "name": "Assign a signing certificate", "disabled": true, "request": { "description": "POST /signing-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.assignLicenseSigningCertificate\"}" } } }, { "name": "List license templates", "disabled": true, "request": { "description": "GET /templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseTemplates\"}" } } }, { "name": "Create a license template", "disabled": true, "request": { "description": "POST /templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.createLicenseTemplate\"}" } } }, { "name": "List portal tenants", "disabled": true, "request": { "description": "GET /tenants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"license-portal.listLicenseTenants\"}" } } } ] } ] }, { "name": "oid4vci-issuance-template", "description": "Operations associated with the oid4vci-issuance-template guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuance-template-operations", "description": "oid4vci-issuance-template-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List issuance templates", "disabled": true, "request": { "description": "GET /templates/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.listIssuanceTemplates\"}" } } }, { "name": "Create issuance template", "disabled": true, "request": { "description": "POST /templates/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.createIssuanceTemplate\"}" } } }, { "name": "Delete issuance template", "disabled": true, "request": { "description": "DELETE /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.deleteIssuanceTemplate\"}" } } }, { "name": "Get issuance template", "disabled": true, "request": { "description": "GET /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.getIssuanceTemplate\"}" } } }, { "name": "Patch issuance template", "disabled": true, "request": { "description": "PATCH /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.patchIssuanceTemplate\"}" } } }, { "name": "Replace issuance template", "disabled": true, "request": { "description": "PUT /templates/issuance/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.replaceIssuanceTemplate\"}" } } }, { "name": "Create credential offer from issuance template", "disabled": true, "request": { "description": "Resolves the template, merges execution overrides, and calls the existing credential-offer session creation path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuance-template.createCredentialOfferFromIssuanceTemplate\"}" } } } ] } ] }, { "name": "oid4vci-issuer", "description": "Operations associated with the oid4vci-issuer guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuer-operations", "description": "oid4vci-issuer-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Initialise an issuance pipeline session", "disabled": true, "request": { "description": "Allocates a new issuance pipeline session for a registered pipeline configuration,\noptionally seeded with attributes and connector fields known at init time. No phase runs here;\nthis only opens the session. Drive phases afterwards with the contribute endpoint. The\nresponse returns the session id and the resolved correlation handle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.initPipelineSession\"}" } } }, { "name": "Apply an approval-gate decision to a session", "disabled": true, "request": { "description": "Applies an approve or reject decision to a session that is awaiting approval. On approval\nthe session moves towards ready; on rejection it fails. The approver identity is resolved\nfrom the authenticated context and is never supplied in the body. A reason is required on\nrejection.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.approvePipelineSession\"}" } } }, { "name": "Read accumulated session attributes", "disabled": true, "request": { "description": "Returns the attribute values accumulated in the session bag, keyed by attribute path,\nplus the names of any connector fields present on the session. Connector-field values are\nsensitive and are never returned over this API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getSessionAttributes\"}" } } }, { "name": "Contribute attributes to a session", "disabled": true, "request": { "description": "Pushes compact attribute groups and connector fields into an active session as input for the\ncredential-request phase. The session is identified by the path correlation id; the\nattributes and connector fields come from the body. Each record carries provenance: the\nproducing contributor, the phase, the capture time, an optional assurance level, a\nconflict-resolution priority, and a retention policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.contributeAttributes\"}" } } }, { "name": "Contribute attributes via an asynchronous callback", "request": { "description": "Inbound contribution endpoint for a connector contributor that answers out of band. The\ncallback token is the opaque capability artefact minted by the issuer when the contributor was\ndispatched; it is validated and cross-checked against the path correlation id. The body is\nfed into the pipeline as a deferred contribution. Authorisation is carried by the callback\ntoken in the path, so this endpoint does not require a bearer token.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/api/oid4vci/v1/backend/sessions/{correlationId}/callbacks/{callbackToken}" } }, { "name": "Evaluate session attribute completeness", "disabled": true, "request": { "description": "Returns a verdict per credential-claims binding: whether the session's accumulated bag\nsatisfies every mandatory attribute path, which paths are still missing, and whether\ndeferral or approval is indicated. This is a read-only verdict; it does not mutate the\nsession.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.evaluateCompleteness\"}" } } }, { "name": "Mark a contributor's contribution as failed", "disabled": true, "request": { "description": "Records that a single connector contributor could not deliver its contribution to the session.\nA later completeness evaluation can then treat an unsatisfied required contributor as a hard\nmiss rather than waiting indefinitely.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.recordPipelineContributorFailure\"}" } } }, { "name": "Resolve a pre-session data-entry form for a credential configuration", "disabled": true, "request": { "description": "Resolves the same data-entry form as the testing-surface operation of the same name,\nseeded from each bound design claim's `exampleValue`, so an operator can fill in the\nclaim values before an issuance session exists. Unlike the testing operation this path\nis never gated on the instance testing surface being enabled and always requires bearer\ncredentials; the tenant is taken from the token and the instance and configuration are\nscoped exactly as on the testing path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciCredentialConfigurationOperatorForm\"}" } } }, { "name": "Execute an issuer testing action", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/actions/{action}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.executeOid4vciTestingAction\"}" } } }, { "name": "Get issuer testing-surface bootstrap links", "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/oid4vci/v1/testing/instances/{instanceId}/bootstrap" } }, { "name": "Get issuer testing-surface capabilities", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingCapabilities\"}" } } }, { "name": "Resolve a pre-session data-entry form for a credential configuration", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/credential-configurations/{configurationId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingCredentialConfigurationOperatorForm\"}" } } }, { "name": "List event-sourced issuer sessions", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingSessions\"}" } } }, { "name": "Get a issuer session projection", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingSession\"}" } } }, { "name": "List immutable issuer session events", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingSessionEvents\"}" } } }, { "name": "Get the operator form for an issuer session", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingOperatorForm\"}" } } }, { "name": "Amend the operator form values for an issuer session", "disabled": true, "request": { "description": "PUT /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.amendOid4vciTestingOperatorForm\"}" } } }, { "name": "Validate operator-form values for an issuer session", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/sessions/{sessionId}/operator-form/validation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.validateOid4vciTestingOperatorForm\"}" } } }, { "name": "Release a deferred session so the next wallet poll issues", "disabled": true, "request": { "description": "Advances a session that is deferred or awaiting approval so the next wallet poll of the\ndeferred-credential endpoint returns the issued credential. The approver identity is\nresolved from the authenticated context, mirroring approvePipelineSession.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.markOid4vciTestingSessionReady\"}" } } }, { "name": "List issuer testing status lists", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/status-lists. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingStatusLists\"}" } } }, { "name": "Get an issuer testing status-list entry", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/status-lists/{statusListId}/entries/{index}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingStatusListEntry\"}" } } }, { "name": "Update an issuer testing status-list entry", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/status-lists/{statusListId}/entries/{index}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.updateOid4vciTestingStatusListEntry\"}" } } }, { "name": "List issuer testing templates", "disabled": true, "request": { "description": "GET /api/oid4vci/v1/testing/instances/{instanceId}/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.listOid4vciTestingTemplates\"}" } } }, { "name": "Execute an issuer testing template", "disabled": true, "request": { "description": "POST /api/oid4vci/v1/testing/instances/{instanceId}/templates/{templateId}/execute. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.executeOid4vciTestingTemplate\"}" } } }, { "name": "Get the issuer testing workspace", "disabled": true, "request": { "description": "Returns operational dashboard aggregates, credential catalog metadata, and action URLs. AS-protected instances require their exact configured resource grant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer.getOid4vciTestingWorkspace\"}" } } }, { "name": "Get hosted SD-JWT VC type metadata", "request": { "description": "Returns a design-generated SD-JWT VC type metadata document for VCT bindings whose\n`vctHostingMode` is `HOSTED`. External VCTs and plain non-hosted VCT strings are not\nserved from this endpoint.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/public/schema/vct/{vctId}" } } ] } ] }, { "name": "oid4vci-issuer-session", "description": "Operations associated with the oid4vci-issuer-session guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vci-issuer-session-operations", "description": "oid4vci-issuer-session-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a credential offer and its issuance session", "disabled": true, "request": { "description": "Creates a new OID4VCI Credential Offer for the supplied credential configuration ids and\nopens a tracked issuance session for it. The response carries everything needed to start\nthe wallet flow and to follow the session afterwards: the offer URI, an optional QR code\ndata URI (returned only when `qr_code` options were supplied), the transaction code (when a\npre-authorized grant requested one), a `status_uri` for polling, and the `correlation_id`\nthat keys the session.\n\nGrant selection follows the request `grants`. When neither a pre-authorized nor an\nauthorization code grant is given, a pre-authorized code grant is used by default. Supply a\n`correlation_id` to use your own business key, otherwise the server generates one. This\nendpoint is meant to be called from the issuer backend, not from a browser or wallet.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.createCredentialOffer\"}" } } }, { "name": "Delete a credential offer session", "disabled": true, "request": { "description": "Removes all state associated with the credential-offer session identified by its\n`correlation_id`. Use it to clean up after the session completes, after it times out, or to\ncancel an outstanding offer. Returns `204 No Content` on success.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.deleteCredentialOffer\"}" } } }, { "name": "Get credential offer session status", "disabled": true, "request": { "description": "Returns the current status of a credential-offer session identified by its\n`correlation_id`. The response always carries the status and a `last_updated` timestamp.\nWhen the session has reached `credential_issued`, the response also includes\n`issuance_data` (the issued credential configuration ids and credential identifiers). When\nthe session has reached `error`, the response includes an `error` object with a code and\nmessage. Poll this endpoint to follow the session across the issuance lifecycle.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vci-issuer-session.getCredentialOfferStatus\"}" } } } ] } ] }, { "name": "oid4vp-dcql", "description": "Operations associated with the oid4vp-dcql guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-dcql-operations", "description": "oid4vp-dcql-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List DCQL query configurations", "disabled": true, "request": { "description": "Returns every DCQL query configuration belonging to the calling tenant, ordered by `queryId`. Returns an empty array when the tenant has no configurations. Only the calling tenant's configurations are visible.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlQueries\"}" } } }, { "name": "List verifier bindings that reference a DCQL query configuration", "disabled": true, "request": { "description": "Reverse lookup of the verifier bindings that reference the given configuration. Returns an empty array in single-verifier deployments.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlBoundVerifiers\"}" } } }, { "name": "Author a DCQL query from verifiable-credential channels and persist it", "disabled": true, "request": { "description": "Derives a multi-credential DCQL query from the referenced, version-pinned verifiable-credential channels, persists it to the versioned DCQL store under the caller-chosen `queryId`, and records REQUEST-role business-term usage lineage. Authoring an existing `queryId` appends a new version (the version in the response advances monotonically). Requires the `semantic-modeling.v1` feature; without it the request fails with `403` and nothing is persisted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.createAuthoredDcqlQuery\"}" } } }, { "name": "List a verifier's DCQL bindings", "disabled": true, "request": { "description": "Lists the DCQL bindings for the given verifier.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listVerifierDcqlBindings\"}" } } }, { "name": "Create a DCQL query configuration", "disabled": true, "request": { "description": "Creates a new DCQL query configuration for the calling tenant. The `queryId` you supply becomes the stable handle used to reference, update, and delete the configuration later. Fails with `409` if a configuration with the same `queryId` already exists for the tenant, and with `400` if the DCQL query is malformed (for example a query that has neither `credentials` nor `credential_sets`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.createDcqlQuery\"}" } } }, { "name": "Preview a DCQL query derived from verifiable-credential channels, without persisting it", "disabled": true, "request": { "description": "Derives a multi-credential DCQL query from the referenced, version-pinned verifiable-credential channels and returns it together with per-credential-query provenance. Nothing is created or modified. Each channel reference contributes exactly one credential query. Requires the `semantic-modeling.v1` feature; without it the request fails with `403`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.previewDcqlQuery\"}" } } }, { "name": "Delete a DCQL query configuration", "disabled": true, "request": { "description": "Permanently deletes the configuration identified by `{queryId}` for the calling tenant. Returns `204` with no body on success and `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.deleteDcqlQuery\"}" } } }, { "name": "List versions of a DCQL query configuration", "disabled": true, "request": { "description": "GET /queries/{queryId}/versions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listDcqlQueryVersions\"}" } } }, { "name": "Bind a DCQL query to a verifier", "disabled": true, "request": { "description": "POST /verifiers/{verifierId}/bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.bindVerifierDcql\"}" } } }, { "name": "Unbind a DCQL query from a verifier", "disabled": true, "request": { "description": "DELETE /verifiers/{verifierId}/bindings/{queryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.unbindVerifierDcql\"}" } } }, { "name": "Get a DCQL query configuration", "disabled": true, "request": { "description": "Returns the single DCQL query configuration identified by `{queryId}` for the calling tenant. Fails with `404` if no configuration with that `queryId` exists for the tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getDcqlQuery\"}" } } }, { "name": "Get a single version of a DCQL query configuration", "disabled": true, "request": { "description": "GET /queries/{queryId}/versions/{version}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getDcqlQueryVersion\"}" } } }, { "name": "Read a verifier's binding for a DCQL query", "disabled": true, "request": { "description": "GET /verifiers/{verifierId}/bindings/{queryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.getVerifierDcqlBinding\"}" } } }, { "name": "Partially update a DCQL query configuration", "disabled": true, "request": { "description": "Partially updates the configuration identified by `{queryId}`. Only the fields present (and non-null) in the body are changed; every omitted field keeps its stored value. The merge behaviour matches `PUT`, but `PATCH` is the idiomatic verb when changing one or two fields (for example flipping `enabled` to `false` without resending the DCQL query). The `queryId` is taken from the path, never the body. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.patchDcqlQuery\"}" } } }, { "name": "Restore a previous version of a DCQL query configuration", "disabled": true, "request": { "description": "Restores the configuration to the supplied version, creating a new current version with the restored content. Returns the resulting configuration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.restoreDcqlQueryVersion\"}" } } }, { "name": "Advance/roll back the pinned version, toggle enabled, or set the alias", "disabled": true, "request": { "description": "PATCH /verifiers/{verifierId}/bindings/{queryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.updateVerifierDcqlBinding\"}" } } }, { "name": "Replace a DCQL query configuration", "disabled": true, "request": { "description": "Replaces the configuration identified by `{queryId}`. A `PUT` caller supplies every mutable field (`name`, `description`, `dcqlQuery`, `enabled`). The `queryId` is taken from the path and is never read from the body. Any field omitted or sent as `null` leaves the stored value unchanged, so to clear `description` send an empty string rather than `null`. Fails with `404` if the configuration does not exist, and with `400` if a supplied DCQL query is malformed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.replaceDcqlQuery\"}" } } }, { "name": "List the activations for a verifier's DCQL binding", "disabled": true, "request": { "description": "GET /verifiers/{verifierId}/bindings/{queryId}/activations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.listVerifierDcqlBindingActivations\"}" } } }, { "name": "Activate a verifier's DCQL binding", "disabled": true, "request": { "description": "Creates an activation that makes the binding effective for the verifier.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.activateVerifierDcqlBinding\"}" } } }, { "name": "Deactivate a verifier's DCQL binding", "disabled": true, "request": { "description": "DELETE /verifiers/{verifierId}/bindings/{queryId}/activations/{activationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-dcql.deactivateVerifierDcqlBinding\"}" } } } ] } ] }, { "name": "oid4vp-universal", "description": "Operations associated with the oid4vp-universal guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-universal-operations", "description": "oid4vp-universal-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create authorization request and session", "disabled": true, "request": { "description": "Creates a new OID4VP authorization request that can be used to request digital credentials\nfrom a wallet. Returns the URIs needed to start the flow and check its status. The supplied\n`queryId` must be configured on the Relying Party agent.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.create-authorization-request\"}" } } }, { "name": "Remove authorization request state", "disabled": true, "request": { "description": "Deletes all state associated with an authorization request. Use for cleanup after completion or timeout.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.delete-authorization-request\"}" } } }, { "name": "Get authorization session status", "disabled": true, "request": { "description": "Checks the current status of an Authorization Request session. Can optionally include verified credential data\nin the response when the status is 'verified'.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-universal.get-authorization-status\"}" } } } ] } ] }, { "name": "oid4vp-verification-template", "description": "Operations associated with the oid4vp-verification-template guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-verification-template-operations", "description": "oid4vp-verification-template-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List verification templates", "disabled": true, "request": { "description": "GET /templates/verification. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.listVerificationTemplates\"}" } } }, { "name": "Create verification template", "disabled": true, "request": { "description": "POST /templates/verification. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.createVerificationTemplate\"}" } } }, { "name": "Delete verification template", "disabled": true, "request": { "description": "DELETE /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.deleteVerificationTemplate\"}" } } }, { "name": "Get verification template", "disabled": true, "request": { "description": "GET /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.getVerificationTemplate\"}" } } }, { "name": "Patch verification template", "disabled": true, "request": { "description": "PATCH /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.patchVerificationTemplate\"}" } } }, { "name": "Replace verification template", "disabled": true, "request": { "description": "PUT /templates/verification/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.replaceVerificationTemplate\"}" } } }, { "name": "Create authorization request from verification template", "disabled": true, "request": { "description": "Resolves the template, resolves the configured DCQL query/version, merges overrides, and calls the existing authorization-request session creation path.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verification-template.createAuthorizationRequestFromVerificationTemplate\"}" } } } ] } ] }, { "name": "oid4vp-verifier", "description": "Operations associated with the oid4vp-verifier guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "oid4vp-verifier-operations", "description": "oid4vp-verifier-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Execute a verifier testing action", "disabled": true, "request": { "description": "POST /api/oid4vp/v1/testing/instances/{instanceId}/actions/{action}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.executeOid4vpTestingAction\"}" } } }, { "name": "Get verifier testing-console bootstrap links", "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/bootstrap. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.", "method": "GET", "header": [], "url": "{{baseUrl}}/api/oid4vp/v1/testing/instances/{instanceId}/bootstrap" } }, { "name": "Get verifier testing-console capabilities", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/capabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingCapabilities\"}" } } }, { "name": "List event-sourced verifier sessions", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingSessions\"}" } } }, { "name": "Get a verifier session projection", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions/{sessionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingSession\"}" } } }, { "name": "List immutable verifier session events", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/sessions/{sessionId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingSessionEvents\"}" } } }, { "name": "List verifier testing templates", "disabled": true, "request": { "description": "GET /api/oid4vp/v1/testing/instances/{instanceId}/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.listOid4vpTestingTemplates\"}" } } }, { "name": "Execute a verifier testing template", "disabled": true, "request": { "description": "POST /api/oid4vp/v1/testing/instances/{instanceId}/templates/{templateId}/execute. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.executeOid4vpTestingTemplate\"}" } } }, { "name": "Get the verifier testing workspace", "disabled": true, "request": { "description": "Returns operational dashboard aggregates, client/DCQL/template catalog metadata, transport defaults, and action URLs. AS-protected instances require their exact configured resource grant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"oid4vp-verifier.getOid4vpTestingWorkspace\"}" } } } ] } ] }, { "name": "party-manager", "description": "Operations associated with the party-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "party-manager-operations", "description": "party-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List groups", "disabled": true, "request": { "description": "Returns a page of `group` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listGroups\"}" } } }, { "name": "Create a group", "disabled": true, "request": { "description": "POST /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createGroup\"}" } } }, { "name": "Soft-delete a group", "disabled": true, "request": { "description": "DELETE /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteGroup\"}" } } }, { "name": "Get a group", "disabled": true, "request": { "description": "GET /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getGroup\"}" } } }, { "name": "Update a group", "disabled": true, "request": { "description": "PUT /groups/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateGroup\"}" } } }, { "name": "List a group's members", "disabled": true, "request": { "description": "Returns a page of the parties that are members of the group. Members may be of any type, so each item is a polymorphic [PartyEntity].\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listGroupMembers\"}" } } }, { "name": "Replace a group's membership", "disabled": true, "request": { "description": "Replaces the full membership of the group with the supplied set of party ids.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.replaceGroupMembers\"}" } } }, { "name": "Remove a party from a group", "disabled": true, "request": { "description": "Removes the party from the group's membership. Idempotent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.removeGroupMember\"}" } } }, { "name": "Add a party to a group", "disabled": true, "request": { "description": "Adds the party to the group's membership. Idempotent.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addGroupMember\"}" } } }, { "name": "Remove an identity's application binding", "disabled": true, "request": { "description": "DELETE /identities/{identityId}/applications/{applicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteIdentityApplicationBinding\"}" } } }, { "name": "Get an identity's application binding", "disabled": true, "request": { "description": "Returns the binding between an identity and an application's login surface, including the permitted authentication methods and the binding status.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getIdentityApplicationBinding\"}" } } }, { "name": "Bind an identity to an application", "disabled": true, "request": { "description": "Creates or replaces the binding between an identity and an application's login surface, making the identity authenticable against that application with the permitted methods.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.setIdentityApplicationBinding\"}" } } }, { "name": "List organizations", "disabled": true, "request": { "description": "Returns a page of `organization` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizations\"}" } } }, { "name": "Create an organization", "disabled": true, "request": { "description": "POST /organizations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createOrganization\"}" } } }, { "name": "Soft-delete an organization", "disabled": true, "request": { "description": "DELETE /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteOrganization\"}" } } }, { "name": "Get an organization", "disabled": true, "request": { "description": "GET /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getOrganization\"}" } } }, { "name": "Update an organization", "disabled": true, "request": { "description": "PUT /organizations/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateOrganization\"}" } } }, { "name": "List an organization's registrations", "disabled": true, "request": { "description": "Returns the business registrations held by the organization.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationRegistrations\"}" } } }, { "name": "Add a registration to an organization", "disabled": true, "request": { "description": "POST /organizations/{id}/registrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addOrganizationRegistration\"}" } } }, { "name": "List organization units", "disabled": true, "request": { "description": "Returns a page of `organization_unit` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnits\"}" } } }, { "name": "Create an organization unit", "disabled": true, "request": { "description": "POST /ou. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createOrganizationUnit\"}" } } }, { "name": "Soft-delete an organization unit", "disabled": true, "request": { "description": "DELETE /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteOrganizationUnit\"}" } } }, { "name": "Get an organization unit", "disabled": true, "request": { "description": "GET /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getOrganizationUnit\"}" } } }, { "name": "Update an organization unit", "disabled": true, "request": { "description": "PUT /ou/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateOrganizationUnit\"}" } } }, { "name": "List an organization unit's child units", "disabled": true, "request": { "description": "Returns a page of the organization units whose `parentOuId` is this unit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnitChildren\"}" } } }, { "name": "List an organization unit's members", "disabled": true, "request": { "description": "Returns a page of the parties whose home organization unit is this unit. Members may be of any type, so each item is a polymorphic [PartyEntity].\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listOrganizationUnitMembers\"}" } } }, { "name": "List parties of any type", "disabled": true, "request": { "description": "Returns a page of parties in the caller's tenant across all types. Each item is a polymorphic [PartyEntity] discriminated by `partyType`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listParties\"}" } } }, { "name": "Get a party of any type", "disabled": true, "request": { "description": "Returns the party as a polymorphic [PartyEntity], whatever its type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getParty\"}" } } }, { "name": "List a party's electronic addresses", "disabled": true, "request": { "description": "Returns the party's electronic addresses, primary addresses first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listElectronicAddresses\"}" } } }, { "name": "Add an electronic address to a party", "disabled": true, "request": { "description": "POST /parties/{id}/addresses/electronic. