The organization's handle (unique). Not the internal database uuid.
displayName
string
false
none
none
businessOwner
string¦null
false
none
none
businessOwnerContact
string¦null
false
none
none
businessOwnerEmail
string(email)¦null
false
none
none
idpRefId
string
false
none
The organization claim value asserted by the configured identity provider (IDP) at single sign-on (SSO) login. On every login, the portal matches the authenticated user's org claim against this value to resolve which organization they belong to — it must exactly match the IDP's claim, or login fails for that org's users. Distinct from cpRefId, which is unrelated to authentication.
cpRefId
string¦null
false
none
Control Plane reference ID. Included in outbound webhook event payloads so subscribers can correlate this organization with its Control Plane (Platform API) counterpart. Not used for authentication or org resolution.
configuration
object
false
none
Free-form organization configuration set by the caller. Which artifact types the portal serves is operator configuration (api_portal.artifacts), not part of this.
Fields are returned at the root of ApiMetadataResponse / ApiMetadataCreateResponse (not nested under an apiInfo key) — this schema exists only to share the field set between the two via allOf.
and
Name
Type
Required
Restrictions
Description
anonymous
object
false
none
none
» id
string
false
none
The API's handle (unique per org). Not the internal database uuid.
» refId
string¦null
false
none
Platform API (Control Plane) reference ID for this API. Used for MCP registry visibility filtering and included in outbound webhook event payloads. Null/absent for APIs that exist only in the API Portal and are not registered with the Platform API — e.g. MCP servers published via the registry.
Fields are returned at the root of ApiMetadataResponse / ApiMetadataCreateResponse (not nested under an apiInfo key) — this schema exists only to share the field set between the two via allOf.
and
Name
Type
Required
Restrictions
Description
anonymous
object
false
none
none
» id
string
false
none
The API's handle (unique per org). Not the internal database uuid.
» refId
string¦null
false
none
Platform API (Control Plane) reference ID for this API. Used for MCP registry visibility filtering and included in outbound webhook event payloads. Null/absent for APIs that exist only in the API Portal and are not registered with the Platform API — e.g. MCP servers published via the registry.
» dataSource
string¦null
false
none
Indicates which content matched the search term: METADATA if the match was in the API's own metadata, or a content type (e.g. a value from the API Content type field) if the match was inside an uploaded content file. Only computed by getAllApiMetadataForOrganization when both the query search parameter is supplied and the database is PostgreSQL — absent on SQLite (the dev default) and absent from every other operation (get/create/update single API).
Identity of the user who created this API, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
» updatedBy
string
false
none
Identity of the user who last updated this API, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
Fields are returned at the root of ApiMetadataResponse / ApiMetadataCreateResponse (not nested under an apiInfo key) — this schema exists only to share the field set between the two via allOf.
The stored/returned type constant (src/utils/constants.js API_TYPE) — distinct from the request-time keyword accepted on create/update (see type in ApiMetadataMultipartBody: REST, SOAP, MCP, WS, WEBSUB, GRAPHQL). REST maps to RestApi and WEBSUB maps to WebSubApi; the rest are returned unchanged.
referenceId
string¦null
false
none
External reference ID. Present when the API was created from a YAML artifact whose spec block sets referenceId — the create response echoes the parsed YAML back.
The plan's handle (unique per org). Not the internal database uuid.
displayName
string
false
none
none
description
string
false
none
none
limits
[object]
false
none
Rate/quota limits enforced for this plan. Empty when the plan is unlimited.
» limitType
string
false
none
none
» limitCount
any
false
none
Returned as a string when the stored count exceeds the safe integer range, otherwise a number. Unlimited plans have no limit entries — the limits array is empty.
oneOf
Name
Type
Required
Restrictions
Description
»» anonymous
integer
false
none
none
xor
Name
Type
Required
Restrictions
Description
»» anonymous
string
false
none
none
continued
Name
Type
Required
Restrictions
Description
» timeUnit
string¦null
false
none
none
» timeAmount
integer
false
none
none
refId
string¦null
false
none
Platform API subscription plan UUID associated with this plan.
orgId
string
false
none
none
createdBy
string
false
none
Identity of the user who created this subscription plan, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated this subscription plan, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
The label's handle (unique per org). Not the internal database uuid.
displayName
string
false
none
none
ApplicationResponse
{"id":"my-weather-app","displayName":"Weather App","description":"Application used to call Weather APIs.","appKeyMappings":[{"asClientId":"asgardeo-client-abc123","kmId":"km-uuid-12345","type":"PRODUCTION"}],"createdBy":"[email protected]","updatedBy":"[email protected]","createdAt":"2026-05-07T08:30:00Z","updatedAt":"2026-05-07T08:30:00Z"}
[OAuth client ID mapping entry attached to an application.]
createdBy
string
false
none
Identity of the user who created this application, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated this application, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
The view's handle (unique per org). Not the internal database uuid.
displayName
string
true
none
none
labels
[string]
true
none
none
createdBy
string
false
none
Identity of the user who created this view, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated this view, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
Desired handle for the organization (unique), stored as-is. Used in portal URLs.
idpRefId
string
true
none
The organization claim value asserted by the configured Identity Provider at SSO login. Must exactly match the IDP's org claim for that org's users, or login will fail. Distinct from cpRefId.
cpRefId
string¦null
false
none
Control Plane reference ID, included in outbound webhook event payloads. Not used for authentication.