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addElectronicAddress\"}" } } }, { "name": "Delete an electronic address", "disabled": true, "request": { "description": "DELETE /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteElectronicAddress\"}" } } }, { "name": "Get one electronic address", "disabled": true, "request": { "description": "GET /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getElectronicAddress\"}" } } }, { "name": "Update an electronic address", "disabled": true, "request": { "description": "PUT /parties/{id}/addresses/electronic/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateElectronicAddress\"}" } } }, { "name": "List a party's physical addresses", "disabled": true, "request": { "description": "Returns the physical and postal addresses attached to the party.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPhysicalAddresses\"}" } } }, { "name": "Add a physical address to a party", "disabled": true, "request": { "description": "POST /parties/{id}/addresses/physical. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.addPhysicalAddress\"}" } } }, { "name": "Delete a physical address", "disabled": true, "request": { "description": "DELETE /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deletePhysicalAddress\"}" } } }, { "name": "Get one physical address", "disabled": true, "request": { "description": "GET /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getPhysicalAddress\"}" } } }, { "name": "Update a physical address", "disabled": true, "request": { "description": "PUT /parties/{id}/addresses/physical/{addressId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updatePhysicalAddress\"}" } } }, { "name": "List a party's relationships", "disabled": true, "request": { "description": "Returns the relationships the party participates in, on either side.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPartyRelationships\"}" } } }, { "name": "List persons", "disabled": true, "request": { "description": "Returns a page of `natural_person` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listPersons\"}" } } }, { "name": "Create a person", "disabled": true, "request": { "description": "POST /persons. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createPerson\"}" } } }, { "name": "Soft-delete a person", "disabled": true, "request": { "description": "DELETE /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deletePerson\"}" } } }, { "name": "Get a person", "disabled": true, "request": { "description": "GET /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getPerson\"}" } } }, { "name": "Update a person", "disabled": true, "request": { "description": "PUT /persons/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updatePerson\"}" } } }, { "name": "List relationships", "disabled": true, "request": { "description": "Returns a page of relationships in the caller's tenant. Filters combine with AND. Use `partyId` to match either side, or `leftId`/`rightId` to match a specific side. Both counter-parties are resolvable to their full [PartyEntity] through the party endpoints.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listRelationships\"}" } } }, { "name": "Create a relationship", "disabled": true, "request": { "description": "POST /relationships. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createRelationship\"}" } } }, { "name": "Delete a relationship", "disabled": true, "request": { "description": "DELETE /relationships/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteRelationship\"}" } } }, { "name": "Get a relationship", "disabled": true, "request": { "description": "Returns a single relationship by id. Both counter-parties are resolvable to their full [PartyEntity] through the party endpoints.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getRelationship\"}" } } }, { "name": "Update a relationship", "disabled": true, "request": { "description": "Updates status, validity end, and verification. Omitted fields are left unchanged.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateRelationship\"}" } } }, { "name": "List services", "disabled": true, "request": { "description": "Returns a page of `service` parties in the caller's tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.listServices\"}" } } }, { "name": "Create a service", "disabled": true, "request": { "description": "POST /services. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.createService\"}" } } }, { "name": "Soft-delete a service", "disabled": true, "request": { "description": "DELETE /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.deleteService\"}" } } }, { "name": "Get a service", "disabled": true, "request": { "description": "GET /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getService\"}" } } }, { "name": "Update a service", "disabled": true, "request": { "description": "PUT /services/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.updateService\"}" } } }, { "name": "Get an application's login configuration", "disabled": true, "request": { "description": "Returns the login-surface configuration for a `service` party that acts as an application: the accepted authentication methods, the identifier types usable to log in, the permitted external IdPs, and whether self-registration is open.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.getApplicationLoginConfig\"}" } } }, { "name": "Set an application's login configuration", "disabled": true, "request": { "description": "Sets the login-surface configuration for a `service` party that acts as an application: the accepted authentication methods, the identifier types usable to log in, the permitted external IdPs, and whether self-registration is open.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"party-manager.setApplicationLoginConfig\"}" } } } ] } ] }, { "name": "platform-admin", "description": "Operations associated with the platform-admin guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-admin-operations", "description": "platform-admin-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get the license status projection", "disabled": true, "request": { "description": "Returns the sanitized status projection of the effective license - lifecycle status, per-product summaries, and expiry signals. Underlying license material, decoded claims, and the entitlement graph are never exposed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationLicense\"}" } } }, { "name": "Get onboarding policy", "disabled": true, "request": { "description": "Returns the onboarding policy toggles that constrain which onboarding flows are accepted.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationOnboarding\"}" } } }, { "name": "Update onboarding policy", "disabled": true, "request": { "description": "Updates the onboarding policy. Every field is optional; a field left\nunset leaves that toggle unchanged. Returns the full updated policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.putApplicationOnboarding\"}" } } }, { "name": "Get evaluated onboarding availability", "disabled": true, "request": { "description": "Returns the evaluated availability matrix composed from license features,\nconfig toggles, and runtime readiness of the application tenant and email\ntransport. Each flow carries a stable reason string\nwhen it is unavailable.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationOnboardingAvailability\"}" } } }, { "name": "Get application tenant status", "disabled": true, "request": { "description": "Returns the runtime state of the application tenant, including the\nreadiness of the platform-hosted authorization server and whether the\nfirst customer tenant can yet be registered.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getApplicationTenant\"}" } } }, { "name": "Create or reconcile the application tenant", "disabled": true, "request": { "description": "Creates the application tenant and its hosted authorization server, or\nreconciles them if they already exist, and returns the resulting state.\nOptional operator contact details seed the initial operator account.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.bootstrapApplicationTenant\"}" } } }, { "name": "Get the feature catalog", "disabled": true, "request": { "description": "Returns the data-driven feature catalog (the assembled FeatureRegistry). Each entry carries the stable feature key, its typed value kind, a description, and the products that may include it. Read-only; drives the admin console feature/entitlement surfaces.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getFeatureCatalog\"}" } } }, { "name": "Get tenant onboarding status", "disabled": true, "request": { "description": "Returns the public-safe lifecycle status of a tenant registration attempt,\nincluding the per-step timeline, keyed by the `correlationId` returned at\nregistration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getTenantOnboardingStatus\"}" } } }, { "name": "List tenants", "disabled": true, "request": { "description": "Lists tenants as a paginated envelope. Supply `parentTenantId` to list the\nchildren of a parent; omit it to list root tenants. Sort by `createdAt` or\n`slug`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenants\"}" } } }, { "name": "Register a tenant", "disabled": true, "request": { "description": "Registers an organization tenant with required natural-person contacts,\na mandatory default authorization server and key store, optional issuer\nand verifier surfaces, and owner/admin account delivery.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.registerTenant\"}" } } }, { "name": "Confirm tenant signup email token", "request": { "description": "Public entry point. Confirms a signup using the plaintext verification\ntoken from the email. When approval is not required the response carries\nthe resulting registration. The verification token is write-only.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/confirm" } }, { "name": "List pending tenant signups", "disabled": true, "request": { "description": "Lists pending signup requests as a paginated envelope. Supply\n`parentTenantId` to scope to a parent; omit it to list root signups. Sort\nby `createdAt` or `email`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listPendingTenantSignups\"}" } } }, { "name": "Mark expired pending tenant signups", "disabled": true, "request": { "description": "Marks pending signup requests whose expiry has passed as expired, relative to the supplied `now`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.reconcileExpiredTenantSignups\"}" } } }, { "name": "Request tenant signup email verification", "request": { "description": "Public entry point. Starts a self-service signup and sends an email\nverification to the supplied address. Returns the signup request id, its\nexpiry, whether operator approval is required, and the email delivery\nresult.\n", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/request" } }, { "name": "Approve pending tenant signup", "disabled": true, "request": { "description": "Approves an email-verified signup request and drives it to registration.\nWhen registration completes the response carries the resulting\nregistration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.approveTenantSignup\"}" } } }, { "name": "Reject pending tenant signup", "disabled": true, "request": { "description": "Rejects a pending signup request with an optional reason.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.rejectTenantSignup\"}" } } }, { "name": "Resend tenant signup email verification", "request": { "description": "Public entry point. Re-mints and resends the verification email for a pending signup request.", "method": "POST", "header": [], "url": "{{baseUrl}}/tenants/signup/{signupRequestId}/resend" } }, { "name": "Delete tenant", "disabled": true, "request": { "description": "Soft-deletes the tenant routing row.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.deleteTenant\"}" } } }, { "name": "Get tenant", "disabled": true, "request": { "description": "Returns a single tenant by id.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.getTenant\"}" } } }, { "name": "List immediate child tenants", "disabled": true, "request": { "description": "Lists the immediate children of a parent tenant as a paginated envelope. Sort by `createdAt` or `slug`.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listSubtenants\"}" } } }, { "name": "List tenant domains", "disabled": true, "request": { "description": "Lists the domains attached to a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenantDomains\"}" } } }, { "name": "Add tenant domain", "disabled": true, "request": { "description": "Attaches a domain (platform subdomain or custom) to a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.addTenantDomain\"}" } } }, { "name": "Remove tenant domain", "disabled": true, "request": { "description": "Detaches a domain from a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.removeTenantDomain\"}" } } }, { "name": "Verify tenant custom domain", "disabled": true, "request": { "description": "Submits a DNS challenge proof to verify a custom domain and returns the\nupdated domain. The verification proof is write-only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.markTenantDomainVerified\"}" } } }, { "name": "Update tenant status", "disabled": true, "request": { "description": "Updates a tenant's lifecycle status and returns the updated tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.updateTenantStatus\"}" } } }, { "name": "List tenant public endpoint bindings", "disabled": true, "request": { "description": "Lists the public endpoint bindings for a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.listTenantPublicEndpoints\"}" } } }, { "name": "Delete tenant public endpoint binding", "disabled": true, "request": { "description": "Deletes the public endpoint binding for a tenant and service type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.deleteTenantPublicEndpoint\"}" } } }, { "name": "Create or update tenant public endpoint binding", "disabled": true, "request": { "description": "Creates or updates the public endpoint binding for a tenant and service type.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-admin.upsertTenantPublicEndpoint\"}" } } } ] } ] }, { "name": "platform-bootstrap", "description": "Operations associated with the platform-bootstrap guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-bootstrap-operations", "description": "platform-bootstrap-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the tenant admin-console context for the exact public host", "request": { "description": "Returns the browser-safe tenant administration context bound to the\nexact public origin supplied by the trusted reverse proxy. The service\nreads `X-Forwarded-Host`, `X-Forwarded-Proto`, and\n`X-Forwarded-Prefix`; it does not accept a tenant id or slug selector.\n\nResolution succeeds only when the host is a non-deleted verified tenant\ndomain, the owning tenant is ACTIVE, and an active OAuth2 authorization\nserver endpoint for the same tenant is registered on that exact host.\nUnknown, unverified, inactive, cross-tenant, and host-mismatched\nrequests all return 404. The response contains no client secret,\ninternal network address, credential, or token.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/admin-console-context" } }, { "name": "Get internal platform bootstrap configuration", "disabled": true, "request": { "description": "Returns the platform-authoritative bootstrap projection for an internal\nconsumer such as a satellite, workload service, frontend server, or\noperator tool.\n\nThe response may include internal Kubernetes or Docker network\naddresses. It is not browser-safe and must be protected by service or\noperator authentication.\n\n`services.tenantKms` is internal service discovery for the tenant-KMS\ngRPC command receiver and its HTTP health endpoint. It never advertises\na public or generic KMS REST API. KMS resource administration remains on\nthe typed platform-config surface.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-bootstrap.getPlatformBootstrapConfig\"}" } } }, { "name": "Get browser-safe application runtime configuration", "request": { "description": "Returns the sanitized runtime configuration response for a known\nplatform-hosted browser application.\n\nKnown application ids include `admin-console`, `platform-onboarding`,\nand `license-portal`. Unknown application ids are rejected. The response\nis safe to expose to browser JavaScript and does not include internal\nKubernetes or Docker addresses, raw secrets, business-authored credential\nartifacts, DCQL query bodies, issuer or verifier designs, or service\nconfiguration bodies.\n\nThe response may use the inbound request origin as the platform base URL.\nThat behavior is for browser runtime wiring only; `.well-known` protocol\nmetadata continues to use the canonical public endpoint binding for the\nresolved tenant/service.\n\nTyped KMS administration is exposed only by the platform-config API.\nBrowser runtime configuration never projects a tenant-KMS service or\ngeneric KMS provider, key, or credential endpoint.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/runtime-config/{applicationId}" } }, { "name": "Resolve the business-wallet context for the exact public host", "request": { "description": "Returns the browser-safe business-wallet context bound to the exact\npublic origin supplied by the trusted reverse proxy. The service reads\n`X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-Prefix`; it\ndoes not accept a tenant id or slug selector.\n\nResolution succeeds only when the host is a non-deleted verified tenant\ndomain, the owning tenant is ACTIVE, an enabled `BUSINESS_WALLET` public\nendpoint for the requested slug is registered on that exact host, the\nwallet capability is ACTIVE and enabled, the effective license of the\nowning tenant grants `business-wallet.standard.v1`, and at least one\nenabled authorization-server binding exists for the wallet. Unknown,\nunverified, inactive, cross-tenant, unlicensed, and host-mismatched\nrequests all return 404. The response contains no client secret,\ninternal network address, credential, or token.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/wallet-context/{slug}" } } ] } ] }, { "name": "platform-config", "description": "Operations associated with the platform-config guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-config-operations", "description": "platform-config-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Get tenant-wide Developer Console configuration", "disabled": true, "request": { "description": "Returns effective tenant defaults and tenant overrides for the Developer Console.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getDeveloperConsoleConfig\"}" } } }, { "name": "Replace tenant-wide Developer Console configuration", "disabled": true, "request": { "description": "Replaces the tenant policy when the supplied revision is current; the response has the next revision.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceDeveloperConsoleConfig\"}" } } }, { "name": "List authorization-server migration entries", "disabled": true, "request": { "description": "Lists only the acting customer tenant's sanitized migration ledger entries. The platform tenant is rejected. Source configuration values, credentials, secret locators, exception messages, and stack traces are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerMigrations\"}" } } }, { "name": "Get an authorization-server migration entry", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-server-migrations/{authorizationServerMigrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerMigration\"}" } } }, { "name": "Accept and retry a reviewed migration source change", "disabled": true, "request": { "description": "Distinct audited operation for an administrator-reviewed source change. It re-reads the source, requires the recorded and current digests plus ledger revision to match the request, records the digest transition and operator reason, and retries the FAILED source. It is not a resume mode. Conflicts and cancellation do not mutate the ledger.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.acceptAuthorizationServerMigrationSourceChange\"}" } } }, { "name": "Resume a failed authorization-server migration", "disabled": true, "request": { "description": "Invokes the coded migration for a FAILED source using revision and source-digest compare-and-set. It never edits a runtime projection or creates a compatibility record. A stale revision, changed digest, APPLIED entry, wrong tenant, or platform tenant fails with conflict or forbidden and does not mutate the ledger.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resumeAuthorizationServerMigration\"}" } } }, { "name": "List authorization-server resources", "disabled": true, "request": { "description": "Lists durable hosted and external resources for the tenant. Runtime configuration projections are not lifecycle authority.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServers\"}" } } }, { "name": "Create a hosted or external authorization-server resource", "disabled": true, "request": { "description": "Creates a durable authorization-server resource. The platform tenant is not a valid target. EXTERNAL registration performs secured OAuth2 and OIDC discovery from the issuer and accepts no manual endpoint overrides. External resources do not consume a license quota; hosted creation consumes the existing hosted-AS entitlement and quota.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServer\"}" } } }, { "name": "Delete an authorization-server resource", "disabled": true, "request": { "description": "Deletes a decommissioned non-system resource and its generated runtime projection.\n\nBusiness wallets log their users in through an authorization server, so this delete is guarded by the wallet binding join. If any business wallet has this AS as its **default** authorization server the request is rejected with `409` unconditionally: `detachBindings` does not override it, because removing a wallet's default AS breaks login for that wallet. Repoint those wallets at another authorization server first. If wallets merely bind this AS without defaulting to it, the delete is still rejected with `409` unless `detachBindings=true`, which removes those binding rows and de-registers the wallets' public clients as part of the delete. Call `listBusinessWallets` with `boundAuthorizationServerId=` (add `boundDefaultOnly=true` for the unrecoverable set) to enumerate the affected wallets before deleting.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServer\"}" } } }, { "name": "Get an authorization-server resource", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServer\"}" } } }, { "name": "Update an authorization-server resource", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServer\"}" } } }, { "name": "Activate an authorization-server resource", "disabled": true, "request": { "description": "Hosted activation enforces the hosted-AS entitlement and quota. External activation is license-unrestricted and requires a current valid discovery snapshot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.activateAuthorizationServer\"}" } } }, { "name": "List AS OAuth2 clients", "disabled": true, "request": { "description": "Lists public and confidential registrations. Confidential entries expose only credential state and opaque typed references.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerClients\"}" } } }, { "name": "Register an AS OAuth2 client", "disabled": true, "request": { "description": "Creates a public or confidential client registration. Raw secrets are accepted only as write-once values stored immediately through secret management and are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerClient\"}" } } }, { "name": "Delete an AS OAuth2 client", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServerClient\"}" } } }, { "name": "Get an AS OAuth2 client", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerClient\"}" } } }, { "name": "Update an AS OAuth2 client", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServerClient\"}" } } }, { "name": "Replace an AS OAuth2 client", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/clients/{clientId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAuthorizationServerClient\"}" } } }, { "name": "Get hosted authorization-server configuration", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getHostedAuthorizationServerConfiguration\"}" } } }, { "name": "Replace hosted authorization-server configuration", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceHostedAuthorizationServerConfiguration\"}" } } }, { "name": "Decommission an authorization-server resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/decommission. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.decommissionAuthorizationServer\"}" } } }, { "name": "Get AS device flow settings", "disabled": true, "request": { "description": "Returns effective RFC 8628 device authorization grant settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsDeviceFlowSettings\"}" } } }, { "name": "Update AS device flow settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to device flow settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsDeviceFlowSettings\"}" } } }, { "name": "Replace AS device flow settings", "disabled": true, "request": { "description": "Replaces device flow settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsDeviceFlowSettings\"}" } } }, { "name": "Refresh external discovery metadata", "disabled": true, "request": { "description": "Fetches, validates, reconciles, and atomically persists a new metadata snapshot and digest. Redirects, private network targets, DNS rebinding, untrusted TLS, oversized responses, issuer contradictions, and unsupported algorithms are rejected.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.refreshExternalAuthorizationServerDiscovery\"}" } } }, { "name": "Get AS feature policy", "disabled": true, "request": { "description": "Returns the effective OAuth/OIDC feature policy for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsFeaturesSettings\"}" } } }, { "name": "Update AS feature policy", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the feature policy. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsFeaturesSettings\"}" } } }, { "name": "Replace AS feature policy", "disabled": true, "request": { "description": "Replaces the feature policy. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsFeaturesSettings\"}" } } }, { "name": "List federation bindings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listFederationBindings\"}" } } }, { "name": "Create a federation binding", "disabled": true, "request": { "description": "The source must be HOSTED and the target must be an EXTERNAL resource with a validated OIDC capability. This operation is license-unrestricted.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createFederationBinding\"}" } } }, { "name": "Replace federation binding order", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/order. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.reorderFederationBindings\"}" } } }, { "name": "Delete a federation binding", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteFederationBinding\"}" } } }, { "name": "Get a federation binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getFederationBinding\"}" } } }, { "name": "Update a federation binding", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateFederationBinding\"}" } } }, { "name": "Disable a federation binding", "disabled": true, "request": { "description": "Disables the binding through its distinct lifecycle operation and returns enabled false with status DISABLED.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.disableFederationBinding\"}" } } }, { "name": "Enable a validated federation binding", "disabled": true, "request": { "description": "Enables only a binding whose latest persisted validation status is VALID. Unvalidated, invalid, stale, or disabled-without-current-validation bindings are rejected with conflict.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.enableFederationBinding\"}" } } }, { "name": "Validate a federation binding", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/federation-bindings/{federationBindingId}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateFederationBinding\"}" } } }, { "name": "Get AS grant settings", "disabled": true, "request": { "description": "Returns effective grant types, response types, and scopes for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsGrantSettings\"}" } } }, { "name": "Update AS grant settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to grant settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsGrantSettings\"}" } } }, { "name": "Replace AS grant settings", "disabled": true, "request": { "description": "Replaces grant settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsGrantSettings\"}" } } }, { "name": "List AS identities", "disabled": true, "request": { "description": "Lists real identities bound to the AS application with activation and delivery lifecycle state.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listAuthorizationServerIdentities\"}" } } }, { "name": "Create an AS identity", "disabled": true, "request": { "description": "Creates or reuses an identity by protected email, adds a suspended AUTHENTICABLE application binding, and sends an activation email when routing is available. The request never accepts a password or activation code. If email is unavailable, the response may contain a one-time manual activation link.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerIdentity\"}" } } }, { "name": "Delete an AS identity", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteAuthorizationServerIdentity\"}" } } }, { "name": "Get an AS identity", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAuthorizationServerIdentity\"}" } } }, { "name": "Enable or disable an AS identity", "disabled": true, "request": { "description": "Updates only this identity's binding to the addressed authorization server. Disabling does not delete the identity or affect bindings to other applications. The authenticated administrator cannot disable their own account.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAuthorizationServerIdentity\"}" } } }, { "name": "Create a one-time manual activation link", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}/activation/manual-link. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createAuthorizationServerIdentityManualActivationLink\"}" } } }, { "name": "Resend an AS identity activation email", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/identities/{identityId}/activation/resend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resendAuthorizationServerIdentityActivation\"}" } } }, { "name": "Send an AS identity password-change email", "disabled": true, "request": { "description": "Only verified primary email identifiers are eligible. No password, token, or manual link is exposed to the operator.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.sendAuthorizationServerIdentityPasswordChange\"}" } } }, { "name": "Get AS interactive authorization settings", "disabled": true, "request": { "description": "Returns effective OID4VCI interactive authorization endpoint (IAE) settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Update AS interactive authorization settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to interactive authorization settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Replace AS interactive authorization settings", "disabled": true, "request": { "description": "Replaces interactive authorization settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsInteractiveAuthorizationSettings\"}" } } }, { "name": "Get AS signed metadata settings", "disabled": true, "request": { "description": "Returns effective signed authorization-server metadata document settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsSignedMetadataSettings\"}" } } }, { "name": "Update AS signed metadata settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to signed metadata settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsSignedMetadataSettings\"}" } } }, { "name": "Replace AS signed metadata settings", "disabled": true, "request": { "description": "Replaces signed metadata settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsSignedMetadataSettings\"}" } } }, { "name": "Get hosted authorization-server signing reference", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/authorization-servers/{authorizationServerId}/signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getHostedAuthorizationServerSigning\"}" } } }, { "name": "Replace hosted authorization-server signing reference", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/authorization-servers/{authorizationServerId}/signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceHostedAuthorizationServerSigning\"}" } } }, { "name": "Suspend an authorization-server resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/authorization-servers/{authorizationServerId}/suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.suspendAuthorizationServer\"}" } } }, { "name": "Get AS token exchange settings", "disabled": true, "request": { "description": "Returns effective RFC 8693 token exchange settings for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsTokenExchangeSettings\"}" } } }, { "name": "Update AS token exchange settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to token exchange settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsTokenExchangeSettings\"}" } } }, { "name": "Replace AS token exchange settings", "disabled": true, "request": { "description": "Replaces token exchange settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsTokenExchangeSettings\"}" } } }, { "name": "Get AS token settings", "disabled": true, "request": { "description": "Returns effective token lifetimes and token behavior for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsTokenSettings\"}" } } }, { "name": "Update AS token settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to token settings. Absent fields stay unchanged. Explicit null clears the tenant override for that field.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsTokenSettings\"}" } } }, { "name": "Replace AS token settings", "disabled": true, "request": { "description": "Replaces token settings. Provided non-null fields become tenant overrides; omitted fields and explicit nulls clear the tenant override and return the field to its default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsTokenSettings\"}" } } }, { "name": "Validate an external authorization server", "disabled": true, "request": { "description": "Performs SSRF-hardened OAuth2 and OIDC discovery without mutating the stored snapshot. HOSTED resources are rejected.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateExternalAuthorizationServer\"}" } } }, { "name": "Get AS WebAuthn login settings", "disabled": true, "request": { "description": "Returns the effective local WebAuthn relying-party policy for the AS instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getAsWebAuthnSettings\"}" } } }, { "name": "Update AS WebAuthn login settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the local WebAuthn relying-party policy.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateAsWebAuthnSettings\"}" } } }, { "name": "Replace AS WebAuthn login settings", "disabled": true, "request": { "description": "Replaces the local WebAuthn relying-party policy. Enabling WebAuthn requires an RP ID and at least one allowed origin.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceAsWebAuthnSettings\"}" } } }, { "name": "List business wallets", "disabled": true, "request": { "description": "Lists the tenant's business wallets, materialized from `wallets..*` config rows and the WALLET capability on each wallet software party.\n\nThe `boundIssuerId`, `boundVerifierId`, and `boundAuthorizationServerId` filters are the reverse lookup over the binding join: they return the wallets that reference the given instance. The console calls this before offering to delete an issuer, verifier, or authorization-server instance, so it can show which wallets would break and decide whether to offer the cascading `detachBindings` delete. Adding `boundDefaultOnly=true` narrows the result to the wallets for which that instance is the default of its kind, which is the set that cannot be repaired by simply dropping the binding.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listBusinessWallets\"}" } } }, { "name": "Create a business wallet", "disabled": true, "request": { "description": "Creates a business wallet for a tenant. The command creates the wallet software party with a WALLET capability, reserves the BUSINESS_WALLET tenant public endpoint for ``, writes descriptor keys under `wallets..*`, and enforces the tenant wallet instance quota `wallet.instances.perTenant.max` before writing. The slug is supplied by the caller and never derived from the display name, because it is part of a permanent public route.\n\nA newly created wallet has no bindings. It cannot serve traffic until at least one authorization-server binding exists.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createBusinessWallet\"}" } } }, { "name": "Delete a business wallet", "disabled": true, "request": { "description": "Soft-deletes the wallet software party, releases its public endpoint reservation, removes every issuer, verifier, and authorization-server binding row of this wallet, and deletes every tenant config key under `wallets..`. Bound issuer, verifier, and authorization-server instances are untouched; only the join rows go away. Wallets flagged `system: true` are protected and are rejected with `409`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteBusinessWallet\"}" } } }, { "name": "Get a business wallet", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWallet\"}" } } }, { "name": "Update a business wallet descriptor", "disabled": true, "request": { "description": "Updates wallet display metadata, edition, enabled state, and public route. `slug` and `partyId` are immutable. Changing `host` or `pathPrefix` re-projects the tenant public endpoint and changes `publicUrl`, which invalidates the redirect URIs registered for the wallet's authorization-server bindings; the command re-registers them against each bound AS.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateBusinessWallet\"}" } } }, { "name": "List business wallet authorization-server bindings", "disabled": true, "request": { "description": "Lists the authorization servers this wallet logs its users in through. Each row is a join between one wallet and one AS instance; the same AS can be bound by other wallets in the same tenant. The row marked `default` is the AS the wallet uses when it does not show an IdP picker.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listBusinessWalletAuthorizationServerBindings\"}" } } }, { "name": "Add a business wallet authorization-server binding", "disabled": true, "request": { "description": "Binds an authorization-server instance to this wallet and registers the OAuth2 client the wallet uses on it. The client is a **public PKCE client** on that AS: it is auto-registered by this operation from the wallet's derived redirect URI (``), it holds no secret, and it appears in the AS client registry afterwards. Adding the same AS twice to one wallet is rejected with `409`; binding an AS that other wallets already use is normal. The first authorization-server binding of a wallet becomes the default automatically, because a wallet with no default AS cannot bootstrap a session.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.addBusinessWalletAuthorizationServerBinding\"}" } } }, { "name": "Remove a business wallet authorization-server binding", "disabled": true, "request": { "description": "Removes the join row and de-registers the wallet's public PKCE client from the bound AS. The authorization-server instance itself is untouched and stays available to the other wallets that bind it.\n\nRemoving the **last** authorization-server binding of a wallet is rejected with `409`: a wallet with no authorization server cannot bootstrap, so the wallet must be deleted instead of being left unreachable. Removing the binding that is currently the wallet's **default** is rejected too, even when others remain: no survivor is promoted, because that would move every user's sign-in to an authorization server nobody chose. Make another binding the default first. The blocking condition is reported in `details`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.removeBusinessWalletAuthorizationServerBinding\"}" } } }, { "name": "Get a business wallet authorization-server binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/authorization-servers/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletAuthorizationServerBinding\"}" } } }, { "name": "Update a business wallet authorization-server binding", "disabled": true, "request": { "description": "Updates the mutable configuration this join row carries. `instanceId` and `clientId` are immutable: the client id names a live public client registration on the bound AS. Setting `default` clears the flag on the wallet's other authorization-server bindings; clearing `default` on the only binding that has it is rejected with `409`, because a wallet with no default authorization server cannot bootstrap a session.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateBusinessWalletAuthorizationServerBinding\"}" } } }, { "name": "Get business wallet branding settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/branding. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletBrandingSettings\"}" } } }, { "name": "Replace business wallet branding settings", "disabled": true, "request": { "description": "Replaces the branding section under `wallets..branding.*` and clears omitted fields back to defaults.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceBusinessWalletBrandingSettings\"}" } } }, { "name": "Get business wallet feature settings", "disabled": true, "request": { "description": "Returns the effective feature flags. Reads are license-clamped: a flag whose backing license feature is not granted to the tenant reads back `false` with `source: license`, whatever the stored tenant value is. Enterprise-only flags therefore read `false` on a `standard` wallet, and become visible again after an edition upgrade without needing a rewrite.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletFeaturesSettings\"}" } } }, { "name": "Replace business wallet feature settings", "disabled": true, "request": { "description": "Replaces the feature section under `wallets..features.*` and clears omitted fields back to defaults. Writes are accepted for every flag whatever the licensed edition is, so an operator can stage a configuration ahead of an upgrade; clamping happens on read.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceBusinessWalletFeaturesSettings\"}" } } }, { "name": "Get business wallet issuance defaults", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/issuance-defaults. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletIssuanceDefaultsSettings\"}" } } }, { "name": "Replace business wallet issuance defaults", "disabled": true, "request": { "description": "Replaces the issuance section under `wallets..issuance.*` and clears omitted fields back to defaults. `defaultIssuerId` must name an issuer instance that this wallet already has a binding to, and `credentialConfigurationIds` must be a subset of what that binding allows.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceBusinessWalletIssuanceDefaultsSettings\"}" } } }, { "name": "List business wallet issuer bindings", "disabled": true, "request": { "description": "Lists the OID4VCI issuer instances bound to this wallet. Each row is a join between one wallet and one issuer; the same issuer can be bound by other wallets in the same tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listBusinessWalletIssuerBindings\"}" } } }, { "name": "Add a business wallet issuer binding", "disabled": true, "request": { "description": "Binds an OID4VCI issuer instance to this wallet. Adding the same issuer twice to one wallet is rejected with `409`; binding an issuer that other wallets already use is normal.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.addBusinessWalletIssuerBinding\"}" } } }, { "name": "Remove a business wallet issuer binding", "disabled": true, "request": { "description": "Removes the join row. The issuer instance itself is untouched and stays available to the other wallets that bind it. Removing the binding that `issuance-defaults.defaultIssuerId` points at also clears that default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.removeBusinessWalletIssuerBinding\"}" } } }, { "name": "Get a business wallet issuer binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/issuers/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletIssuerBinding\"}" } } }, { "name": "Update a business wallet issuer binding", "disabled": true, "request": { "description": "Updates the mutable configuration this join row carries. `instanceId` is immutable; point the wallet at a different issuer by removing this row and adding another. Setting `default` clears the flag on the wallet's other issuer bindings.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateBusinessWalletIssuerBinding\"}" } } }, { "name": "List business wallet memberships", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/members. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listBusinessWalletMemberships\"}" } } }, { "name": "Add a business wallet member", "disabled": true, "request": { "description": "Grants a non-empty set of wallet-local roles to one identity in the same tenant. A timestamp makes the grant effective from that instant. Null records a pending grant that does not authorize until activated by an update.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.addBusinessWalletMembership\"}" } } }, { "name": "Resolve the authenticated wallet membership", "disabled": true, "request": { "description": "Resolves the authenticated principal after token exchange for this tenant and wallet. This operation is intended for a server-side wallet BFF. A missing membership and a membership whose `activatedAt` is null or in the future produce the same not-found response.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getCurrentBusinessWalletMembership\"}" } } }, { "name": "Remove a business wallet membership", "disabled": true, "request": { "description": "Revokes the membership as an auditable write. Existing wallet sessions are rejected at their next bounded membership recheck rather than waiting for the identity token to expire.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.removeBusinessWalletMembership\"}" } } }, { "name": "Get a business wallet membership", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/members/{identityId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletMembership\"}" } } }, { "name": "Update a business wallet membership", "disabled": true, "request": { "description": "Replaces roles and/or activation time. An explicit null `activatedAt` makes the grant ineffective without revoking it. Revocation is the separate DELETE operation.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateBusinessWalletMembership\"}" } } }, { "name": "Get business wallet session settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/session. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletSessionSettings\"}" } } }, { "name": "Replace business wallet session settings", "disabled": true, "request": { "description": "Replaces the session section under `wallets..session.*` and clears omitted fields back to defaults. Changing `redirectPath` or `postLogoutRedirectPath` changes the wallet's derived redirect URI, so the command re-registers the public PKCE client of every authorization-server binding of this wallet. `defaultAuthorizationServerId` must identify an authorization-server binding of this wallet that is marked default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceBusinessWalletSessionSettings\"}" } } }, { "name": "Get business wallet verification defaults", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/verification-defaults. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletVerificationDefaultsSettings\"}" } } }, { "name": "Replace business wallet verification defaults", "disabled": true, "request": { "description": "Replaces the verification section under `wallets..verification.*` and clears omitted fields back to defaults. `defaultVerifierId` must name a verifier instance that this wallet already has a binding to, and `queryIds` must be a subset of what that binding allows.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceBusinessWalletVerificationDefaultsSettings\"}" } } }, { "name": "List business wallet verifier bindings", "disabled": true, "request": { "description": "Lists the OID4VP verifier instances bound to this wallet. Each row is a join between one wallet and one verifier; the same verifier can be bound by other wallets in the same tenant.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listBusinessWalletVerifierBindings\"}" } } }, { "name": "Add a business wallet verifier binding", "disabled": true, "request": { "description": "Binds an OID4VP verifier instance to this wallet. Adding the same verifier twice to one wallet is rejected with `409`; binding a verifier that other wallets already use is normal.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.addBusinessWalletVerifierBinding\"}" } } }, { "name": "Remove a business wallet verifier binding", "disabled": true, "request": { "description": "Removes the join row. The verifier instance itself is untouched and stays available to the other wallets that bind it. Removing the binding that `verification-defaults.defaultVerifierId` points at also clears that default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.removeBusinessWalletVerifierBinding\"}" } } }, { "name": "Get a business wallet verifier binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/business-wallets/{slug}/verifiers/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getBusinessWalletVerifierBinding\"}" } } }, { "name": "Update a business wallet verifier binding", "disabled": true, "request": { "description": "Updates the mutable configuration this join row carries. `instanceId` is immutable. Setting `default` clears the flag on the wallet's other verifier bindings.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateBusinessWalletVerifierBinding\"}" } } }, { "name": "List tenant email accounts", "disabled": true, "request": { "description": "Lists SMTP mail accounts registered for the tenant. For the platform tenant these accounts are named platform defaults; regular tenants can add their own accounts to send mail with their own sender name, address, and SMTP server.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailAccounts\"}" } } }, { "name": "Create an email account", "disabled": true, "request": { "description": "Creates an EXTERNAL software party with an EMAIL_SERVER capability and writes the mail account config under `vdx.service.email.accounts..*`. The optional write-only SMTP password creates the account's typed resource binding; raw secret identifiers, provider references, paths, and environment-variable names are rejected.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailAccount\"}" } } }, { "name": "Delete an email account", "disabled": true, "request": { "description": "Soft-deletes the email account software party and removes its mail config prefix. An account referenced as a local default or explicit assignment must first be removed from the routing policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailAccount\"}" } } }, { "name": "Get an email account", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/accounts/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailAccount\"}" } } }, { "name": "Update an email account", "disabled": true, "request": { "description": "Updates the tenant mail account configuration. The path id is the email account software party id; the stable account id remains the `` segment in the config key prefix. SMTP credentials are created, rotated, or detached only through the account's typed resource mutation and are never returned as secret IDs, locators, or plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateEmailAccount\"}" } } }, { "name": "Send a test email through an account", "disabled": true, "request": { "description": "Sends a test message using the selected tenant email account. The path id is the email account software party id; the server resolves the stable `accountId` and dispatches through the tenant-scoped email service.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.testSendEmailAccount\"}" } } }, { "name": "Create a custom email type and its initial template atomically", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/catalog. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailCatalogEntry\"}" } } }, { "name": "Get email routing policy", "disabled": true, "request": { "description": "Returns the tenant-local account-centric routing policy together with redacted effective resolution for every registered email type. Effective routes use an explicit assignment, local default, then the APP-scoped platform default. Account credentials are never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailRouting\"}" } } }, { "name": "Replace email routing policy", "disabled": true, "request": { "description": "Atomically replaces the local policy. Tenant policies may reference only accounts in that tenant's TENANT scope; the platform policy may reference only APP-scoped platform accounts. An email type may be assigned to only one account. Disabled types never resolve.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.putEmailRouting\"}" } } }, { "name": "List email templates", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailTemplates\"}" } } }, { "name": "Create another template for an existing email type", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailTemplate\"}" } } }, { "name": "Delete a locally owned email template", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/email/templates/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailTemplate\"}" } } }, { "name": "Get an email template and revision history", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/templates/{templateId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailTemplate\"}" } } }, { "name": "Save an email template draft", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/email/templates/{templateId}/draft. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.saveEmailTemplateDraft\"}" } } }, { "name": "Reset a local template override to its inherited layer", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/email/templates/{templateId}/override. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.resetEmailTemplateOverride\"}" } } }, { "name": "Render a branded email template preview", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.previewEmailTemplate\"}" } } }, { "name": "Publish the current email template draft", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/publish. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.publishEmailTemplate\"}" } } }, { "name": "Copy a historical revision into a new draft", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/revisions/{revision}/draft. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.rollbackEmailTemplateToDraft\"}" } } }, { "name": "Send a draft or published template through effective routing", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/templates/{templateId}/test-send. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.testSendEmailTemplate\"}" } } }, { "name": "List registered email types", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/types. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listEmailTypes\"}" } } }, { "name": "Create a custom email type", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/email/types. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createEmailType\"}" } } }, { "name": "Delete a custom email type", "disabled": true, "request": { "description": "System types cannot be deleted. Custom types referenced by templates or routing must be detached first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteEmailType\"}" } } }, { "name": "Get an email type", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/email/types/{emailTypeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getEmailType\"}" } } }, { "name": "Update an email type", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/email/types/{emailTypeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateEmailType\"}" } } }, { "name": "Read the tenant's default KMS provider", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/kms/default-provider. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getDefaultKmsProvider\"}" } } }, { "name": "Set the tenant's default KMS provider", "disabled": true, "request": { "description": "The provider must be one the tenant can currently see: a tenant-owned KMS in CONFIGURED state, or an enabled platform KMS. Anything else returns 400.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.setDefaultKmsProvider\"}" } } }, { "name": "List tenant-visible typed KMS offerings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/kms/offerings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listKmsResourceOfferings\"}" } } }, { "name": "List typed KMS resources", "disabled": true, "request": { "description": "Returns browser-safe resource projections addressed only by opaque handles.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listKmsResources\"}" } } }, { "name": "Create a platform-managed typed KMS resource", "disabled": true, "request": { "description": "Creates approved product-owned provider and credential state without caller-selected internal identities.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createManagedKmsResource\"}" } } }, { "name": "Get safe typed KMS resource configuration", "disabled": true, "request": { "description": "Returns a tenant-owned typed KMS resource by opaque handle. Cloud coordinates are limited to the approved public configuration projection. Credential material, permits, raw locators, product-managed credential references, and platform-owned shared-instance configuration are never returned.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getKmsResourceDetail\"}" } } }, { "name": "Attach, write through, or retain an AWS KMS credential", "disabled": true, "request": { "description": "PRODUCT_MANAGED resources accept an optional write-only secret with their derived reference. TENANT_SUPPLIED resources accept only a tenant-owned secret reference plus providerAssignmentId and never plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachAwsKmsCredential\"}" } } }, { "name": "Attach, write through, or retain an Azure Key Vault credential", "disabled": true, "request": { "description": "PRODUCT_MANAGED resources accept an optional write-only secret with their derived reference. TENANT_SUPPLIED resources accept only a tenant-owned secret reference plus providerAssignmentId and never plaintext.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachAzureKeyVaultCredential\"}" } } }, { "name": "Read SOFTWARE KMS credential status", "disabled": true, "request": { "description": "Returns status and a read-safe credential reference without material.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getSoftwareKmsCredentialStatus\"}" } } }, { "name": "Write or retain a SOFTWARE KMS credential", "disabled": true, "request": { "description": "The credential reference is required. Supplying the optional write-only password writes through to the binding; omitting it retains the current credential.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.writeSoftwareKmsCredential\"}" } } }, { "name": "Upload a SOFTWARE KMS keystore", "disabled": true, "request": { "description": "Replaces the protected uploaded keystore generation for an UPLOADED_FILE resource. The password and keystore bytes are write-only; clients must send the expected resource version and the configured Java keystore type. Re-upload is the only synchronization path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.uploadSoftwareKmsKeystore\"}" } } }, { "name": "Detach a typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/detach. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.detachKmsResource\"}" } } }, { "name": "Change a typed cloud KMS resource reference", "disabled": true, "request": { "description": "Changes validated non-secret cloud coordinates using optimistic resource versioning.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.changeKmsResourceReference\"}" } } }, { "name": "Retire a detached typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/retire. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.retireKmsResource\"}" } } }, { "name": "Rotate a platform-managed KMS credential", "disabled": true, "request": { "description": "Rotates the existing typed credential leaf using a reference-first, write-through body. Plaintext input is write-only and never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.rotateKmsResource\"}" } } }, { "name": "Read which tenants a platform-owned KMS is offered to", "disabled": true, "request": { "description": "Platform tenant only. Returns the tenants this KMS is offered to. A tenant that is not the platform tenant receives 403 regardless of whether the handle exists.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getKmsResourceSharing\"}" } } }, { "name": "Set which tenants a platform-owned KMS is offered to", "disabled": true, "request": { "description": "Platform tenant only. Replaces the allow-list. Removing a tenant that had enabled this KMS revokes its access on the next provider resolution; keys the tenant created in it are retained but become unreachable until the offer is restored.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.setKmsResourceSharing\"}" } } }, { "name": "Validate a typed KMS resource", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/resources/{kmsResourceHandle}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.validateKmsResource\"}" } } }, { "name": "Attach a tenant-managed cloud KMS resource reference", "disabled": true, "request": { "description": "Attaches validated non-secret cloud coordinates; credential authority is attached separately.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.attachKmsResourceReference\"}" } } }, { "name": "List platform KMSes offered to this tenant", "disabled": true, "request": { "description": "Returns the platform-owned KMSes offered to the calling tenant, each flagged with whether the tenant has enabled it. Configuration and credential state of the platform KMS are never included.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listSharedKmsProviders\"}" } } }, { "name": "Stop using an offered platform KMS", "disabled": true, "request": { "description": "Disabling removes the provider from the tenant's KMS REST surface. Keys the tenant created in it are retained and reappear if it is enabled again. Returns 409 when the provider is the tenant's current default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.disableSharedKmsProvider\"}" } } }, { "name": "Enable an offered platform KMS for this tenant", "disabled": true, "request": { "description": "POST /tenants/{tenantId}/kms/shared-providers/{providerId}:enable. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.enableSharedKmsProvider\"}" } } }, { "name": "List OID4VCI issuer instances", "disabled": true, "request": { "description": "Lists OID4VCI issuer instances for the tenant. The implementation is the VDX service-instance issuer command surface mounted under platform-config; instances are software parties with an OID4VCI_ISSUER capability and configuration rooted at `oid4vci.issuers..*`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerInstances\"}" } } }, { "name": "Create an OID4VCI issuer instance", "disabled": true, "request": { "description": "Creates an issuer software party, reserves the tenant public endpoint for the issuer surface, and writes initial issuer configuration under `oid4vci.issuers..*`. `host` and `pathPrefix` drive the public route projection; when omitted the command derives a tenant-safe route prefix.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createOid4vciIssuerInstance\"}" } } }, { "name": "Delete an OID4VCI issuer instance", "disabled": true, "request": { "description": "Soft-deletes the service instance, removes its public endpoint projection, and deletes the issuer config prefix.\n\nIf any business wallet binds this issuer the request is rejected with `409` and the blocking wallets are listed in `details`. Passing `detachBindings=true` cascades instead: the issuer binding rows are removed from those wallets, and a wallet whose issuance default pointed at this issuer has that default cleared. Call `listBusinessWallets` with `boundIssuerId=` first to show the operator what would be detached.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciIssuerInstance\"}" } } }, { "name": "Get an OID4VCI issuer instance", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstance\"}" } } }, { "name": "Update an OID4VCI issuer instance", "disabled": true, "request": { "description": "Updates issuer display metadata and the initial config fields exposed by the service-instance command.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstance\"}" } } }, { "name": "Get OID4VCI issuer catalog-console settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/catalog-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getVdxOid4vciIssuerCatalogConsoleSettings\"}" } } }, { "name": "Update OID4VCI issuer catalog-console settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/catalog-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateVdxOid4vciIssuerCatalogConsoleSettings\"}" } } }, { "name": "Import OID4VCI issuer instance credential configurations from a remote issuer", "disabled": true, "request": { "description": "Fetches issuer metadata from the requested source and materializes the selected `credential_configuration_id` values as per-configuration settings for the instance, optionally creating or updating accompanying credential designs. When `dryRun` is true the planned actions are returned without writing any changes.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.importOid4vciIssuerInstanceCredentialConfigurations\"}" } } }, { "name": "List OID4VCI issuer instance per-configuration non-display settings", "disabled": true, "request": { "description": "Returns the editable NON-DISPLAY settings for every `credential_configuration_id` the issuer instance advertises. The per-locale credential/claim display is owned by the credential-design API and is not part of this resource.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerInstanceCredentialConfigurationSettings\"}" } } }, { "name": "Delete a single OID4VCI issuer instance credential-configuration's non-display settings", "disabled": true, "request": { "description": "Removes the `credential_configuration_id` from the issuer instance's credential-configuration index and clears its non-display settings. Design-authored display and claim metadata are not deleted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciIssuerInstanceCredentialConfigurationSetting\"}" } } }, { "name": "Get a single OID4VCI issuer instance credential-configuration's non-display settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/credential-config-settings/{credentialConfigurationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceCredentialConfigurationSetting\"}" } } }, { "name": "Update a single OID4VCI issuer instance credential-configuration's non-display settings", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to one `credential_configuration_id`. Absent fields stay unchanged. Explicit null clears the field. Design-authored display and claim metadata for the same configuration are left untouched.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstanceCredentialConfigurationSetting\"}" } } }, { "name": "Create or replace a single OID4VCI issuer instance credential-configuration's non-display settings", "disabled": true, "request": { "description": "Upserts the non-display settings for one `credential_configuration_id` and registers it in the issuer instance's credential-configuration index. Scalar and list fields are replaced wholesale; omitted/null fields are cleared. Design-authored display and claim metadata for the same configuration are left untouched.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerInstanceCredentialConfigurationSetting\"}" } } }, { "name": "Get OID4VCI issuer instance credential defaults", "disabled": true, "request": { "description": "Returns the effective issuer-level credential defaults for the instance with per-field source markers. Each field resolves as `issuer` (a default set at this issuer scope) over `default` (the platform default). These defaults form the `issuer` layer beneath per-configuration settings: for a credential configuration the effective value resolves `configuration` over `issuer` over `design` over `default`. Inheritance is live and resolved at read and issuance time, never snapshotted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceCredentialDefaults\"}" } } }, { "name": "Update OID4VCI issuer instance credential defaults", "disabled": true, "request": { "description": "Applies RFC 7386 merge-patch semantics to the issuer credential defaults. Absent fields stay unchanged. Explicit null clears the issuer default for that field and returns it to the platform default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstanceCredentialDefaults\"}" } } }, { "name": "Replace OID4VCI issuer instance credential defaults", "disabled": true, "request": { "description": "Replaces the issuer credential defaults. Provided non-null fields become issuer-level defaults; omitted fields and explicit nulls clear the issuer default and return the field to the platform default.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerInstanceCredentialDefaults\"}" } } }, { "name": "List OID4VCI issuer instance effective per-configuration settings", "disabled": true, "request": { "description": "Returns the effective NON-DISPLAY settings for every advertised `credential_configuration_id` with per-field source markers. For each field the effective value resolves `configuration` (the per-configuration setting) over `issuer` (the issuer credential default) over `design` (identity and display carried by the bound credential design) over `default` (the platform default). Inheritance is live and resolved at read time. A separate `effective-` path segment is used because configuration ids are free-form strings.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerInstanceEffectiveCredentialConfigurationSettings\"}" } } }, { "name": "Get a single OID4VCI issuer instance credential-configuration's effective settings", "disabled": true, "request": { "description": "Returns the effective NON-DISPLAY settings for one `credential_configuration_id` with per-field source markers, resolving `configuration` over `issuer` over `design` over `default`. Inheritance is live and resolved at read time.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceEffectiveCredentialConfigurationSetting\"}" } } }, { "name": "Get VDX OID4VCI issuer issuance settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceIssuanceSettings\"}" } } }, { "name": "Update VDX OID4VCI issuer issuance settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/issuance. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstanceIssuanceSettings\"}" } } }, { "name": "Get VDX OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceMetadataSettings\"}" } } }, { "name": "Update VDX OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstanceMetadataSettings\"}" } } }, { "name": "Replace VDX OID4VCI issuer metadata settings", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/metadata. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerInstanceMetadataSettings\"}" } } }, { "name": "Get VDX OID4VCI issuer security settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/security. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerInstanceSecuritySettings\"}" } } }, { "name": "Update VDX OID4VCI issuer security settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/security. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vciIssuerInstanceSecuritySettings\"}" } } }, { "name": "Get OID4VCI issuer testing-console settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/testing-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getVdxOid4vciIssuerTestingConsoleSettings\"}" } } }, { "name": "Update OID4VCI issuer testing-console settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vci/issuer/instances/{instanceId}/testing-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateVdxOid4vciIssuerTestingConsoleSettings\"}" } } }, { "name": "List an issuer's authorization-server bindings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vciIssuerAuthorizationServerBindings\"}" } } }, { "name": "Bind an authorization server to an issuer", "disabled": true, "request": { "description": "The authorization server must belong to the same tenant and support the issuer's selected grant policy. Exactly one enabled binding must be the default.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Remove an issuer authorization-server binding", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Replace an issuer authorization-server binding", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciIssuerAuthorizationServerBinding\"}" } } }, { "name": "Clear a credential configuration's AS override", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Get a credential configuration's AS override", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Replace a credential configuration's AS override", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciCredentialAuthorizationServerOverride\"}" } } }, { "name": "Clear an issuance template's AS override", "disabled": true, "request": { "description": "DELETE /tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Get an issuance template's AS override", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Replace an issuance template's AS override", "disabled": true, "request": { "description": "Enabled multi-credential templates are rejected if their credentials resolve to different authorization servers.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceOid4vciTemplateAuthorizationServerOverride\"}" } } }, { "name": "Get an issuer's OID4VCI protocol profile", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vci/issuers/{instanceId}/protocol-profile. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vciIssuerProtocolProfile\"}" } } }, { "name": "Atomically apply an OID4VCI profile upgrade", "disabled": true, "request": { "description": "Applies only a compatible preflight at the expected revision, records an audit event, invalidates metadata, and leaves in-flight offers and authorization transactions on their snapshotted starting profile.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.applyOid4vciIssuerProfileUpgrade\"}" } } }, { "name": "Dry-run an OID4VCI profile upgrade", "disabled": true, "request": { "description": "Reports incompatible credentials, metadata, grants, AS bindings, and templates without mutation.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.dryRunOid4vciIssuerProfileUpgrade\"}" } } }, { "name": "List OID4VP verifier instances", "disabled": true, "request": { "description": "Lists OID4VP verifier instances for the tenant. The implementation is the VDX service-instance verifier command surface mounted under platform-config; instances are software parties with an OID4VP_VERIFIER capability and configuration rooted at `oid4vp.verifiers..*`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.listOid4vpVerifierInstances\"}" } } }, { "name": "Create an OID4VP verifier instance", "disabled": true, "request": { "description": "Creates a verifier software party, reserves the tenant public endpoint for the verifier surface, and writes initial verifier configuration under `oid4vp.verifiers..*`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.createOid4vpVerifierInstance\"}" } } }, { "name": "Delete an OID4VP verifier instance", "disabled": true, "request": { "description": "Soft-deletes the service instance, removes its public endpoint projection, and deletes the verifier config prefix.\n\nIf any business wallet binds this verifier the request is rejected with `409` and the blocking wallets are listed in `details`. Passing `detachBindings=true` cascades instead: the verifier binding rows are removed from those wallets, and a wallet whose verification default pointed at this verifier has that default cleared. Call `listBusinessWallets` with `boundVerifierId=` first to show the operator what would be detached.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.deleteOid4vpVerifierInstance\"}" } } }, { "name": "Get an OID4VP verifier instance", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierInstance\"}" } } }, { "name": "Update an OID4VP verifier instance", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierInstance\"}" } } }, { "name": "Get OID4VP verifier catalog-console settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/catalog-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getVdxOid4vpVerifierCatalogConsoleSettings\"}" } } }, { "name": "Update OID4VP verifier catalog-console settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/catalog-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateVdxOid4vpVerifierCatalogConsoleSettings\"}" } } }, { "name": "Get VDX OID4VP verifier client settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/client. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierInstanceClientSettings\"}" } } }, { "name": "Update VDX OID4VP verifier client settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/client. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierInstanceClientSettings\"}" } } }, { "name": "Get VDX OID4VP verifier reconciliation settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/identity-reconciliation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierInstanceReconciliationSettings\"}" } } }, { "name": "Update VDX OID4VP verifier reconciliation settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/identity-reconciliation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierInstanceReconciliationSettings\"}" } } }, { "name": "Get VDX OID4VP request-object signing settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/request-object-signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierInstanceRequestObjectSigningSettings\"}" } } }, { "name": "Update VDX OID4VP request-object signing settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/request-object-signing. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierInstanceRequestObjectSigningSettings\"}" } } }, { "name": "Get VDX OID4VP verifier session settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getOid4vpVerifierInstanceSessionSettings\"}" } } }, { "name": "Update VDX OID4VP verifier session settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/sessions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateOid4vpVerifierInstanceSessionSettings\"}" } } }, { "name": "Get OID4VP verifier testing-console settings", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/testing-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getVdxOid4vpVerifierTestingConsoleSettings\"}" } } }, { "name": "Update OID4VP verifier testing-console settings", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}/oid4vp/verifier/instances/{instanceId}/testing-console. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.updateVdxOid4vpVerifierTestingConsoleSettings\"}" } } }, { "name": "Get a status-list signing key binding", "disabled": true, "request": { "description": "GET /tenants/{tenantId}/status-lists/{statusListId}/signing-key. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.getStatusListSigningKeyBinding\"}" } } }, { "name": "Replace a status-list signing key binding", "disabled": true, "request": { "description": "PUT /tenants/{tenantId}/status-lists/{statusListId}/signing-key. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-config.replaceStatusListSigningKeyBinding\"}" } } } ] } ] }, { "name": "platform-setup", "description": "Operations associated with the platform-setup guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "platform-setup-operations", "description": "platform-setup-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Continue the pending administrator password setup", "disabled": true, "request": { "description": "Validates the browser-bound, HttpOnly setup continuation capability and\nredirects to the one-time account activation page. The endpoint is\navailable only while the durable setup gate remains open, the license\nallows the admin console, and exactly one setup-authorized administrator\nstill has no credential.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.continueSetupAdministratorActivation\"}" } } }, { "name": "Enable the platform tenant and operator login", "disabled": true, "request": { "description": "Creates or reconciles the platform tenant, seeds the platform-integrated\nauthorization server, creates the initial natural-person operator identity, and\nissues its one-time password activation. The first-run gate remains open until\nthat account action writes a usable credential. Production tenants are created\nafterwards through the authenticated platform admin API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.bootstrapPlatform\"}" } } }, { "name": "Import a protected license renewal bundle", "disabled": true, "request": { "description": "POST /license-management/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.importSetupLicenseManagementBundle\"}" } } }, { "name": "Preview a protected license renewal bundle import", "disabled": true, "request": { "description": "POST /license-management/import/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.previewSetupLicenseManagementBundleImport\"}" } } }, { "name": "Get persisted contacts and the latest generated license request", "disabled": true, "request": { "description": "GET /license-management/request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getManagedLicenseRequestState\"}" } } }, { "name": "Validate and persist license contacts without generating a request", "disabled": true, "request": { "description": "PUT /license-management/request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.saveManagedLicenseRequestState\"}" } } }, { "name": "Generate and persist a signed replacement license request", "disabled": true, "request": { "description": "POST /license-management/request/generate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.generateManagedLicenseRequest\"}" } } }, { "name": "Get configured license request defaults", "disabled": true, "request": { "description": "GET /license-request. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupLicenseRequestStatus\"}" } } }, { "name": "Generate a signed local license request", "disabled": true, "request": { "description": "POST /license-request/generate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.generateSetupLicenseRequest\"}" } } }, { "name": "Import a protected setup license bundle", "disabled": true, "request": { "description": "POST /license/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.importSetupLicenseBundle\"}" } } }, { "name": "Preview a protected setup license bundle import", "disabled": true, "request": { "description": "POST /license/import/preview. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.previewSetupLicenseBundleImport\"}" } } }, { "name": "Get persisted first-run onboarding state", "disabled": true, "request": { "description": "Returns the persisted deployment draft and generated license request artifact, if present, so the setup UI can resume after a browser restart.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupOnboardingState\"}" } } }, { "name": "Get first-run setup readiness", "disabled": true, "request": { "description": "GET /status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"platform-setup.getSetupStatus\"}" } } } ] } ] }, { "name": "resource-manager", "description": "Operations associated with the resource-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "resource-manager-operations", "description": "resource-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List bookings", "disabled": true, "request": { "description": "GET /bookings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listBookings\"}" } } }, { "name": "Create booking", "disabled": true, "request": { "description": "Creates a booking and enforces conflict and verification requirements.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createBooking\"}" } } }, { "name": "Cancel booking", "disabled": true, "request": { "description": "DELETE /bookings/{bookingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.cancelBooking\"}" } } }, { "name": "Get booking", "disabled": true, "request": { "description": "GET /bookings/{bookingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getBooking\"}" } } }, { "name": "Update booking", "disabled": true, "request": { "description": "PUT /bookings/{bookingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateBooking\"}" } } }, { "name": "List requirement categories", "disabled": true, "request": { "description": "GET /categories/requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listRequirementCategories\"}" } } }, { "name": "Create requirement category", "disabled": true, "request": { "description": "POST /categories/requirements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createRequirementCategory\"}" } } }, { "name": "Soft-delete requirement category", "disabled": true, "request": { "description": "DELETE /categories/requirements/{requirementCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteRequirementCategory\"}" } } }, { "name": "Get requirement category", "disabled": true, "request": { "description": "GET /categories/requirements/{requirementCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getRequirementCategory\"}" } } }, { "name": "Update requirement category", "disabled": true, "request": { "description": "PATCH /categories/requirements/{requirementCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateRequirementCategory\"}" } } }, { "name": "List resource categories", "disabled": true, "request": { "description": "GET /categories/resources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listResourceCategories\"}" } } }, { "name": "Create resource category", "disabled": true, "request": { "description": "POST /categories/resources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createResourceCategory\"}" } } }, { "name": "Soft-delete resource category", "disabled": true, "request": { "description": "DELETE /categories/resources/{resourceCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteResourceCategory\"}" } } }, { "name": "Get resource category", "disabled": true, "request": { "description": "GET /categories/resources/{resourceCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getResourceCategory\"}" } } }, { "name": "Update resource category", "disabled": true, "request": { "description": "PUT /categories/resources/{resourceCategoryId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateResourceCategory\"}" } } }, { "name": "List resource groups", "disabled": true, "request": { "description": "GET /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listResourceGroups\"}" } } }, { "name": "Create resource group", "disabled": true, "request": { "description": "POST /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createResourceGroup\"}" } } }, { "name": "Soft-delete resource group", "disabled": true, "request": { "description": "DELETE /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteResourceGroup\"}" } } }, { "name": "Get resource group", "disabled": true, "request": { "description": "GET /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getResourceGroup\"}" } } }, { "name": "Update resource group", "disabled": true, "request": { "description": "PUT /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateResourceGroup\"}" } } }, { "name": "List policy assignments", "disabled": true, "request": { "description": "GET /policies/assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listPolicyAssignments\"}" } } }, { "name": "Create policy assignment", "disabled": true, "request": { "description": "POST /policies/assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createPolicyAssignment\"}" } } }, { "name": "Delete policy assignment", "disabled": true, "request": { "description": "DELETE /policies/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deletePolicyAssignment\"}" } } }, { "name": "Get policy assignment", "disabled": true, "request": { "description": "GET /policies/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getPolicyAssignment\"}" } } }, { "name": "Update policy assignment", "disabled": true, "request": { "description": "PATCH /policies/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updatePolicyAssignment\"}" } } }, { "name": "List usage policies", "disabled": true, "request": { "description": "GET /policies/usage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listUsagePolicies\"}" } } }, { "name": "Create usage policy", "disabled": true, "request": { "description": "POST /policies/usage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createUsagePolicy\"}" } } }, { "name": "Get the default usage policy", "disabled": true, "request": { "description": "Returns the default usage policy for the tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getDefaultUsagePolicy\"}" } } }, { "name": "Delete usage policy", "disabled": true, "request": { "description": "DELETE /policies/usage/{usagePolicyId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteUsagePolicy\"}" } } }, { "name": "Get usage policy", "disabled": true, "request": { "description": "GET /policies/usage/{usagePolicyId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getUsagePolicy\"}" } } }, { "name": "Update usage policy", "disabled": true, "request": { "description": "PATCH /policies/usage/{usagePolicyId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateUsagePolicy\"}" } } }, { "name": "List resources", "disabled": true, "request": { "description": "Filterable resource listing scoped by tenant with optional category filtering.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listResources\"}" } } }, { "name": "Create resource", "disabled": true, "request": { "description": "Creates a party-backed resource with optional policy, schedule, and credential requirements.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createResource\"}" } } }, { "name": "Soft-delete resource", "disabled": true, "request": { "description": "DELETE /resources/{resourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteResource\"}" } } }, { "name": "Get resource details", "disabled": true, "request": { "description": "GET /resources/{resourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getResource\"}" } } }, { "name": "Update resource", "disabled": true, "request": { "description": "PUT /resources/{resourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateResource\"}" } } }, { "name": "Get availability grid", "disabled": true, "request": { "description": "GET /resources/{resourceId}/availability. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getResourceAvailability\"}" } } }, { "name": "Get effective policy for a resource", "disabled": true, "request": { "description": "GET /resources/{resourceId}/effective/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getEffectiveResourcePolicy\"}" } } }, { "name": "Get flattened effective schedule rules for a resource", "disabled": true, "request": { "description": "GET /resources/{resourceId}/effective/schedules/rules. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getEffectiveResourceScheduleRules\"}" } } }, { "name": "Get effective schedule set for a resource", "disabled": true, "request": { "description": "GET /resources/{resourceId}/effective/schedules/set. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getEffectiveResourceScheduleSet\"}" } } }, { "name": "List schedule sets", "disabled": true, "request": { "description": "GET /schedules/sets. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listScheduleSets\"}" } } }, { "name": "Create schedule set", "disabled": true, "request": { "description": "POST /schedules/sets. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createScheduleSet\"}" } } }, { "name": "Delete schedule set", "disabled": true, "request": { "description": "DELETE /schedules/sets/{scheduleSetId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteScheduleSet\"}" } } }, { "name": "Get schedule set", "disabled": true, "request": { "description": "GET /schedules/sets/{scheduleSetId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getScheduleSet\"}" } } }, { "name": "Update schedule set", "disabled": true, "request": { "description": "PUT /schedules/sets/{scheduleSetId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateScheduleSet\"}" } } }, { "name": "List schedule set assignments", "disabled": true, "request": { "description": "GET /schedules/sets/{scheduleSetId}/assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.listScheduleSetAssignments\"}" } } }, { "name": "Create schedule set assignment", "disabled": true, "request": { "description": "POST /schedules/sets/{scheduleSetId}/assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createScheduleSetAssignment\"}" } } }, { "name": "Delete schedule set assignment", "disabled": true, "request": { "description": "DELETE /schedules/sets/{scheduleSetId}/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.deleteScheduleSetAssignment\"}" } } }, { "name": "Get schedule set assignment", "disabled": true, "request": { "description": "GET /schedules/sets/{scheduleSetId}/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getScheduleSetAssignment\"}" } } }, { "name": "Update schedule set assignment", "disabled": true, "request": { "description": "PUT /schedules/sets/{scheduleSetId}/assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.updateScheduleSetAssignment\"}" } } }, { "name": "Start a verification", "disabled": true, "request": { "description": "POST /verifications. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.createVerification\"}" } } }, { "name": "Get verification status", "disabled": true, "request": { "description": "GET /verifications/{verificationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"resource-manager.getVerification\"}" } } } ] } ] }, { "name": "secret-management", "description": "Operations associated with the secret-management guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "secret-management-operations", "description": "secret-management-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "listPlatformSecretOfferings", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretOfferings\"}" } } }, { "name": "listPlatformSecretOfferingProviderDefinitions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretOfferingProviderDefinitions\"}" } } }, { "name": "createPlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the offering-provider collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "getPlatformSecretOfferingProviderSetupOptions", "disabled": true, "request": { "description": "Role-correct setup catalog filtered server-side to provider types, authentication modes, configuration fields, capabilities, and isolation modes eligible for backend-isolated platform offerings.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderSetupOptions\"}" } } }, { "name": "retirePlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition; assigned, published, migration-retained, or otherwise referenced definitions cannot retire.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retirePlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "getPlatformSecretOfferingProviderDefinition", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderDefinition\"}" } } }, { "name": "rotatePlatformSecretOfferingProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag and rotates only the published revision resolved by the server.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotatePlatformSecretOfferingProviderCredentials\"}" } } }, { "name": "createPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent platform-offering provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "getPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "stagePlatformSecretOfferingProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed offering candidate revision aggregate ETag; explicit confirmed clear requests use the same fenced transition.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stagePlatformSecretOfferingProviderCredentials\"}" } } }, { "name": "preflightPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "publishPlatformSecretOffering", "disabled": true, "request": { "description": "If-Match fences the path-addressed READY provider revision ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.publishPlatformSecretOffering\"}" } } }, { "name": "markPlatformSecretOfferingProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag; READY requires the persisted, unexpired preflight for this exact revision.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markPlatformSecretOfferingProviderRevisionReady\"}" } } }, { "name": "testPlatformSecretOfferingProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testPlatformSecretOfferingProviderRevision\"}" } } }, { "name": "getPlatformSecretOffering", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/offerings/{offeringId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretOffering\"}" } } }, { "name": "updatePlatformSecretOffering", "disabled": true, "request": { "description": "If-Match fences the path-addressed offering ETag returned by this GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.updatePlatformSecretOffering\"}" } } }, { "name": "getPlatformSecretStorage", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretStorage\"}" } } }, { "name": "listPlatformSecretMigrations", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/migrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretMigrations\"}" } } }, { "name": "startPlatformSecretMigration", "disabled": true, "request": { "description": "If-Match fences the active platform-storage assignment returned by the storage GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.startPlatformSecretMigration\"}" } } }, { "name": "getPlatformSecretMigration", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/migrations/{migrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretMigration\"}" } } }, { "name": "listPlatformSecretProviderDefinitions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listPlatformSecretProviderDefinitions\"}" } } }, { "name": "createPlatformSecretProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the platform provider collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretProviderDefinition\"}" } } }, { "name": "getPlatformSecretProviderSetupOptions", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/options. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderSetupOptions\"}" } } }, { "name": "retirePlatformSecretProviderDefinition", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retirePlatformSecretProviderDefinition\"}" } } }, { "name": "getPlatformSecretProviderDefinition", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderDefinition\"}" } } }, { "name": "rotatePlatformSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotatePlatformSecretProviderCredentials\"}" } } }, { "name": "createPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createPlatformSecretProviderRevision\"}" } } }, { "name": "getPlatformSecretProviderRevision", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/storage/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getPlatformSecretProviderRevision\"}" } } }, { "name": "stagePlatformSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stagePlatformSecretProviderCredentials\"}" } } }, { "name": "preflightPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightPlatformSecretProviderRevision\"}" } } }, { "name": "markPlatformSecretProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markPlatformSecretProviderRevisionReady\"}" } } }, { "name": "testPlatformSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testPlatformSecretProviderRevision\"}" } } }, { "name": "getGlobalTenantSecretPolicy", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getGlobalTenantSecretPolicy\"}" } } }, { "name": "updateGlobalTenantSecretPolicy", "disabled": true, "request": { "description": "If-Match fences the global policy ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.updateGlobalTenantSecretPolicy\"}" } } }, { "name": "listTenantSecretPolicyOverrides", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy/overrides. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretPolicyOverrides\"}" } } }, { "name": "deleteTenantSecretPolicyOverride", "disabled": true, "request": { "description": "If-Match fences the path-addressed override ETag; deleting restores global inheritance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.deleteTenantSecretPolicyOverride\"}" } } }, { "name": "getTenantSecretPolicyOverride", "disabled": true, "request": { "description": "GET /platform/admin/v1/application/secrets/tenant-policy/overrides/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretPolicyOverride\"}" } } }, { "name": "putTenantSecretPolicyOverride", "disabled": true, "request": { "description": "If-Match fences the item ETag, or the override collection ETag when creating a missing override.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.putTenantSecretPolicyOverride\"}" } } }, { "name": "getTenantSecretAssignment", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/assignment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretAssignment\"}" } } }, { "name": "listTenantSecretMigrations", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/migrations. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretMigrations\"}" } } }, { "name": "startTenantSecretMigration", "disabled": true, "request": { "description": "If-Match fences the active tenant assignment returned by the assignment GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.startTenantSecretMigration\"}" } } }, { "name": "getTenantSecretMigration", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/migrations/{migrationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretMigration\"}" } } }, { "name": "preflightTenantSecretOffering", "disabled": true, "request": { "description": "If-Match must be the selected option's `preflightEtag`; it fences the path-addressed target offering aggregate before issuing the short-lived migration preflight result.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightTenantSecretOffering\"}" } } }, { "name": "getTenantSecretOptions", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/options. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretOptions\"}" } } }, { "name": "listTenantSecretProviders", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretProviders\"}" } } }, { "name": "createTenantSecretProvider", "disabled": true, "request": { "description": "If-Match fences the tenant provider collection and effective-policy version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretProvider\"}" } } }, { "name": "retireTenantSecretProvider", "disabled": true, "request": { "description": "If-Match fences the path-addressed tenant provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.retireTenantSecretProvider\"}" } } }, { "name": "getTenantSecretProvider", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers/{definitionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretProvider\"}" } } }, { "name": "rotateTenantSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences the path-addressed provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotateTenantSecretProviderCredentials\"}" } } }, { "name": "createTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences the parent tenant provider definition ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretProviderRevision\"}" } } }, { "name": "getTenantSecretProviderRevision", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/providers/{definitionId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretProviderRevision\"}" } } }, { "name": "stageTenantSecretProviderCredentials", "disabled": true, "request": { "description": "If-Match fences and bumps the path-addressed candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.stageTenantSecretProviderCredentials\"}" } } }, { "name": "preflightTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.preflightTenantSecretProviderRevision\"}" } } }, { "name": "markTenantSecretProviderRevisionReady", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.markTenantSecretProviderRevisionReady\"}" } } }, { "name": "testTenantSecretProviderRevision", "disabled": true, "request": { "description": "If-Match fences and bumps the candidate revision aggregate ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.testTenantSecretProviderRevision\"}" } } }, { "name": "listTenantSecretValues", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/values. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.listTenantSecretValues\"}" } } }, { "name": "createTenantSecretValue", "disabled": true, "request": { "description": "If-Match fences the active assignment and secret-value collection version returned by this collection GET.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.createTenantSecretValue\"}" } } }, { "name": "getTenantSecretValue", "disabled": true, "request": { "description": "GET /platform/config/v1/tenants/{tenantId}/secrets/values/{secretId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.getTenantSecretValue\"}" } } }, { "name": "rotateTenantSecretValue", "disabled": true, "request": { "description": "If-Match fences the path-addressed secret handle ETag.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"secret-management.rotateTenantSecretValue\"}" } } } ] } ] }, { "name": "semantic-binding", "description": "Operations associated with the semantic-binding guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "semantic-binding-operations", "description": "semantic-binding-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List semantic party attribute values", "disabled": true, "request": { "description": "Returns a page of party attribute values in the calling tenant, optionally scoped to one\nparty. Pagination accepts both `limit`/`offset` and OpenAPI-style `page`/`size`; `limit`\nis clamped to `[1, 100]` (default `20`). Default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.listSemanticPartyAttributeValues\"}" } } }, { "name": "Create a semantic party attribute value", "disabled": true, "request": { "description": "POST /partyattributevalues. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.createSemanticPartyAttributeValue\"}" } } }, { "name": "Soft-delete a semantic party attribute value", "disabled": true, "request": { "description": "DELETE /partyattributevalues/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.deleteSemanticPartyAttributeValue\"}" } } }, { "name": "Get one semantic party attribute value", "disabled": true, "request": { "description": "GET /partyattributevalues/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.getSemanticPartyAttributeValue\"}" } } }, { "name": "Update a semantic party attribute value", "disabled": true, "request": { "description": "PUT /partyattributevalues/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.updateSemanticPartyAttributeValue\"}" } } }, { "name": "List semantic party-type bindings", "disabled": true, "request": { "description": "Returns a page of party-type bindings in the calling tenant, narrowed by the optional\nfilter. Pagination accepts both `limit`/`offset` and OpenAPI-style `page`/`size`; the\nparser normalises and clamps `limit` to `[1, 100]` (default `20`). Default sort is\n`createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.listSemanticPartyTypeBindings\"}" } } }, { "name": "Create a semantic party-type binding", "disabled": true, "request": { "description": "POST /partytypebindings. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.createSemanticPartyTypeBinding\"}" } } }, { "name": "Soft-delete a semantic party-type binding", "disabled": true, "request": { "description": "DELETE /partytypebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.deleteSemanticPartyTypeBinding\"}" } } }, { "name": "Get one semantic party-type binding", "disabled": true, "request": { "description": "GET /partytypebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.getSemanticPartyTypeBinding\"}" } } }, { "name": "Update a semantic party-type binding", "disabled": true, "request": { "description": "PUT /partytypebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.updateSemanticPartyTypeBinding\"}" } } }, { "name": "List semantic relationship bindings", "disabled": true, "request": { "description": "Returns a page of relationship bindings in the calling tenant, optionally scoped to a\nsubject party, object party, and/or governed relation type (e.g. to read all roles a\ngiven subject party holds). Pagination accepts both `limit`/`offset` and OpenAPI-style\n`page`/`size`; `limit` is clamped to `[1, 100]` (default `20`). Default sort is\n`createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.listSemanticRelationshipBindings\"}" } } }, { "name": "Create a semantic relationship binding", "disabled": true, "request": { "description": "Creates a relationship binding. The create command validates `relationType` against the\nthe relationship-type registry and, when the optional endpoint party types are supplied,\nchecks endpoint compatibility.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.createSemanticRelationshipBinding\"}" } } }, { "name": "Soft-delete a semantic relationship binding", "disabled": true, "request": { "description": "DELETE /relationshipbindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.deleteSemanticRelationshipBinding\"}" } } }, { "name": "Get one semantic relationship binding", "disabled": true, "request": { "description": "GET /relationshipbindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.getSemanticRelationshipBinding\"}" } } }, { "name": "Update a semantic relationship binding", "disabled": true, "request": { "description": "Re-validates the governed relation type and endpoint compatibility before persisting.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.updateSemanticRelationshipBinding\"}" } } }, { "name": "List semantic service capabilities", "disabled": true, "request": { "description": "Returns a page of service-capability declarations in the calling tenant, optionally\nscoped to one service id. Pagination accepts both `limit`/`offset` and OpenAPI-style\n`page`/`size`; `limit` is clamped to `[1, 100]` (default `20`). Default sort is\n`createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.listSemanticServiceCapabilities\"}" } } }, { "name": "Create a semantic service capability", "disabled": true, "request": { "description": "POST /servicecapabilities. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.createSemanticServiceCapability\"}" } } }, { "name": "Soft-delete a semantic service capability", "disabled": true, "request": { "description": "DELETE /servicecapabilities/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.deleteSemanticServiceCapability\"}" } } }, { "name": "Get one semantic service capability", "disabled": true, "request": { "description": "GET /servicecapabilities/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.getSemanticServiceCapability\"}" } } }, { "name": "Update a semantic service capability", "disabled": true, "request": { "description": "PUT /servicecapabilities/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.updateSemanticServiceCapability\"}" } } }, { "name": "List semantic source bindings", "disabled": true, "request": { "description": "Returns a page of source bindings in the calling tenant, optionally scoped to a source party\nand/or the bound data domain. Pagination accepts both `limit`/`offset` and OpenAPI-style\n`page`/`size`; `limit` is clamped to `[1, 100]` (default `20`). Default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.listSemanticSourceBindings\"}" } } }, { "name": "Bind a registered connector to data-domain business terms", "disabled": true, "request": { "description": "Binds a registered connector/software party carrying a `CONNECTOR`\ncapability to business terms in a version-pinned data domain. The connector's native fields map onto\nbusiness-term paths and inherit those terms' governance overlays; whether the resolved\nvalues are stored or only referenced is controlled by `materialization`. The id, tenant and\ntimestamps are assigned by the command (tenant from the session).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.createSemanticSourceBinding\"}" } } }, { "name": "Soft-delete a semantic source binding", "disabled": true, "request": { "description": "DELETE /sourcebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.deleteSemanticSourceBinding\"}" } } }, { "name": "Get one semantic source binding", "disabled": true, "request": { "description": "GET /sourcebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.getSemanticSourceBinding\"}" } } }, { "name": "Update a semantic source binding", "disabled": true, "request": { "description": "PUT /sourcebindings/{id}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-binding.updateSemanticSourceBinding\"}" } } } ] } ] }, { "name": "semantic-model-authoring", "description": "Operations associated with the semantic-model-authoring guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "semantic-model-authoring-operations", "description": "semantic-model-authoring-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List credential-branding records for the calling tenant", "disabled": true, "request": { "description": "GET /branding. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listCredentialBrandings\"}" } } }, { "name": "Create a draft credential-branding record", "disabled": true, "request": { "description": "POST /branding. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createCredentialBranding\"}" } } }, { "name": "Delete a credential-branding record by id", "disabled": true, "request": { "description": "DELETE /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteCredentialBranding\"}" } } }, { "name": "Get a credential-branding record by id", "disabled": true, "request": { "description": "GET /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getCredentialBranding\"}" } } }, { "name": "Update a draft credential-branding record's name, description, locales, or layout", "disabled": true, "request": { "description": "PATCH /branding/{brandingId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateCredentialBranding\"}" } } }, { "name": "Toggle credential-branding status (draft <-> published)", "disabled": true, "request": { "description": "PUT /branding/{brandingId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setCredentialBrandingStatus\"}" } } }, { "name": "Bump the credential-branding record's snapshot version", "disabled": true, "request": { "description": "POST /branding/{brandingId}/version. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotBrandingVersion\"}" } } }, { "name": "List channels for the calling tenant", "disabled": true, "request": { "description": "Returns a page of channels matching the optional filter, each as a channel\nenvelope ({channel, definition}). Pagination accepts both `limit`/`offset` and OpenAPI-style\n`page`/`size`; the parser normalises and clamps `limit` to `[1, 100]` (default `20`).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listChannels\"}" } } }, { "name": "Create an API-payload definition for one data product", "disabled": true, "request": { "description": "POST /channels/api. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createApiPayloadChannel\"}" } } }, { "name": "Replace an API-payload definition's content", "disabled": true, "request": { "description": "PUT /channels/api/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateApiPayloadChannel\"}" } } }, { "name": "Create a verifiable-credential definition for one data product", "disabled": true, "request": { "description": "POST /channels/credentials. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createVerifiableCredentialChannel\"}" } } }, { "name": "Replace a verifiable-credential definition's content", "disabled": true, "request": { "description": "PUT /channels/credentials/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateVerifiableCredentialChannel\"}" } } }, { "name": "List FORM channels (optional nameContains/dataProductId filters)", "disabled": true, "request": { "description": "GET /channels/forms. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listFormChannels\"}" } } }, { "name": "Create a form definition binding one data product to a capture form", "disabled": true, "request": { "description": "POST /channels/forms. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createFormChannel\"}" } } }, { "name": "Get a FORM channel by id", "disabled": true, "request": { "description": "GET /channels/forms/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getFormChannel\"}" } } }, { "name": "Replace a form definition's content", "disabled": true, "request": { "description": "PUT /channels/forms/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateFormChannel\"}" } } }, { "name": "Set a FORM channel's publication state", "disabled": true, "request": { "description": "PUT /channels/forms/{channelId}/publication. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.publishFormChannel\"}" } } }, { "name": "Create an OID4VCI issuance definition for one data product", "disabled": true, "request": { "description": "POST /channels/oid4vci. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createOid4vciIssuanceChannel\"}" } } }, { "name": "Replace an OID4VCI issuance definition's content", "disabled": true, "request": { "description": "PUT /channels/oid4vci/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateOid4vciIssuanceChannel\"}" } } }, { "name": "Create a PDF/document definition for one data product", "disabled": true, "request": { "description": "POST /channels/pdf. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createPdfDocumentChannel\"}" } } }, { "name": "Replace a PDF/document definition's content", "disabled": true, "request": { "description": "PUT /channels/pdf/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updatePdfDocumentChannel\"}" } } }, { "name": "Delete a channel by id", "disabled": true, "request": { "description": "DELETE /channels/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteChannel\"}" } } }, { "name": "Get a channel by id (returned as a channel envelope)", "disabled": true, "request": { "description": "GET /channels/{channelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getChannel\"}" } } }, { "name": "List data-domain identities and revision pointers", "disabled": true, "request": { "description": "GET /data-domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomains\"}" } } }, { "name": "Create the stable data-domain identity and initial draft revision", "disabled": true, "request": { "description": "POST /data-domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomain\"}" } } }, { "name": "Get a data-domain identity and revision pointers", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomain\"}" } } }, { "name": "List publications", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainPublications\"}" } } }, { "name": "Create a publication for an approved revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/publications. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainPublication\"}" } } }, { "name": "Get a publication", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainPublication\"}" } } }, { "name": "List publication notices", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}/notices. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainPublicationNotices\"}" } } }, { "name": "Create a publication notice", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/publications/{publicationId}/notices. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainPublicationNotice\"}" } } }, { "name": "Get a publication notice", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/publications/{publicationId}/notices/{noticeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainPublicationNotice\"}" } } }, { "name": "List revisions", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainRevisions\"}" } } }, { "name": "Create a draft revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainRevision\"}" } } }, { "name": "Delete a draft revision", "disabled": true, "request": { "description": "DELETE /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteDataDomainDraftRevision\"}" } } }, { "name": "Get an exact pinned revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevision\"}" } } }, { "name": "Replace draft revision content", "disabled": true, "request": { "description": "PUT /data-domains/{dataDomainId}/revisions/{revision}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.replaceDataDomainDraftRevision\"}" } } }, { "name": "Get the exact published revision content", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/composed. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevisionComposed\"}" } } }, { "name": "Project exact revision governance as an ODRL Offer", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainGovernancePolicy\"}" } } }, { "name": "List reviews for an exact revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainReviews\"}" } } }, { "name": "Create a review for an exact draft revision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions/{revision}/reviews. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainReview\"}" } } }, { "name": "Get a review", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainReview\"}" } } }, { "name": "List immutable decisions for a review", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainReviewDecisions\"}" } } }, { "name": "Record an immutable review decision", "disabled": true, "request": { "description": "POST /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataDomainReviewDecision\"}" } } }, { "name": "Get an immutable review decision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/reviews/{reviewId}/decisions/{decisionId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainReviewDecision\"}" } } }, { "name": "List usages for an exact data-domain revision", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/usages. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataDomainRevisionUsages\"}" } } }, { "name": "Validate the exact revision content", "disabled": true, "request": { "description": "GET /data-domains/{dataDomainId}/revisions/{revision}/validation. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataDomainRevisionValidation\"}" } } }, { "name": "List data products for the calling tenant", "disabled": true, "request": { "description": "Returns a page of data products matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Sort is constrained to an allow-list (`name`, `createdAt`,\n`updatedAt`, `version`); the default is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listDataProducts\"}" } } }, { "name": "Create a draft data product narrowing one published object model", "disabled": true, "request": { "description": "POST /data-products. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createDataProduct\"}" } } }, { "name": "Delete an data product by id", "disabled": true, "request": { "description": "DELETE /data-products/{dataProductId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteDataProduct\"}" } } }, { "name": "Get an data product by id", "disabled": true, "request": { "description": "GET /data-products/{dataProductId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getDataProduct\"}" } } }, { "name": "Update a draft data product's name, description, selection or overrides", "disabled": true, "request": { "description": "Partial update of a DRAFT data product. Each field is optional; a null (or absent) field leaves the\ncorresponding value unchanged. The object model reference, lifecycle status and version are not\neditable here. Updating a PUBLISHED data product is a conflict.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateDataProduct\"}" } } }, { "name": "Resolve an data product into its effective contract", "disabled": true, "request": { "description": "Resolves the data product against the object model its `objectModelRef` pins, restricts to the selected paths,\nand applies the narrow-only member overrides, yielding the effective contract a downstream\ncredential definition consumes. This is a read and is not license-gated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.resolveDataProduct\"}" } } }, { "name": "Replace a draft data product's selection entries wholesale", "disabled": true, "request": { "description": "Replaces the data product's `selected` entries wholesale. Overrides are untouched; an override whose\n`(roleRef, path)` is no longer selected is rejected by validation. The data product must be in DRAFT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setDataProductSelection\"}" } } }, { "name": "Toggle data product status (draft <-> published)", "disabled": true, "request": { "description": "PUT /data-products/{dataProductId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setDataProductStatus\"}" } } }, { "name": "Bump the data product's snapshot version", "disabled": true, "request": { "description": "Bumps the data product's monotonic snapshot `version` by one. No request body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotDataProductVersion\"}" } } }, { "name": "List object models for the calling tenant", "disabled": true, "request": { "description": "Returns a page of object models matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Sort is constrained to an allow-list; the default is\n`createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.listObjectModels\"}" } } }, { "name": "Create a draft object model", "disabled": true, "request": { "description": "POST /objects. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.createObjectModel\"}" } } }, { "name": "Delete an object model by id", "disabled": true, "request": { "description": "DELETE /objects/{objectModelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.deleteObjectModel\"}" } } }, { "name": "Get an object model by id", "disabled": true, "request": { "description": "GET /objects/{objectModelId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.getObjectModel\"}" } } }, { "name": "Update an object model's name or description", "disabled": true, "request": { "description": "Partial update of an object model's mutable metadata (name, description). Each field is optional; a\nnull (or absent) field leaves the corresponding value unchanged. Domain refs, roles,\nrelationships, overrides, version and status have their own endpoints.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.updateObjectModel\"}" } } }, { "name": "Set (replace) the domain refs of an object model", "disabled": true, "request": { "description": "Replaces the whole domain-ref set wholesale. The reconstructed object model enforces the\nat-most-one-ref-per-data-domain invariant and that roles and relationships still reference\nreferenced data domains.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelDomainRefs\"}" } } }, { "name": "Set (replace) the narrow-only overrides of an object model", "disabled": true, "request": { "description": "Replaces the narrow-only per-attribute override set wholesale. The reconstructed object model\nvalidates that each override references a declared role; the data-domain-aware widening check\nrejects any override that would widen rather than narrow the data-domain attribute.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelOverrides\"}" } } }, { "name": "Set (replace) the relationships of an object model", "disabled": true, "request": { "description": "Replaces the selected data-domain relationship set wholesale. The reconstructed object model validates\nthat each relationship references a data domain the object model refers to and resolves to a real data-domain\nrelationship whose ends are bound by the object model's roles.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelRelationships\"}" } } }, { "name": "Resolve an object model into its effective object-graph projection", "disabled": true, "request": { "description": "Resolves the object model across its referenced data-domain snapshots: each role composes its bound\nobject type (root plus applied specializations) with the object model's narrow-only overrides applied,\nand each selected relationship is projected over the bound roles, yielding the effective\nobject-graph projection. This is a read and is not license-gated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.resolveObjectModel\"}" } } }, { "name": "Set (replace) the roles of an object model", "disabled": true, "request": { "description": "Replaces the declared role set wholesale. The reconstructed object model validates role-id\nuniqueness and that overrides still reference declared roles and roles reference referenced\ndata domains.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelRoles\"}" } } }, { "name": "Generate (and optionally register) an object model's use-case JSON Schema", "disabled": true, "request": { "description": "Resolves the object model and projects its resolved nested attributes into a CONFORMANCE-BEARING\nJSON Schema: an attribute whose effective mandatory flag is set contributes to the enclosing\nobject's `required` array, data-domain object boundaries nest, entry-code narrowing maps to `enum`,\nand a repeating attribute maps to an `array`. Only `JSON_SCHEMA` is supported now; any other\n`targetType` (including `JSON_LD_CONTEXT`) is reserved for a later phase and rejected with a\n400. When `register` is true the schema is also registered with the schema registry under the\n`object-models` namespace and the resulting registry id is returned; registration is the\nonly license-gated path (pure generation is a read).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.generateObjectModelSchema\"}" } } }, { "name": "Toggle object model status (draft <-> published)", "disabled": true, "request": { "description": "PUT /objects/{objectModelId}/status. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.setObjectModelStatus\"}" } } }, { "name": "Bump the object model's snapshot version", "disabled": true, "request": { "description": "Bumps the object model's monotonic snapshot `version` by one. No request body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-model-authoring.snapshotObjectModelVersion\"}" } } } ] } ] }, { "name": "semantic-vocabulary", "description": "Operations associated with the semantic-vocabulary guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "semantic-vocabulary-operations", "description": "semantic-vocabulary-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List vocabularies", "disabled": true, "request": { "description": "Returns a page of vocabularies matching the optional filter. Pagination accepts both\n`limit`/`offset` and OpenAPI-style `page`/`size`; the parser normalises and clamps `limit`\nto `[1, 100]` (default `20`). Default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.listSemanticVocabularies\"}" } } }, { "name": "Create a vocabulary with initial terms and concept schemes", "disabled": true, "request": { "description": "POST /vocabularies. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.createSemanticVocabulary\"}" } } }, { "name": "Import and persist a vocabulary from serialized content", "disabled": true, "request": { "description": "POST /vocabularies/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.importSemanticVocabulary\"}" } } }, { "name": "Search terms across all vocabularies of the current tenant", "disabled": true, "request": { "description": "GET /vocabularies/terms/search. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.searchSemanticVocabularyTerms\"}" } } }, { "name": "Soft-delete a vocabulary", "disabled": true, "request": { "description": "DELETE /vocabularies/{vocabId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.deleteSemanticVocabulary\"}" } } }, { "name": "Get one vocabulary", "disabled": true, "request": { "description": "GET /vocabularies/{vocabId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.getSemanticVocabulary\"}" } } }, { "name": "Update a vocabulary", "disabled": true, "request": { "description": "Update vocabulary metadata. When the request body's `content` field is **null**, only\nmetadata fields (name, version, description) are updated; null fields in the input are\nleft unchanged. When `content` is provided, a full content refresh is performed: all\nterms and concept schemes are atomically replaced, `sourceFormat` is required in that\ncase.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.updateSemanticVocabulary\"}" } } }, { "name": "Return SKOS concept-scheme hierarchies for the vocabulary", "disabled": true, "request": { "description": "GET /vocabularies/{vocabId}/concepts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.listSemanticVocabularyConceptSchemes\"}" } } }, { "name": "List terms within a vocabulary", "disabled": true, "request": { "description": "Returns terms within a vocabulary, optionally filtered by `labelContains`, `dataType`,\nand `parentTermUri`, with `limit`/`offset` pagination. The response shape is\n`{ \"data\": [...] }` without pagination metadata.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.listSemanticVocabularyTerms\"}" } } }, { "name": "Get a single term by URI", "disabled": true, "request": { "description": "GET /vocabularies/{vocabId}/terms/byuri. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"semantic-vocabulary.getSemanticVocabularyTermByUri\"}" } } } ] } ] }, { "name": "software-manager", "description": "Operations associated with the software-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "software-manager-operations", "description": "software-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List authorization server instances", "disabled": true, "request": { "description": "GET /oauth2/servers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listAuthorizationServers\"}" } } }, { "name": "Create an authorization server instance", "disabled": true, "request": { "description": "POST /oauth2/servers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.createAuthorizationServer\"}" } } }, { "name": "Soft-delete an authorization server", "disabled": true, "request": { "description": "DELETE /oauth2/servers/{asId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.deleteAuthorizationServer\"}" } } }, { "name": "Get authorization server detail", "disabled": true, "request": { "description": "GET /oauth2/servers/{asId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.getAuthorizationServer\"}" } } }, { "name": "Update an authorization server", "disabled": true, "request": { "description": "PATCH /oauth2/servers/{asId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.updateAuthorizationServer\"}" } } }, { "name": "List credentials for this AS", "disabled": true, "request": { "description": "GET /oauth2/servers/{asId}/credentials. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listAuthorizationServerCredentials\"}" } } }, { "name": "Add a credential for this AS", "disabled": true, "request": { "description": "POST /oauth2/servers/{asId}/credentials. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.addAuthorizationServerCredential\"}" } } }, { "name": "Remove a credential", "disabled": true, "request": { "description": "DELETE /oauth2/servers/{asId}/credentials/{credentialId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.removeAuthorizationServerCredential\"}" } } }, { "name": "List OID4VCI issuer instances", "disabled": true, "request": { "description": "GET /oid4vci/issuers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listOid4vciIssuers\"}" } } }, { "name": "Create an OID4VCI issuer instance", "disabled": true, "request": { "description": "POST /oid4vci/issuers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.createOid4vciIssuer\"}" } } }, { "name": "Soft-delete an issuer", "disabled": true, "request": { "description": "DELETE /oid4vci/issuers/{issuerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.deleteOid4vciIssuer\"}" } } }, { "name": "Get issuer detail", "disabled": true, "request": { "description": "GET /oid4vci/issuers/{issuerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.getOid4vciIssuer\"}" } } }, { "name": "Update an issuer", "disabled": true, "request": { "description": "PATCH /oid4vci/issuers/{issuerId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.updateOid4vciIssuer\"}" } } }, { "name": "List OID4VP verifier instances", "disabled": true, "request": { "description": "GET /oid4vp/verifiers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listOid4vpVerifiers\"}" } } }, { "name": "Create an OID4VP verifier instance", "disabled": true, "request": { "description": "POST /oid4vp/verifiers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.createOid4vpVerifier\"}" } } }, { "name": "Soft-delete a verifier", "disabled": true, "request": { "description": "DELETE /oid4vp/verifiers/{verifierId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.deleteOid4vpVerifier\"}" } } }, { "name": "Get verifier detail", "disabled": true, "request": { "description": "GET /oid4vp/verifiers/{verifierId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.getOid4vpVerifier\"}" } } }, { "name": "Update a verifier", "disabled": true, "request": { "description": "PATCH /oid4vp/verifiers/{verifierId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.updateOid4vpVerifier\"}" } } }, { "name": "List all service instances across types", "disabled": true, "request": { "description": "GET /services/instances. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listServiceInstances\"}" } } }, { "name": "Soft-delete a service instance", "disabled": true, "request": { "description": "DELETE /services/instances/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.deleteServiceInstance\"}" } } }, { "name": "Get a service instance by ID", "disabled": true, "request": { "description": "GET /services/instances/{instanceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.getServiceInstance\"}" } } }, { "name": "Decommission a service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/actions/decommission. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.decommissionServiceInstance\"}" } } }, { "name": "Deploy a managed service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/actions/deploy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.deployServiceInstance\"}" } } }, { "name": "Trigger metadata discovery for a service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/actions/discover. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.discoverServiceInstance\"}" } } }, { "name": "Resume a suspended service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/actions/resume. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.resumeServiceInstance\"}" } } }, { "name": "Suspend a service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/actions/suspend. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.suspendServiceInstance\"}" } } }, { "name": "List deployments for a service instance", "disabled": true, "request": { "description": "GET /services/instances/{instanceId}/deployments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listDeployments\"}" } } }, { "name": "Add a deployment to a service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/deployments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.addDeployment\"}" } } }, { "name": "Update deployment status", "disabled": true, "request": { "description": "PATCH /services/instances/{instanceId}/deployments/{deploymentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.updateDeploymentStatus\"}" } } }, { "name": "List endpoints for a service instance", "disabled": true, "request": { "description": "GET /services/instances/{instanceId}/endpoints. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.listEndpoints\"}" } } }, { "name": "Add an endpoint to a service instance", "disabled": true, "request": { "description": "POST /services/instances/{instanceId}/endpoints. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.addEndpoint\"}" } } }, { "name": "Remove an endpoint", "disabled": true, "request": { "description": "DELETE /services/instances/{instanceId}/endpoints/{endpointId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"software-manager.removeEndpoint\"}" } } } ] } ] }, { "name": "statuslist-hosting", "description": "Operations associated with the statuslist-hosting guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "statuslist-hosting-operations", "description": "statuslist-hosting-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Resolve the signed status-list token by correlation id", "request": { "description": "Returns the raw signed status-list token for the list with business correlation id\n`{correlationId}`. This is the stable, externally referenced address that issued credentials\nembed, since the correlation id is operator-chosen and does not change across upgrades. The\nbody is the bare signed token with the token's own `Content-Type` and a\n`Cache-Control: public, max-age=`\nheader (falling back to `public, max-age=300`). Returns `404` when no list has this correlation\nid.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{correlationId}" } } ] } ] }, { "name": "statuslist-management", "description": "Operations associated with the statuslist-management guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "statuslist-management-operations", "description": "statuslist-management-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List credential status lists", "disabled": true, "request": { "description": "Returns status-list summaries matching the optional filters. Pagination\nuses `limit` and `offset`; `limit` is clamped to `[1, 100]` and defaults\nto `20`. The default sort is `createdAt DESC`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.listStatusLists\"}" } } }, { "name": "Create a credential status list", "disabled": true, "request": { "description": "Creates a status-list definition and signs the initial empty token.\n`correlationId` is the stable business key used by issuance bindings\nand hosted URLs. The response includes the signed token; list endpoints\nreturn summaries without the token.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.createStatusList\"}" } } }, { "name": "Delete a credential status list", "disabled": true, "request": { "description": "Soft-deletes the status list owned by the calling tenant and releases its hosted URL.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.deleteStatusList\"}" } } }, { "name": "Get a credential status list by id", "disabled": true, "request": { "description": "Fetches the full status-list record, including the signed token that\ncan be served by the hosting API.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.getStatusList\"}" } } }, { "name": "Get a single status-list entry by index", "disabled": true, "request": { "description": "Looks up one allocated entry by its status-list index. The optional `entryCorrelationId` and\n`credentialId` query parameters narrow the lookup when the same index could be disambiguated\nby business key.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.getStatusListEntry\"}" } } }, { "name": "Update a credential's status (revoke / suspend / reactivate)", "disabled": true, "request": { "description": "Sets the status value of a single entry within the status list identified by `{id}`. Select\nthe entry by exactly one of `statusListIndex`, `entryCorrelationId`, or `credentialId`, and\nset `value` to the new status (e.g. `1` = INVALID to revoke, `2` = SUSPENDED to suspend,\n`0` = VALID to reactivate).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"statuslist-management.updateCredentialStatus\"}" } } } ] } ] }, { "name": "theme", "description": "Operations associated with the theme guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "theme-operations", "description": "theme-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Purge the theme cache", "disabled": true, "request": { "description": "Purges the theme resolution cache, for one tenant or globally. Platform admin operation.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.purgeThemeCache\"}" } } }, { "name": "Generate a palette", "disabled": true, "request": { "description": "Generates a Material Design 3 tonal palette from a seed color.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.generatePalette\"}" } } }, { "name": "Resolve the theme for a registered public host", "request": { "description": "Resolves the tenant exclusively from the request Host and an active issuer or\nverifier public-endpoint binding. Unknown, disabled, ambiguous, or cross-tenant\nhosts return 404. No tenant identifier is accepted in this route.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/resolved" } }, { "name": "Resolve theme CSS for a registered public host", "request": { "description": "Host-resolved CSS companion to `GET /resolved`.", "method": "GET", "header": [], "url": "{{baseUrl}}/resolved/css" } }, { "name": "List applications", "disabled": true, "request": { "description": "Returns every brandable application the tenant runs, as a plain array: platform-managed instances merged from the platform instance registries plus applications registered through this API.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listApplications\"}" } } }, { "name": "Register an application", "disabled": true, "request": { "description": "Registers an external application (a self-hosted portal, a mobile app) as a brandable instance.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.registerApplication\"}" } } }, { "name": "Delete an application", "disabled": true, "request": { "description": "Deletes a registered application. Platform-managed instances are read-only here and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplication\"}" } } }, { "name": "Get an application", "disabled": true, "request": { "description": "GET /{tenant}/applications/{applicationId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getApplication\"}" } } }, { "name": "Update an application", "disabled": true, "request": { "description": "Updates a registered application. Platform-managed instances are read-only here and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateApplication\"}" } } }, { "name": "Delete an application brand", "disabled": true, "request": { "description": "Removes the application's brand override so it cascades from the tenant brand again.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplicationBrand\"}" } } }, { "name": "Get an application brand", "disabled": true, "request": { "description": "GET /{tenant}/applications/{applicationId}/brand. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getApplicationBrand\"}" } } }, { "name": "Set an application brand", "disabled": true, "request": { "description": "Applies a sparse brand override for one registered application. Set properties override the tenant brand for this application; omitted properties keep cascading from the tenant default.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setApplicationBrand\"}" } } }, { "name": "Resolve a feature for an application", "request": { "description": "Resolves the design elements of one feature for a registered application: what a\nrunning application fetches for itself. Per element, the first match wins:\napplication binding (variant, then common), tenant binding (variant, then common),\nproduct default, element default, then the element's fallback token key; a required\nelement that resolves to nothing is listed in `missingRequired`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/applications/{applicationId}/features/{featureId}/resolved" } }, { "name": "Delete an application stylesheet", "disabled": true, "request": { "description": "DELETE /{tenant}/applications/{applicationId}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteApplicationStylesheet\"}" } } }, { "name": "Get an application stylesheet", "request": { "description": "Serves the custom CSS stylesheet of one registered application. Returns 404 for an unknown tenant or application, or when no stylesheet is set.", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/applications/{applicationId}/stylesheet" } }, { "name": "Set an application stylesheet", "disabled": true, "request": { "description": "PUT /{tenant}/applications/{applicationId}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setApplicationStylesheet\"}" } } }, { "name": "Get the tenant brand", "disabled": true, "request": { "description": "GET /{tenant}/brand. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getBrand\"}" } } }, { "name": "Set the tenant brand", "disabled": true, "request": { "description": "Applies the tenant brand and regenerates the palette tokens in the canonical tenant definitions, preserving power overrides. Simple and advanced modes compose because they target the same definitions.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setBrand\"}" } } }, { "name": "Resolve branding context", "disabled": true, "request": { "description": "Resolves the tenant's branding as a flat, template-friendly key/value context, for cross-domain use such as email templates.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.resolveBrandingContext\"}" } } }, { "name": "List theme definitions", "disabled": true, "request": { "description": "Returns the tenant's theme definitions matching the optional filters, as a plain array.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listThemeDefinitions\"}" } } }, { "name": "Create a theme definition", "disabled": true, "request": { "description": "POST /{tenant}/definitions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.createThemeDefinition\"}" } } }, { "name": "Validate a theme definition", "disabled": true, "request": { "description": "Validates a theme definition without saving it, including the scope key rules (PRODUCT requires `productType`, APPLICATION requires `applicationId`, other scopes carry neither).\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.validateThemeDefinition\"}" } } }, { "name": "Delete a theme definition", "disabled": true, "request": { "description": "DELETE /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteThemeDefinition\"}" } } }, { "name": "Get a theme definition", "disabled": true, "request": { "description": "GET /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getThemeDefinition\"}" } } }, { "name": "Update a theme definition", "disabled": true, "request": { "description": "PUT /{tenant}/definitions/{themeId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateThemeDefinition\"}" } } }, { "name": "Get theme definition history", "disabled": true, "request": { "description": "Returns the version history of a theme definition as a plain array, newest first.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getThemeDefinitionHistory\"}" } } }, { "name": "Restore a deleted theme definition", "disabled": true, "request": { "description": "Restores a soft-deleted theme definition.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.restoreThemeDefinition\"}" } } }, { "name": "Undo a theme definition update", "disabled": true, "request": { "description": "Undoes the last update to a theme definition, or reverts to the version given in the body.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.undoThemeDefinition\"}" } } }, { "name": "List features", "disabled": true, "request": { "description": "Returns the brandable features of a product type as a plain array, built-in and custom.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listFeatures\"}" } } }, { "name": "Create a custom feature", "disabled": true, "request": { "description": "Registers a custom feature, as published by user-built workflows, forms, and portal pages.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.createFeature\"}" } } }, { "name": "Delete a custom feature", "disabled": true, "request": { "description": "Deletes a custom feature. Built-in features are read-only and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteFeature\"}" } } }, { "name": "Get a feature", "disabled": true, "request": { "description": "GET /{tenant}/products/{productType}/features/{featureId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getFeature\"}" } } }, { "name": "Update a custom feature", "disabled": true, "request": { "description": "Updates a custom feature. Built-in features are read-only and return 409.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.updateFeature\"}" } } }, { "name": "List element bindings", "disabled": true, "request": { "description": "Returns the stored design element bindings of a feature as a plain array. Without filters, all bindings are returned; `applicationId` and `variant` narrow to one slot.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.listElementBindings\"}" } } }, { "name": "Delete an element binding", "disabled": true, "request": { "description": "Removes the binding at the exact slot selected by the `applicationId` and `variant` query parameters, so resolution falls through to the next layer.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteElementBinding\"}" } } }, { "name": "Set an element binding", "disabled": true, "request": { "description": "Binds a value to a design element at tenant scope (`applicationId` absent: the default for every application of the product) or application scope, optionally per variant. The `applicationId` and `variant` query parameters select the exact binding slot. Exactly one of `asset` or `text` is set, matching the element kind.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setElementBinding\"}" } } }, { "name": "Resolve a feature at product level", "request": { "description": "Resolves the design elements of one feature at tenant level for a product type,\nwithout an application override layer: the defaults every application of this\nproduct inherits.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/products/{productType}/features/{featureId}/resolved" } }, { "name": "Resolve theme", "request": { "description": "Resolves the effective theme for a tenant, optionally scoped to a registered\napplication and variant. Later scopes win: SYSTEM < PRODUCT < TENANT < APPLICATION\n< PRINCIPAL; the PRODUCT and APPLICATION layers apply only when `applicationId` is\nsupplied. Returns 404 for an unknown tenant; a known tenant with no definitions\nresolves to system defaults with `fallback=true` and `X-Theme-Fallback: true`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/resolved" } }, { "name": "Resolve theme CSS", "request": { "description": "Resolves the effective theme and returns it as CSS custom properties. Same\nparameters and tenant semantics as `GET /{tenant}/resolved`.\n", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/resolved/css" } }, { "name": "Seed default themes", "disabled": true, "request": { "description": "Seeds the default theme definitions for a tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.seedTheme\"}" } } }, { "name": "Delete the tenant stylesheet", "disabled": true, "request": { "description": "DELETE /{tenant}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.deleteTenantStylesheet\"}" } } }, { "name": "Get the tenant stylesheet", "request": { "description": "Serves the tenant's custom CSS stylesheet. Returns 404 for an unknown tenant or when no stylesheet is set.", "method": "GET", "header": [], "url": "{{baseUrl}}/{tenant}/stylesheet" } }, { "name": "Set the tenant stylesheet", "disabled": true, "request": { "description": "PUT /{tenant}/stylesheet. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.setTenantStylesheet\"}" } } }, { "name": "Get the editable token set", "disabled": true, "request": { "description": "Returns the editable token set with effective values for the addressed `(scope, variant, applicationId)` combination: tenant scope by default, application scope when `applicationId` is given.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.getTokens\"}" } } }, { "name": "Patch tokens", "disabled": true, "request": { "description": "Upserts and removes tokens in the canonical definition for the addressed `(scope, variant, applicationId)` combination. Composes with the brand endpoints, which write the same canonical definitions.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"theme.patchTokens\"}" } } } ] } ] }, { "name": "trust-domain", "description": "Operations associated with the trust-domain guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "trust-domain-operations", "description": "trust-domain-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List Trust Attachments", "disabled": true, "request": { "description": "GET /attachments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAttachments\"}" } } }, { "name": "Delete Trust Attachment", "disabled": true, "request": { "description": "DELETE /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAttachment\"}" } } }, { "name": "Get Trust Attachment", "disabled": true, "request": { "description": "GET /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustAttachment\"}" } } }, { "name": "Put Trust Attachment", "disabled": true, "request": { "description": "PUT /attachments/{consumerKind}/{consumerId}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAttachment\"}" } } }, { "name": "List Trust Domains", "disabled": true, "request": { "description": "GET /domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustDomains\"}" } } }, { "name": "Create Trust Domain", "disabled": true, "request": { "description": "POST /domains. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustDomain\"}" } } }, { "name": "Delete Trust Domain", "disabled": true, "request": { "description": "DELETE /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustDomain\"}" } } }, { "name": "Get Trust Domain", "disabled": true, "request": { "description": "GET /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustDomain\"}" } } }, { "name": "Put Trust Domain", "disabled": true, "request": { "description": "PUT /domains/{domainId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustDomain\"}" } } }, { "name": "List Trust Anchors", "disabled": true, "request": { "description": "GET /domains/{domainId}/anchors. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAnchors\"}" } } }, { "name": "Create Trust Anchor", "disabled": true, "request": { "description": "POST /domains/{domainId}/anchors. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustAnchor\"}" } } }, { "name": "Delete Trust Anchor", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAnchor\"}" } } }, { "name": "Put Trust Anchor", "disabled": true, "request": { "description": "PUT /domains/{domainId}/anchors/{anchorId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAnchor\"}" } } }, { "name": "List Trust Anchor Admissions", "disabled": true, "request": { "description": "GET /domains/{domainId}/anchors/{anchorId}/admissions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustAnchorAdmissions\"}" } } }, { "name": "Delete Trust Anchor Admission", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}/admissions/{admissionClass}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustAnchorAdmission\"}" } } }, { "name": "Put Trust Anchor Admission", "disabled": true, "request": { "description": "PUT /domains/{domainId}/anchors/{anchorId}/admissions/{admissionClass}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustAnchorAdmission\"}" } } }, { "name": "Remove Mdoc Vical Configuration", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/anchors/{anchorId}/mdoc-vical. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.removeMdocVicalConfiguration\"}" } } }, { "name": "Describe Mdoc Vical Configuration", "disabled": true, "request": { "description": "Returns the ISO 18013-5 Annex C VICAL configured on this anchor. An anchor with no VICAL yet returns an unconfigured configuration rather than 404, so a client can render the empty form without a special case.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.describeMdocVicalConfiguration\"}" } } }, { "name": "Configure Mdoc Vical Configuration", "disabled": true, "request": { "description": "Sets the VICAL source for this anchor. Every referenced anchor must already exist in the same trust domain, be ACTIVE, and hold the admission class for its job: MDOC_VICAL_SIGNER for the anchors that verify the artifact signature, CREDENTIAL_ISSUER for the issuing authorities the artifact admits. At least one signer anchor is required, because an unverified VICAL would admit every authority it happens to contain.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.configureMdocVicalConfiguration\"}" } } }, { "name": "List Trust Catalogs", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustCatalogs\"}" } } }, { "name": "Create Trust Catalog", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.createTrustCatalog\"}" } } }, { "name": "Delete Trust Catalog", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustCatalog\"}" } } }, { "name": "Get Trust Catalog", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustCatalog\"}" } } }, { "name": "Update Trust Catalog", "disabled": true, "request": { "description": "PUT /domains/{domainId}/catalogs/{catalogId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.updateTrustCatalog\"}" } } }, { "name": "Validate Trust Catalog Candidate", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs/{catalogId}/candidates/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateTrustCatalogCandidate\"}" } } }, { "name": "List Trust Catalog Snapshots", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}/snapshots. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustCatalogSnapshots\"}" } } }, { "name": "Get Trust Catalog Snapshot", "disabled": true, "request": { "description": "GET /domains/{domainId}/catalogs/{catalogId}/snapshots/{snapshotId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustCatalogSnapshot\"}" } } }, { "name": "Activate Trust Catalog Snapshot", "disabled": true, "request": { "description": "POST /domains/{domainId}/catalogs/{catalogId}/snapshots/{snapshotId}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateTrustCatalogSnapshot\"}" } } }, { "name": "List Trust Domain Consumers", "disabled": true, "request": { "description": "GET /domains/{domainId}/consumers. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustDomainConsumers\"}" } } }, { "name": "List LoTE Remote Sources", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listLoTERemoteSources\"}" } } }, { "name": "Delete LoTE Remote Source", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteLoTERemoteSource\"}" } } }, { "name": "Get LoTE Remote Source", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getLoTERemoteSource\"}" } } }, { "name": "Put LoTE Remote Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/lote-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putLoTERemoteSource\"}" } } }, { "name": "Get LoTE Remote Source Diagnostics", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}/diagnostics. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getLoTERemoteSourceDiagnostics\"}" } } }, { "name": "Refresh LoTE Remote Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/refresh. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.refreshLoTERemoteSource\"}" } } }, { "name": "List LoTE Remote Source Revisions", "disabled": true, "request": { "description": "GET /domains/{domainId}/lote-sources/{sourceId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listLoTERemoteSourceRevisions\"}" } } }, { "name": "Activate LoTE Remote Source Revision", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/revisions/{revision}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateLoTERemoteSourceRevision\"}" } } }, { "name": "Validate LoTE Remote Source Revision", "disabled": true, "request": { "description": "POST /domains/{domainId}/lote-sources/{sourceId}/revisions/{revision}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateLoTERemoteSourceRevision\"}" } } }, { "name": "List Trust Sources", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSources\"}" } } }, { "name": "Ensure Eu Trust Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/trust-sources/eu. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.ensureEuTrustSource\"}" } } }, { "name": "Delete Trust Source", "disabled": true, "request": { "description": "DELETE /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustSource\"}" } } }, { "name": "Get Trust Source", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustSource\"}" } } }, { "name": "Upsert Custom Trust Source", "disabled": true, "request": { "description": "PUT /domains/{domainId}/trust-sources/{sourceId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.upsertCustomTrustSource\"}" } } }, { "name": "List Trust Source Derived Entries", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/derived-entries. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceDerivedEntries\"}" } } }, { "name": "Get Trust Source Diagnostics", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/diagnostics. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getTrustSourceDiagnostics\"}" } } }, { "name": "Refresh Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/refresh. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.refreshTrustSource\"}" } } }, { "name": "List Trust Source Refresh Attempts", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/refresh-attempts. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceRefreshAttempts\"}" } } }, { "name": "List Trust Source Revisions", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/revisions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustSourceRevisions\"}" } } }, { "name": "Activate Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/revisions/{revision}/activate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.activateTrustSource\"}" } } }, { "name": "Validate Trust Source", "disabled": true, "request": { "description": "POST /domains/{domainId}/trust-sources/{sourceId}/revisions/{revision}/validate. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.validateTrustSource\"}" } } }, { "name": "Get Active Trust Source Snapshot", "disabled": true, "request": { "description": "GET /domains/{domainId}/trust-sources/{sourceId}/snapshot. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.getActiveTrustSourceSnapshot\"}" } } }, { "name": "Delete Trust Eligibility Grant", "disabled": true, "request": { "description": "DELETE /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.deleteTrustEligibilityGrant\"}" } } }, { "name": "List Trust Eligibility Grants", "disabled": true, "request": { "description": "GET /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.listTrustEligibilityGrants\"}" } } }, { "name": "Put Trust Eligibility Grant", "disabled": true, "request": { "description": "PUT /eligibility/{consumerKind}/{usage}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.putTrustEligibilityGrant\"}" } } }, { "name": "Evaluate Catalog Authorization", "disabled": true, "request": { "description": "POST /internal/evaluate/catalog-authorization. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateCatalogAuthorization\"}" } } }, { "name": "Evaluate Credential Issuer Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/credential-issuer. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateCredentialIssuerTrust\"}" } } }, { "name": "Evaluate Verifier Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/verifier. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateVerifierTrust\"}" } } }, { "name": "Evaluate Wallet Provider Trust", "disabled": true, "request": { "description": "POST /internal/evaluate/wallet-provider. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.evaluateWalletProviderTrust\"}" } } }, { "name": "Resolve Trust Attachment", "disabled": true, "request": { "description": "POST /internal/resolve/attachment. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTrustAttachment\"}" } } }, { "name": "Resolve Trust Authentication Material", "disabled": true, "request": { "description": "POST /internal/resolve/authentication-material. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTrustAuthenticationMaterial\"}" } } }, { "name": "Resolve Tls Server Trust Material", "disabled": true, "request": { "description": "POST /internal/resolve/tls-server-material. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"trust-domain.resolveTlsServerTrustMaterial\"}" } } } ] } ] }, { "name": "user-manager", "description": "Operations associated with the user-manager guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "user-manager-operations", "description": "user-manager-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List groups", "disabled": true, "request": { "description": "GET /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.listGroups\"}" } } }, { "name": "Create group", "disabled": true, "request": { "description": "POST /groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.createGroup\"}" } } }, { "name": "Soft-delete group", "disabled": true, "request": { "description": "DELETE /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.deleteGroup\"}" } } }, { "name": "Get group", "disabled": true, "request": { "description": "GET /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getGroup\"}" } } }, { "name": "Partial update group", "disabled": true, "request": { "description": "PATCH /groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.updateGroup\"}" } } }, { "name": "Full update group", "disabled": true, "request": { "description": "Replaces all updatable fields of the group. All required fields must be provided.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.replaceGroup\"}" } } }, { "name": "Get group members", "disabled": true, "request": { "description": "GET /groups/{groupId}/members. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getGroupMembers\"}" } } }, { "name": "Remove member from group", "disabled": true, "request": { "description": "DELETE /groups/{groupId}/members/{userId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.removeMemberFromGroup\"}" } } }, { "name": "Add member to group", "disabled": true, "request": { "description": "POST /groups/{groupId}/members/{userId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.addMemberToGroup\"}" } } }, { "name": "Get group's assigned roles", "disabled": true, "request": { "description": "GET /groups/{groupId}/roles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getGroupRoles\"}" } } }, { "name": "Remove role from group", "disabled": true, "request": { "description": "DELETE /groups/{groupId}/roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.removeRoleFromGroup\"}" } } }, { "name": "Assign role to group", "disabled": true, "request": { "description": "POST /groups/{groupId}/roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.assignRoleToGroup\"}" } } }, { "name": "List roles", "disabled": true, "request": { "description": "GET /roles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.listRoles\"}" } } }, { "name": "Create role", "disabled": true, "request": { "description": "POST /roles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.createRole\"}" } } }, { "name": "Soft-delete role", "disabled": true, "request": { "description": "DELETE /roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.deleteRole\"}" } } }, { "name": "Get role", "disabled": true, "request": { "description": "GET /roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getRole\"}" } } }, { "name": "Partial update role", "disabled": true, "request": { "description": "PATCH /roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.updateRole\"}" } } }, { "name": "Full update role", "disabled": true, "request": { "description": "Replaces all updatable fields of the role. All required fields must be provided.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.replaceRole\"}" } } }, { "name": "List tenants", "disabled": true, "request": { "description": "GET /tenants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.listTenants\"}" } } }, { "name": "Create tenant", "disabled": true, "request": { "description": "Creates a new tenant. If organizationPartyId is not provided,\na new Party (organization) will be automatically created.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.createTenant\"}" } } }, { "name": "Delete tenant", "disabled": true, "request": { "description": "Soft-delete a tenant. Associated data remains but is inaccessible.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.deleteTenant\"}" } } }, { "name": "Get tenant", "disabled": true, "request": { "description": "GET /tenants/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getTenant\"}" } } }, { "name": "Partial update tenant", "disabled": true, "request": { "description": "PATCH /tenants/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.updateTenant\"}" } } }, { "name": "Full update tenant", "disabled": true, "request": { "description": "Replaces all updatable fields of the tenant. All required fields must be provided.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.replaceTenant\"}" } } }, { "name": "List users", "disabled": true, "request": { "description": "GET /users. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.listUsers\"}" } } }, { "name": "Create user", "disabled": true, "request": { "description": "POST /users. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.createUser\"}" } } }, { "name": "Soft-delete user", "disabled": true, "request": { "description": "DELETE /users/{userId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.deleteUser\"}" } } }, { "name": "Get user", "disabled": true, "request": { "description": "GET /users/{userId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getUser\"}" } } }, { "name": "Partial update user", "disabled": true, "request": { "description": "PATCH /users/{userId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.updateUser\"}" } } }, { "name": "Full update user", "disabled": true, "request": { "description": "Replaces all updatable fields of the user. All required fields must be provided.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.replaceUser\"}" } } }, { "name": "Get user's group memberships", "disabled": true, "request": { "description": "GET /users/{userId}/groups. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getUserGroups\"}" } } }, { "name": "Remove user from group", "disabled": true, "request": { "description": "DELETE /users/{userId}/groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.removeUserFromGroup\"}" } } }, { "name": "Add user to group", "disabled": true, "request": { "description": "POST /users/{userId}/groups/{groupId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.addUserToGroup\"}" } } }, { "name": "Get user's directly assigned roles", "disabled": true, "request": { "description": "GET /users/{userId}/roles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getUserRoles\"}" } } }, { "name": "Remove role from user", "disabled": true, "request": { "description": "DELETE /users/{userId}/roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.removeRoleFromUser\"}" } } }, { "name": "Assign role to user", "disabled": true, "request": { "description": "POST /users/{userId}/roles/{roleId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.assignRoleToUser\"}" } } }, { "name": "Get accessible tenants for user", "disabled": true, "request": { "description": "GET /users/{userId}/tenants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.getUserTenants\"}" } } }, { "name": "Revoke user access to tenant", "disabled": true, "request": { "description": "DELETE /users/{userId}/tenants/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.revokeTenantAccess\"}" } } }, { "name": "Grant user access to tenant", "disabled": true, "request": { "description": "POST /users/{userId}/tenants/{tenantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"user-manager.grantTenantAccess\"}" } } } ] } ] }, { "name": "vault", "description": "Operations associated with the vault guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "vault-operations", "description": "vault-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Create a vault", "disabled": true, "request": { "description": "POST /vaults. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVault\"}" } } }, { "name": "Delete a vault conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVault\"}" } } }, { "name": "Get a vault descriptor", "disabled": true, "request": { "description": "GET /vaults/{vaultId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVault\"}" } } }, { "name": "Stream a recipient-scoped TDF export", "disabled": true, "request": { "description": "Object export is TDF. Folder/vault export is deterministic BagIt 1.0 carried in TDF. Normal export excludes private keys, PINs, live tokens, cookies, KMS recovery data, secret zones, and unrelated grant topology.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.exportVaultContent\"}" } } }, { "name": "Stream plaintext by mutable path", "disabled": true, "request": { "description": "Never returns protected bytes as plaintext.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileByPath\"}" } } }, { "name": "Stream a plaintext file through an approved protection provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS. That profile must use `/protected-files` so the service never receives plaintext and never bypasses client-controlled protection.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultPlaintextFile\"}" } } }, { "name": "Create an explicit folder", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/folders. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultFolder\"}" } } }, { "name": "List grants", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultGrants\"}" } } }, { "name": "Create or replace a grant conditionally", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/grants. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultGrant\"}" } } }, { "name": "Revoke a grant conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/grants/{grantId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.revokeVaultGrant\"}" } } }, { "name": "Stream and verify a recipient-scoped TDF export", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/imports. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.importVaultContent\"}" } } }, { "name": "List path entries", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjects\"}" } } }, { "name": "Delete a file or folder conditionally", "disabled": true, "request": { "description": "DELETE /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.deleteVaultObject\"}" } } }, { "name": "Get object, path binding, and current version metadata", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.getVaultObject\"}" } } }, { "name": "Replace object metadata", "disabled": true, "request": { "description": "PATCH /vaults/{vaultId}/objects/{objectId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultObjectMetadata\"}" } } }, { "name": "Stream plaintext by stable object identity", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/content. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultPlaintextFileById\"}" } } }, { "name": "Stream protected content and its ZERO_ACCESS descriptor", "disabled": true, "request": { "description": "Returns protected bytes, record, plaintext digest/size, package reference, protection parameters, and canonical AAD. This is distinct from plaintext read and never unwraps.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.readVaultProtectedFile\"}" } } }, { "name": "Store a client-protected immutable version", "disabled": true, "request": { "description": "The body objectId must match the path objectId and the new client-selected versionId must be unused. The canonical AAD is validated before the authoritative manifest commit.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultProtectedVersion\"}" } } }, { "name": "List immutable versions", "disabled": true, "request": { "description": "GET /vaults/{vaultId}/objects/{objectId}/versions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.listVaultObjectVersions\"}" } } }, { "name": "Stream a new plaintext version through an approved provider", "disabled": true, "request": { "description": "Rejects OWNER_CONTROLLED_ZERO_ACCESS; use `/protected-versions` for that profile.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.createVaultPlaintextVersion\"}" } } }, { "name": "Copy into a new object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:copy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.copyVaultObject\"}" } } }, { "name": "Move or rename without changing object identity", "disabled": true, "request": { "description": "POST /vaults/{vaultId}/objects/{objectId}:move. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.moveVaultObject\"}" } } }, { "name": "Replace the vault policy reference", "disabled": true, "request": { "description": "PUT /vaults/{vaultId}/policy. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.updateVaultPolicy\"}" } } }, { "name": "Store a client-protected ZERO_ACCESS file", "disabled": true, "request": { "description": "Requires client-selected objectId and versionId before upload. The server validates the canonical AAD binding and atomically rejects identifier collision or reuse.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.putVaultProtectedFile\"}" } } }, { "name": "Search bounded metadata projections", "disabled": true, "request": { "description": "Implementations must not scan and decrypt object bodies.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"vault.searchVaultMetadata\"}" } } } ] } ] }, { "name": "wallet-credential", "description": "Operations associated with the wallet-credential guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-credential-operations", "description": "wallet-credential-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List wallet credentials", "disabled": true, "request": { "description": "Lists the credential metadata sidecars of one wallet unit. The query\nparameters mirror the credential metadata filter exactly: type\nreferences, formats, issuer reference, subject reference, credential\nconfiguration id, lifecycle states, and deleted-record inclusion.\n\nThe two set-valued enum filters, formats and lifecycleStates, are sent\nas a single comma-separated value each rather than as repeated query\nparameters, because the server reads one value per parameter name.\n\nThere are no paging parameters; the full filtered set is returned in\none response. Paging arrives later as a compatible extension of this\noperation. Raw credential bodies are never part of the result.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.listWalletCredentials\"}" } } }, { "name": "Delete a wallet credential", "disabled": true, "request": { "description": "Deletes one stored credential after verifying the supplied activation\ngrant. The referenced activation decision is single-use and\noperation-bound to operationType wallet.credentials.delete with the\nexact operation hash, nonce, and audience in the request body. The\nserver consumes the decision before performing the deletion, so a\nsecond attempt with the same decision fails even if the first attempt\ndid not complete. A missing, expired, already consumed, or wrong-hash\ndecision is rejected with 403 and nothing is deleted.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.deleteWalletCredential\"}" } } }, { "name": "Get a wallet credential", "disabled": true, "request": { "description": "Returns the display projection for one stored credential: the metadata\nsidecar, the issuer party derived inside the authoritative profile\nboundary, tags, the canonical sanitized claim tree with localized\nlabels, and referenced external resources.\n\nThe raw credential body is never exposed by this API. The claim tree\nis a sanitized projection; hidden values are absent rather than\nmasked, and external resources are returned as link references that\nclients decide whether to open.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.getWalletCredential\"}" } } }, { "name": "Refresh wallet credential status", "disabled": true, "request": { "description": "Re-resolves the revocation and validity status of one stored\ncredential against its configured status mechanism and persists the\noutcome. The response carries the updated credential metadata sidecar\nplus the latest status snapshot when one is available.\n\nThis operation is unattended-safe: it requires no activation grant,\ndiscloses nothing beyond the metadata sidecar, and can run from\nbackground jobs and sync loops.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-credential.refreshWalletCredentialStatus\"}" } } } ] } ] }, { "name": "wallet-entitlement", "description": "Operations associated with the wallet-entitlement guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-entitlement-operations", "description": "wallet-entitlement-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List wallet entitlements", "disabled": true, "request": { "description": "GET /entitlements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletEntitlements\"}" } } }, { "name": "Create or update wallet entitlement", "disabled": true, "request": { "description": "PUT /entitlements. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletEntitlement\"}" } } }, { "name": "Delete wallet entitlement", "disabled": true, "request": { "description": "DELETE /entitlements/{entitlementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.deleteWalletEntitlement\"}" } } }, { "name": "Get wallet entitlement", "disabled": true, "request": { "description": "GET /entitlements/{entitlementId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.getWalletEntitlement\"}" } } }, { "name": "Resolve wallet feature manifest", "disabled": true, "request": { "description": "GET /manifest. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.resolveWalletFeatureManifest\"}" } } }, { "name": "List wallet feature policy assignments", "disabled": true, "request": { "description": "GET /policy-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletFeaturePolicyAssignments\"}" } } }, { "name": "Create or update a scoped wallet feature policy assignment", "disabled": true, "request": { "description": "PUT /policy-assignments. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletFeaturePolicyAssignment\"}" } } }, { "name": "Revoke a wallet feature policy assignment", "disabled": true, "request": { "description": "DELETE /policy-assignments/{assignmentId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.revokeWalletFeaturePolicyAssignment\"}" } } }, { "name": "Preview effective wallet feature policy", "disabled": true, "request": { "description": "Membership, organization units, groups, license ceilings, and tenant ceilings are resolved server-side and cannot be asserted by the caller.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.previewWalletFeaturePolicy\"}" } } }, { "name": "List wallet feature policy profiles", "disabled": true, "request": { "description": "GET /policy-profiles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.listWalletFeaturePolicyProfiles\"}" } } }, { "name": "Create or update a wallet feature policy profile", "disabled": true, "request": { "description": "PUT /policy-profiles. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.upsertWalletFeaturePolicyProfile\"}" } } }, { "name": "Evaluate managed wallet offering readiness", "disabled": true, "request": { "description": "Returns only safe configuration, dependency, and signed-release-evidence gate results for the authenticated tenant.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-entitlement.evaluateManagedWalletOfferingReadiness\"}" } } } ] } ] }, { "name": "wallet-interaction", "description": "Operations associated with the wallet-interaction guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-interaction-operations", "description": "wallet-interaction-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Bind a screen to a live session", "disabled": true, "request": { "description": "Binds the authenticated screen (bearer screen credential issued by its owning\nauthorization server for the hand-off audience) to the named live session with the\nrole carried by the token and returns the role projection. Binding records presence so\nother screens see the join.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.bindHandoffScreen\"}" } } }, { "name": "Send a screen presence heartbeat", "disabled": true, "request": { "description": "Refreshes last-seen for the authenticated screen within the named session. Screens whose\nheartbeats stop stay visible in operator projections marked stale rather than silently\ndisappearing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.heartbeatHandoffScreen\"}" } } }, { "name": "Start a credential hand-off session", "disabled": true, "request": { "description": "Starts a hand-off session wrapping one offer or request run for a business wallet unit\nand returns the snapshot for the starting caller's role. Protocol execution stays owned\nby the backend; this surface captures, initiates and drives interaction only. The single\ndurable expiry timer is scheduled from the resolved session lifetime.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startHandoffSession\"}" } } }, { "name": "Get the role-scoped hand-off session snapshot", "disabled": true, "request": { "description": "Returns the current point-in-time snapshot from the session store read model, projected\nfor the caller's role. Enforcement is by omission server side: a display projection\ncarries no link text, no email action channel, and no result claim data, and the raw\nexchange URI appears in no projection at any role.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionSnapshot\"}" } } }, { "name": "Replay hand-off session events", "disabled": true, "request": { "description": "Returns recorded hand-off session events in the server-sent-events wire format. Each\nevent uses the event name handoff-session-event, the id field carries the per-session\nsequence used as the replay cursor, and the data field carries the HandoffSessionEvent\nJSON document. When the Last-Event-ID request header is present, only events with a\nsequence greater than that value are replayed. Events are served from the session store\nread model only.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getHandoffSessionEvents\"}" } } }, { "name": "Consume the guarded hand-off exchange URI", "disabled": true, "request": { "description": "Returns the guarded exchange URI held server side for this session to an eligible\nauthenticated screen or operator. This is the ONLY path on which the URI leaves the\nserver: it exists so it can be fed straight into the QR encoder or clipboard path.\nIt never appears in any projection, any stream event, or any log line. Display-role\nscreens use it to feed their encoder without ever receiving link text.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeHandoffExchangeUri\"}" } } }, { "name": "Regenerate the hand-off session", "disabled": true, "request": { "description": "Start over as a distinct action from retry and resume. Cancels the current run,\ninvalidates its correlation id upstream, and starts a successor workflow. The returned\nsnapshot belongs to the successor session; bound screens learn the successor through the\nterminal_reached event and the successorSessionId field. Regeneration after expiry is\nthe expected recovery path.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.regenerateHandoffSession\"}" } } }, { "name": "List wallet interaction activity", "disabled": true, "request": { "description": "Lists the interaction activity log projection for a wallet unit in\nascending sequence order. Use afterSequence with the nextSequence\nvalue of the previous page to fetch the next page.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.listWalletInteractionActivity\"}" } } }, { "name": "Start a wallet interaction", "disabled": true, "request": { "description": "Starts a wallet interaction session from a captured entry point and\nreturns the session with its initial state. The walletUnitId inside\nthe request input must equal the walletUnitId path parameter; a\nmismatch is rejected. The execution owner recorded at start is locked\nbefore semantic interpretation and stays immutable for the lifetime\nof the interaction.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.startWalletInteraction\"}" } } }, { "name": "Cancel a wallet interaction", "disabled": true, "request": { "description": "Cancels the interaction session and returns the terminal state. All\noutstanding sensitive inputs registered for the session are removed\nwhen the interaction terminates.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.cancelWalletInteraction\"}" } } }, { "name": "Dispatch a wallet interaction action", "disabled": true, "request": { "description": "Dispatches one user or client action into the interaction state\nmachine and returns the resulting state. Sensitive values such as\ntransaction codes and security grants are passed by sensitive-input\nreference, never inline.\n\nOPTIMISTIC CONCURRENCY. A client that sends expectedRevision in the\nrequest body makes the dispatch a conditional write: the server reads\nthe session state first and answers 409 with a\nWalletInteractionRevisionConflict, applying nothing, unless the session\nis still at exactly that revision. This is what keeps an approval the\nuser gave against a screen that has since moved on -- a consent decided\non a stale render, or a retry of an action that already applied -- from\nbeing applied against a state nobody looked at. The conflict body\ncarries the current state so the client can re-render immediately.\nOmitting expectedRevision applies the action unconditionally.\n\nThere are no concurrency-control HTTP headers on this operation. The\nprecondition travels in the body, the way the frame transport already\ncarries lastRevision, so no gateway can strip it.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.dispatchWalletInteractionAction\"}" } } }, { "name": "Consume the issuer authorization handoff", "disabled": true, "request": { "description": "Returns the issuer authorization URL held behind authorizationHandoffRef, then spends the\nreference. Public interaction state never carries the URL: this is the one-shot path a\nbrowser host uses to open the issuer sign-in page. A second call with the same reference\nis not found. After the holder returns, register the callback through the sensitive-input\nendpoint and dispatch auth_callback.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.consumeWalletInteractionAuthorizationHandoff\"}" } } }, { "name": "Replay wallet interaction state events", "disabled": true, "request": { "description": "Returns recorded interaction state events in the server-sent-events\nwire format. Each event uses the event name wallet-interaction-state,\nthe id field carries the state revision, and the data field carries\nthe WalletInteractionStateEvent JSON document. When the Last-Event-ID\nrequest header is present, only events with a revision greater than\nthat value are replayed.\n\nThe current implementation returns a bounded replay of the events\nrecorded so far and then closes the response; it does not hold the\nconnection open for live updates. Live streaming is a later server\nenhancement behind this same contract, and remains available today\nthrough the neutral server-streaming command transport.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionEvents\"}" } } }, { "name": "Handle a wallet interaction frame", "disabled": true, "request": { "description": "Multiplexed request/response frame transport over one endpoint. A\nRESUME, DISPATCH_ACTION, or CANCEL client frame is executed against\nthe session and answered with a STATE server frame carrying the\nresulting state and revision; a PING frame is answered with PONG. The\nsessionId inside the frame must equal the sessionId path parameter; a\nmismatch is rejected.\n\nA DISPATCH_ACTION frame that carries lastRevision is a conditional\nwrite on exactly the terms the actions endpoint uses for\nexpectedRevision: it is answered with 409 and an ERROR server frame\ncarrying the current state, applying nothing, unless the session is\nstill at that revision. lastRevision is ignored on RESUME, CANCEL, and\nPING. A RESUME frame of a Failed session with disposition RESUMABLE\nstarts a new phase and advances revision; GET /state is the re-attach\npath that does not. This operation declares no header parameters; the\nprecondition travels in the frame body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.handleWalletInteractionFrame\"}" } } }, { "name": "Resume a wallet interaction", "disabled": true, "request": { "description": "Picks a Failed interaction up where it stopped when error.disposition\nis RESUMABLE: starts a new phase of the same session and returns the\nrestored waiting state. Failed sessions with any other disposition\nare rejected. Live sessions are rehydrated without starting a new\nphase. Re-attaching after restart without changing a Failed session\nis GET /state, not this endpoint. This endpoint takes no request body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.resumeWalletInteraction\"}" } } }, { "name": "Register sensitive interaction input", "disabled": true, "request": { "description": "Registers client-supplied sensitive protocol input for this\ninteraction session and returns an opaque one-time reference. The\ncaller then passes the reference in a subsequent action such as\nsubmit_tx_code, auth_callback, or approve_security_challenge. The\nregistered value is bound to this session and purpose, is consumable\nat most once, is removed when the interaction terminates, is never\nechoed back in any response or interaction state, and is never\nlogged. Only purposes whose value originates at the wallet client are\naccepted: OID4VCI_TRANSACTION_CODE, OID4VCI_AUTHORIZATION_CALLBACK,\nand INTERACTION_SECURITY_GRANT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.registerWalletInteractionSensitiveInput\"}" } } }, { "name": "Get wallet interaction state", "disabled": true, "request": { "description": "Returns the current point-in-time state snapshot of the interaction\nsession, including the revision used for event replay and frame\nreconciliation. This is the re-attach path after restart: it\nrehydrates the session without starting a new phase, so a Failed\nsession stays Failed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-interaction.getWalletInteractionState\"}" } } } ] } ] }, { "name": "wallet-onboarding", "description": "Operations associated with the wallet-onboarding guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-onboarding-operations", "description": "wallet-onboarding-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Capture a one-use managed wallet identifier input", "disabled": true, "request": { "description": "Accepts the identifier only at the authenticated provider boundary. The clear-text email is\nprotected immediately and is never returned, retained in onboarding state, or published to\nevents, outbox messages, or audit projections.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.captureManagedWalletIdentifierInput\"}" } } }, { "name": "Start managed wallet onboarding", "disabled": true, "request": { "description": "POST /processes. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.startManagedWalletOnboarding\"}" } } }, { "name": "Observe managed wallet onboarding", "disabled": true, "request": { "description": "GET /processes/{processId}. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.observeManagedWalletOnboarding\"}" } } }, { "name": "Dispatch a typed onboarding action", "disabled": true, "request": { "description": "POST /processes/{processId}/actions. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.dispatchManagedWalletOnboardingAction\"}" } } }, { "name": "Cancel managed wallet onboarding", "disabled": true, "request": { "description": "POST /processes/{processId}/cancel. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.cancelManagedWalletOnboarding\"}" } } }, { "name": "List append-only managed wallet onboarding events", "disabled": true, "request": { "description": "GET /processes/{processId}/events. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.listManagedWalletOnboardingEvents\"}" } } }, { "name": "Resume from a verified one-use provider completion", "disabled": true, "request": { "description": "POST /processes/{processId}/resume. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.resumeManagedWalletOnboarding\"}" } } }, { "name": "Inspect privacy-safe managed wallet process support state", "disabled": true, "request": { "description": "GET /processes/{processId}/support. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-onboarding.inspectManagedWalletSupport\"}" } } } ] } ] }, { "name": "wallet-recovery", "description": "Operations associated with the wallet-recovery guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-recovery-operations", "description": "wallet-recovery-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Capture an atomic complete-unit production backup", "disabled": true, "request": { "description": "POST /backup/capture. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.captureEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Restore and inspect a complete unit in an isolated failure domain", "disabled": true, "request": { "description": "POST /backup/restore. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.restoreEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Verify the latest complete-unit production backup", "disabled": true, "request": { "description": "POST /backup/verify. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.verifyEnterpriseWalletCompleteUnitBackup\"}" } } }, { "name": "Begin fresh-IDV recovery for a new app on the existing wallet pair", "disabled": true, "request": { "description": "POST /newapp/begin. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.beginEnterpriseWalletNewAppRecovery\"}" } } }, { "name": "Atomically activate the new app and apply the old-app disposition", "disabled": true, "request": { "description": "POST /newapp/finalize. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.finalizeEnterpriseWalletNewAppRecovery\"}" } } }, { "name": "Begin recovery into a distinct successor wallet pair", "disabled": true, "request": { "description": "POST /successor/begin. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.beginEnterpriseWalletSuccessorMigration\"}" } } }, { "name": "Migrate complete logical state and atomically publish the successor", "disabled": true, "request": { "description": "POST /successor/finalize. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.finalizeEnterpriseWalletSuccessorMigration\"}" } } }, { "name": "Export a recipient-scoped protected vault package", "disabled": true, "request": { "description": "POST /vault/export. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.exportEnterpriseWalletVault\"}" } } }, { "name": "Import a verified recipient-scoped protected vault package", "disabled": true, "request": { "description": "POST /vault/import. Inspect the mounted OpenAPI operation in Developer Console for request and response schemas.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-recovery.importEnterpriseWalletVault\"}" } } } ] } ] }, { "name": "wallet-unit", "description": "Operations associated with the wallet-unit guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "wallet-unit-operations", "description": "wallet-unit-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "Enroll wallet activation", "disabled": true, "request": { "description": "Enrolls the activation verifier for a Wallet Unit. The verifier is\nblinded or derived proof material; raw PIN values are intentionally not\npart of this contract and must not cross this production API boundary.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.enrollWalletActivation\"}" } } }, { "name": "Begin passkey wallet activation ceremony", "disabled": true, "request": { "description": "Creates an operation-bound passkey assertion challenge for remote\nHSM-backed Wallet Unit activation. The returned challenge is bound to\nwallet unit, wallet account, activation key, operation hash, nonce, and\naudience, but does not reveal WSCD provider details to OIDC callers.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyActivation\"}" } } }, { "name": "Issue passkey wallet activation decision", "disabled": true, "request": { "description": "Finishes an operation-bound passkey assertion and issues a short-lived,\nsingle-use activation decision for remote HSM-backed WSCD signing.\nWallet signing still happens through the WSCD signing endpoints using\nthe returned activation decision id.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issuePasskeyActivationDecision\"}" } } }, { "name": "Re-enroll wallet activation", "disabled": true, "request": { "description": "Rotates the activation verifier after proving control of the current\nverifier. Both current and replacement values are blinded or derived\nproof material; this is not a reset or account-recovery workflow.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.reEnrollWalletActivation\"}" } } }, { "name": "Revoke wallet activation", "disabled": true, "request": { "description": "Revokes an activation profile/key binding so it can no longer issue\nactivation decisions. This endpoint is limited to activation state and\ndoes not dispatch user notifications or perform factory-delete logic.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletActivation\"}" } } }, { "name": "Unlock wallet activation", "disabled": true, "request": { "description": "Evaluates a blinded or derived activation proof for one operation-bound\nchallenge and returns an activation decision. Accepted decisions are\nshort-lived, single-use inputs for wallet-key signing and must match the\noperation type, hash, nonce, and audience exactly.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.unlockWalletActivation\"}" } } }, { "name": "Issue key attestation", "disabled": true, "request": { "description": "Issues a Key Attestation for one or more attested keys. Production KA\nissuance is bound to key-storage evidence, user-authentication evidence,\nconfigured Wallet Provider signing, and status-list evidence for\nrevocation checks.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issueKeyAttestation\"}" } } }, { "name": "Validate key attestation", "disabled": true, "request": { "description": "Validates KA material or a stored KA reference against audience, nonce,\nsigner trust, key-storage assurance, user-authentication evidence, and\nstatus evidence. This is evidence production for later OID4VCI checks;\nit does not enforce credential-request processing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateKeyAttestation\"}" } } }, { "name": "Validate wallet instance attestation", "disabled": true, "request": { "description": "Validates WIA material or a stored WIA reference against expected\naudience/issuer, JOSE material, Wallet Provider trust, Wallet Solution\ntrust, and status evidence. Missing, expired, revoked, unsupported, or\nuntrusted evidence fails closed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateWalletInstanceAttestation\"}" } } }, { "name": "Issue wallet instance attestation", "disabled": true, "request": { "description": "Issues a Wallet Instance Attestation for a Wallet Unit. Production TS03\nissuance requires configured Wallet Provider signing, Wallet Provider\ntrust evidence, Wallet Solution evidence, status subject evidence, and\nsecure-component evidence; local/test reference material remains\nexplicit and cannot satisfy production VALID evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.issueWalletInstanceAttestation\"}" } } }, { "name": "Get wallet attestation validation evidence", "disabled": true, "request": { "description": "Returns the persisted evidence summary for a previously issued or\nvalidated WIA/KA artifact, including failure reasons and provenance when\nvalidation was rejected.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletAttestationValidationEvidence\"}" } } }, { "name": "List wallet-unit party bindings", "disabled": true, "request": { "description": "Lists Wallet Unit to party-graph bindings. These bindings let VDX party\nand relationship services associate a wallet account, a Wallet Unit, and\ntheir relationship hints without making the Wallet Unit backend mandatory\nfor backendless IDK wallets.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnitPartyBindings\"}" } } }, { "name": "Begin passkey assertion ceremony", "disabled": true, "request": { "description": "Creates a WebAuthn assertion challenge for login, step-up, or wallet\nactivation. The browser or wallet application performs\n`navigator.credentials.get` at the edge and submits the assertion\nresponse to the finish endpoint.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyAssertion\"}" } } }, { "name": "Finish passkey assertion ceremony", "disabled": true, "request": { "description": "Verifies the WebAuthn assertion cryptographically, enforces RP/origin,\nuser verification, backup, transport, replay, ownership, and sign-count\npolicy, and returns operation-bound assertion evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.finishPasskeyAssertion\"}" } } }, { "name": "Begin passkey registration ceremony", "disabled": true, "request": { "description": "Creates a WebAuthn registration challenge for an Identity-bound passkey\ncredential. The browser or wallet application performs\n`navigator.credentials.create` at the edge and submits the resulting\npublic credential response to the finish endpoint.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.beginPasskeyRegistration\"}" } } }, { "name": "Finish passkey registration ceremony", "disabled": true, "request": { "description": "Verifies the WebAuthn registration response cryptographically and stores\nonly public credential material and Identity/Identifier metadata.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.finishPasskeyRegistration\"}" } } }, { "name": "Allocate wallet-unit status subject", "disabled": true, "request": { "description": "Allocates a backing entry in an existing status list for WIA client\nstatus, KA key-storage status, Wallet Unit status, WSCD/keystore status,\nor related attestation status. The allocation uses the shared status-list\nmodules and returns the compact reference that can be embedded in\nattestation claims.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.allocateWalletUnitStatusSubject\"}" } } }, { "name": "Check wallet-unit status subject", "disabled": true, "request": { "description": "Resolves the current status of a Wallet Unit status subject by compact\nreference or by subject kind and subject id. When unauthenticated\nstatus-list hosting is configured, the public status-list URI returned\nfrom allocation exposes the same revocation state.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.checkWalletUnitStatusSubject\"}" } } }, { "name": "Revoke wallet-unit status subject", "disabled": true, "request": { "description": "Records an irreversible revocation event and updates the backing\nstatus-list entry when a status subject reference is supplied. This is\nthe production publishing path for WIA/KA and secure-component\nrevocation; it does not implement notification, reset, or PID-provider\norchestration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletUnitStatusSubject\"}" } } }, { "name": "Resolve wallet provider trust evidence", "disabled": true, "request": { "description": "Resolves Wallet Provider or attestation-signer trust using the configured\ntrusted-list adapter and ETSI/LoTE trust primitives. The response\ncarries explicit rejection decisions for missing, expired, revoked,\nunsupported-profile, and untrusted evidence.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.resolveWalletProviderTrust\"}" } } }, { "name": "Resolve wallet solution trust evidence", "disabled": true, "request": { "description": "Resolves Wallet Solution trust for a named solution/version and optional\ncertification evidence. This is the Wallet Unit facade over the trusted\nlist evidence needed by WIA issuance and validation.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.resolveWalletSolutionTrust\"}" } } }, { "name": "List wallet units", "disabled": true, "request": { "description": "Lists Wallet Units visible to the caller. Use `walletAccountId` when a\ncaller needs the units belonging to one wallet account; omit it for the\ntenant-scoped view exposed by the service policy.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnits\"}" } } }, { "name": "Install a wallet unit", "disabled": true, "request": { "description": "Creates the persisted Wallet Unit and wallet-account records used by\nlater activation, attestation, status, and signing commands. The\nrequest may include remote key references, policy references, and party\nbinding evidence, but it does not make the Wallet Unit production VALID;\nVALID is only reached after the production evidence gate is satisfied.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.installWalletUnit\"}" } } }, { "name": "Get a wallet unit", "disabled": true, "request": { "description": "Returns the current Wallet Unit lifecycle state, account state, counters,\nallowed key references, policy references, and audit history. This is\nthe safest way for clients to check whether a unit is merely installed,\noperational, production VALID, revoked, or uninstalled.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnit\"}" } } }, { "name": "Mark wallet unit operational", "disabled": true, "request": { "description": "Moves an installed Wallet Unit into OPERATIONAL state once the local or\nbackend runtime has completed setup. OPERATIONAL means the unit can\ncollect activation and attestation evidence; it is not sufficient for\nproduction key signing.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.markWalletUnitOperational\"}" } } }, { "name": "Get wallet-unit party binding", "disabled": true, "request": { "description": "Returns the persisted party binding for one Wallet Unit, including\nrelationship hints and the provenance supplied when the binding was\ncreated or updated.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnitPartyBinding\"}" } } }, { "name": "Bind wallet unit to party IDs", "disabled": true, "request": { "description": "Creates or replaces the party binding for a Wallet Unit. This endpoint\nrecords party identifiers and relationship hints only; it does not alter\nactivation state, attestation evidence, status-list entries, or Wallet\nUnit lifecycle state.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.bindWalletUnitParty\"}" } } }, { "name": "Revoke wallet unit", "disabled": true, "request": { "description": "Marks the Wallet Unit REVOKED and records lifecycle evidence. When\nstatus subjects exist for WIA, KA, or related secure components, callers\nshould use the status-subject revocation endpoint to publish the\nirreversible status-list update through the shared status-list backend.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.revokeWalletUnit\"}" } } }, { "name": "Uninstall wallet unit", "disabled": true, "request": { "description": "Marks the Wallet Unit UNINSTALLED for lifecycle bookkeeping. This API\ndoes not implement factory reset or cryptographic asset deletion\norchestration; those workflows are outside this phase of the Wallet Unit\nsurface.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.uninstallWalletUnit\"}" } } }, { "name": "Validate wallet unit", "disabled": true, "request": { "description": "Transitions a Wallet Unit to VALID when persisted production evidence\nsatisfies the configured gate. The service evaluates stored activation\ntranscript evidence, WIA/KA evidence, trusted Wallet Provider/Solution\nevidence, status-list evidence, and secure-component evidence rather\nthan accepting ad-hoc test seeding.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.validateWalletUnit\"}" } } }, { "name": "List wallet-unit WSCD key references", "disabled": true, "request": { "description": "Lists only opaque key references already associated with the\nauthenticated Wallet Unit. Each entry is resolved through the internal\ntenant KMS public-material command; this operation never performs a\ntenant-wide key or provider enumeration.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.listWalletUnitWscdKeyReferences\"}" } } }, { "name": "Provision a wallet-unit WSCD key reference", "disabled": true, "request": { "description": "Provisions a managed holder-proof key through the tenant KMS execution\nboundary, then associates a new opaque `wscd_` reference with\nthe authenticated Wallet Unit and its account. The server resolves the\ntyped KMS assignment and derives all internal aliases. Callers cannot\nselect providers, KMS resources, handles, locators, or raw algorithms.\nPrivate key material is never returned.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.provisionWalletUnitWscdKeyReference\"}" } } }, { "name": "Get wallet-unit WSCD public key detail", "disabled": true, "request": { "description": "Resolves public verification material only after proving that the\nopaque key reference belongs to the authenticated Wallet Unit. Cross-\ntenant, cross-account, and cross-unit references fail closed.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.getWalletUnitWscdKeyReference\"}" } } }, { "name": "Create policy-gated WSCD raw signature", "disabled": true, "request": { "description": "Signs raw input with a Wallet Unit WSCD key after lifecycle, account status,\nkey-reference policy, and activation-decision checks. The activation\ndecision must be accepted, unexpired, unconsumed, and bound to the\nexact operation type, hash, nonce, and audience in this request.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.walletUnitWscdRawSign\"}" } } }, { "name": "Create policy-gated WSCD digest signature", "disabled": true, "request": { "description": "Signs a precomputed digest with a Wallet Unit WSCD key after the same\nlifecycle and activation-decision checks as raw signing. This endpoint\nis intended for flows that already compute the operation digest before\ninvoking the Wallet Unit WSCD policy layer.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"wallet-unit.walletUnitWscdSignDigest\"}" } } } ] } ] }, { "name": "workflow-authoring", "description": "Operations associated with the workflow-authoring guide. Read the guide before executing mutations and use the mounted Scalar/OpenAPI examples for the selected credential or protocol profile.", "item": [ { "name": "workflow-authoring-operations", "description": "workflow-authoring-operations operation sequence. Request and response details come from the same mounted OpenAPI catalog used by Developer Console.", "item": [ { "name": "List workflow definition family heads", "disabled": true, "request": { "description": "Returns the head (highest non-deleted version) of each family matching the filters.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.listWorkflowDefinitions\"}" } } }, { "name": "Create a new draft workflow definition", "disabled": true, "request": { "description": "Creates a new definition family and an initial version 1 DRAFT. Idempotent with X-Idempotency-Key; reusing a key with a different body returns 409 IDEMPOTENCY_KEY_CONFLICT.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.createWorkflowDefinition\"}" } } }, { "name": "Validate a candidate graph without persisting", "disabled": true, "request": { "description": "Validates a workflow graph and returns a WorkflowValidationReport without persisting\nanything. Returns 200 even when the graph is invalid (check `valid` in the body).\nReturns 400 only for a malformed request body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.validateWorkflowDefinition\"}" } } }, { "name": "Soft-delete an entire definition family", "disabled": true, "request": { "description": "Soft-deletes all versions of the family. In-flight workflow runs pinned to published versions are unaffected. The If-Match value is the ETag of the family head.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.deleteWorkflowDefinition\"}" } } }, { "name": "Get the head version of a definition family", "disabled": true, "request": { "description": "Returns the head (highest non-deleted version) of the family with its full graph.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getWorkflowDefinition\"}" } } }, { "name": "Get the latest published version of a definition family", "disabled": true, "request": { "description": "Returns the latest PUBLISHED version's full graph in one round-trip (runtime resolution view). Returns 404 if no published version exists.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getEffectiveWorkflowDefinition\"}" } } }, { "name": "List all versions of a definition family", "disabled": true, "request": { "description": "Returns the version history (all non-deleted versions) of the family, newest first by default.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.listWorkflowDefinitionVersions\"}" } } }, { "name": "Discard a draft version", "disabled": true, "request": { "description": "Soft-deletes a DRAFT version. Returns 422 (INVALID_STATE) if the version is not a DRAFT.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.deleteWorkflowDefinitionVersion\"}" } } }, { "name": "Get a specific version of a definition family", "disabled": true, "request": { "description": "Returns the full graph of an exact (definitionKey, version) pair.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getWorkflowDefinitionVersion\"}" } } }, { "name": "Edit a draft workflow definition version", "disabled": true, "request": { "description": "Applies a JSON Merge Patch (RFC 7396) to a DRAFT version. Semantics:\n- A null property value removes that field from the resource.\n- Array values replace the array wholesale; there is no item-level merge.\n- Supplying `graph` replaces the entire graph; individual steps or edges cannot\n be patched in-place.\n\nThe `If-Match` header carrying the current ETag is required. A mismatch returns\n412 (OPTIMISTIC_LOCK_CONFLICT). A successful update returns 200 with the updated\nresource and a new ETag. Returns 422 (INVALID_STATE) if the addressed version is\nnot a DRAFT.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.updateWorkflowDefinitionDraft\"}" } } }, { "name": "Archive a published version", "disabled": true, "request": { "description": "Transitions a PUBLISHED version to ARCHIVED. Archived versions are excluded from\nnew workflow-instance start and from the effective-version resolution, but in-flight\nruns pinned to this version are unaffected. Returns 422 (INVALID_STATE) if the version\nis not PUBLISHED.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.archiveWorkflowDefinitionVersion\"}" } } }, { "name": "Publish a draft version to an immutable published version", "disabled": true, "request": { "description": "Transitions a DRAFT version to PUBLISHED (immutable). The graph is validated as part\nof the publish gate. Returns 422 (INVALID_STATE) if the version is not a DRAFT, or if\ngraph validation fails (in which case the response body `details` field contains a\nWorkflowValidationReport).\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.publishWorkflowDefinitionVersion\"}" } } }, { "name": "Create a new draft seeded from an existing version", "disabled": true, "request": { "description": "Creates a new DRAFT seeded from the specified version (any version, not just the latest).\nThe new draft's `version` = maxVersion + 1 and `basedOnVersion` = the source version.\n`If-Match` carries the current family-head ETag so two concurrent revise attempts cannot both\ncreate a draft. Returns 422 (INVALID_STATE) if a DRAFT already exists for this family.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.reviseWorkflowDefinitionVersion\"}" } } }, { "name": "Get the evaluator capabilities for editor autocomplete", "disabled": true, "request": { "description": "Returns the evaluator's available payload variable paths and registered function\nset for editor autocomplete. Static today (functions list is empty until the\nevaluator ships); may gain context query parameters in a future revision.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getExpressionCapabilities\"}" } } }, { "name": "Validate an expression string", "disabled": true, "request": { "description": "Validates an expression string against the evaluator grammar and (optionally) a\npayload context sample. Returns 200 even when the expression is invalid — check\n`valid` in the response body. Returns 400 only for a malformed request body.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.validateExpression\"}" } } }, { "name": "Fetch type-ahead options from a dynamic option source", "disabled": true, "request": { "description": "Returns a page of dynamic options for the named option source.\nKnown keys: `workflow.connections`, `workflow.publishedForms`, `workflow.taskQueues`.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.listDynamicOptions\"}" } } }, { "name": "Deregister a step-type descriptor", "disabled": true, "request": { "description": "Soft-deletes the specified (stepTypeId, descriptorVersion) by marking it DEPRECATED.\nNo-op when the id is absent. In-flight workflows that reference the descriptor are\nunaffected — DEPRECATED descriptors continue to resolve for existing definitions.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.deregisterStepType\"}" } } }, { "name": "Register or refresh a step-type descriptor", "disabled": true, "request": { "description": "Idempotent upsert keyed by (scope, stepTypeId, descriptorVersion). The path\nsupplies stepTypeId and descriptorVersion. The namespace is supplied via the query\nparameter (defaults to `default`); the scope (tenant) and lifecycle are\nderived from the worker token. Returns 201 (INSERTED) on first registration,\n200 (REFRESHED or UPDATED) on subsequent calls, distinguished by upsertOutcome in\nthe body. Only name, description, and palette changes are cosmetic updates. Any change\nto binding, kind/family, IO identifiers, terminals, property form, restrictions, defaults,\nor scope is structural and returns 409 unless descriptorVersion is bumped.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.registerStepType\"}" } } }, { "name": "List ACTIVE step-type descriptors (palette)", "disabled": true, "request": { "description": "Returns the palette of ACTIVE step-type descriptors matching the filters. DEPRECATED and STALE descriptors are excluded.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.listStepTypes\"}" } } }, { "name": "Get the latest ACTIVE descriptor for a step type", "disabled": true, "request": { "description": "Returns the latest ACTIVE step-type descriptor in the given namespace scope.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getStepType\"}" } } }, { "name": "Resolve the property-editor form for a step type", "disabled": true, "request": { "description": "Opens the property editor by resolving a workflow-specific wrapper around ResolvedForm. Supply\n`currentValues` to prefill the form when editing an existing step instance; omit\nto receive server-supplied defaults for a new step instance. Authored values use the same\nAuthoredConfig literal / `$expr` representation as the stored workflow graph.\n\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.resolveStepTypeForm\"}" } } }, { "name": "Get a specific version of a step-type descriptor", "disabled": true, "request": { "description": "Returns the exact (stepTypeId, descriptorVersion) pair with observable lifecycle and liveness timestamps. Resolves DEPRECATED descriptors for existing definitions, validation, and monitoring.\n\nThis protected operation is routed through the Developer Console BFF. Authenticate first and replace only the allowlisted route request payload described by the mounted operation; the browser never receives the upstream access token.", "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": "{{baseUrl}}/api/developer-console/v1/bff/forward", "body": { "mode": "raw", "raw": "{\"routeId\":\"workflow-authoring.getStepTypeVersion\"}" } } } ] } ] } ] } ], "variable": [ { "key": "baseUrl", "value": "", "type": "default", "enabled": true }, { "key": "tenantId", "value": "", "type": "default", "enabled": true }, { "key": "authorizationServer", "value": "", "type": "default", "enabled": true } ], "auth": { "type": "oauth2", "oauth2": [ { "key": "grant_type", "value": "authorization_code", "type": "string" }, { "key": "client_id", "value": "developer-postman", "type": "string" }, { "key": "client_authentication", "value": "none", "type": "string" }, { "key": "authUrl", "value": "{{authorizationServer}}/authorize", "type": "string" }, { "key": "accessTokenUrl", "value": "{{authorizationServer}}/token", "type": "string" }, { "key": "redirect_uri", "value": "https://oauth.pstmn.io/v1/browser-callback", "type": "string" }, { "key": "scope", "value": "openid profile developer-console.read", "type": "string" }, { "key": "code_challenge_method", "value": "S256", "type": "string" }, { "key": "usePkce", "value": "true", "type": "string" } ] } }