Desired handle for the organization (unique), stored as-is. Used in portal URLs.
idpRefId
string
true
none
The organization claim value asserted by the configured Identity Provider at SSO login. Must exactly match the IDP's org claim for that org's users, or login will fail. Distinct from cpRefId.
cpRefId
string¦null
false
none
Control Plane reference ID, included in outbound webhook event payloads. Not used for authentication.
Optional desired handle for the plan (unique per org), stored as-is. When omitted, the server generates a UUID handle. When the plan is created from a SubscriptionPlan YAML artifact instead, the handle is always taken from metadata.name.
refId
string
false
none
Platform API subscription plan UUID to associate with this plan.
displayName
string
true
none
none
description
string
false
none
none
limits
[object]
false
none
Rate/quota limits enforced for this plan. Omit or leave empty for an unlimited plan. Replaces the whole limit set on update.
» limitType
string
false
none
none
» limitCount
integer
true
none
Use -1 for unlimited, otherwise a positive number.
» timeUnit
string¦null
false
none
Omit for a limit with no time window.
» timeAmount
integer
false
none
Size of the time window, in timeUnit units.
type
string
false
none
Legacy shorthand accepted only via SubscriptionPlan/SubscriptionPlanList YAML upload (multipart/form-data); converted into limits before storage. Ignored for JSON requests — use limits instead.
requestCount
any
false
none
Legacy YAML shorthand paired with type: requestcount. Use -1 for unlimited.
oneOf
Name
Type
Required
Restrictions
Description
» anonymous
integer
false
none
none
xor
Name
Type
Required
Restrictions
Description
» anonymous
string
false
none
none
continued
Name
Type
Required
Restrictions
Description
eventCount
any
false
none
Legacy YAML shorthand paired with type: eventcount. Use -1 for unlimited.
API ID the subscription belongs to. Optional — if provided, it is validated against the API derived from the existing subscription record and the request is rejected with 400 if they don't match. It is never used as a fallback: if the API cannot be derived from the subscription record, the request fails with 400 regardless of this value.
Plaintext subscription token, decrypted on every read (not just on create). Null if decryption fails (e.g. the encryption key changed since the token was stored).
subscriptionPlanName
string
false
none
none
status
string
false
none
none
createdBy
string
false
none
Identity of the user who created the subscription, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated the subscription, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
Optional handle for the key. When provided it must match the pattern and be unique for this API; when omitted, the server generates a UUID handle.
displayName
string
false
none
Optional human-readable name for the key. Defaults to id when omitted.
subscriptionId
string
false
none
Optional subscription ID to associate the key with.
appId
string
false
none
Optional application ID to associate the key with, for analytics attribution only — it has no effect on the key's validity or authorization. Must belong to the same organization and be owned by the caller.
expiresAt
any
false
none
Optional ISO-8601 datetime with timezone, epoch seconds, or epoch milliseconds.
oneOf
Name
Type
Required
Restrictions
Description
» anonymous
string(date-time)
false
none
none
xor
Name
Type
Required
Restrictions
Description
» anonymous
number
false
none
none
ApiKeyMetadataResponse
{"id":"weather_prod_key","displayName":"Weather Prod Key","apiId":"weather-api-v1","appId":"my-weather-app","appDisplayName":"My Mobile App","status":"ACTIVE","expiresAt":"2026-12-31T23:59:59Z","createdAt":"2019-08-24T14:15:22Z","revokedAt":"2019-08-24T14:15:22Z"}
API key metadata returned by list operations. Secret material is omitted.
API key response returned by generate/regenerate only. Unlike ApiKeyMetadataResponse, this does not include apiId, appId, appDisplayName, createdAt, or revokedAt — generate/regenerate return only these five fields.
Optional desired handle for the key manager (unique per org), stored as-is. When omitted, the server generates a UUID handle. A collision on a handle you supply yourself is reported as 409.
enabled
boolean
false
none
none
tokenEndpoint
string(uri)
true
none
OAuth2 token endpoint. The OAuth application itself must be created directly in this key manager; the portal only proxies client_appKeyMappings token requests to this endpoint.
The key manager's handle (unique per org). Not the internal database uuid.
displayName
string
false
none
none
orgId
string
false
none
none
enabled
boolean
false
none
none
tokenEndpoint
string(uri)
false
none
none
createdBy
string
false
none
Identity of the user who created this key manager, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated this key manager, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
Optional handle for the webhook subscriber (unique per org), stored as-is. When omitted, the server generates a UUID handle. Supply it only when you need a specific, stable identifier — it is the id used in the resource path, and a collision on a handle you supplied yourself is reported as 409.
displayName
string
true
none
Display name for the webhook subscriber.
targetUrl
string(uri)
true
none
Target URL events are POSTed to.
secret
string
false
none
Shared secret, used for two purposes. It signs outgoing payloads with a hash-based message authentication code (HMAC-SHA256). It also derives, through HKDF-SHA3-256, the AES-256-GCM key that encrypts sensitive fields in apikey.* and subscription.* payloads, so only the subscriber can read the plaintext. Encrypted fields arrive as data.iv, data.tag, and data.ciphertext; the derivation and a worked decryption example are documented in the webhook event catalog. Stored encrypted, and never returned in responses.
events
[string]
false
none
Glob-style event type allowlist (only a trailing * wildcard is supported, e.g. apikey.*). Omit or leave empty to receive all event types.
The webhook subscriber's handle (unique per org). Not the internal database uuid.
orgId
string
false
none
none
displayName
string
false
none
none
targetUrl
string(uri)
false
none
none
enabled
boolean
false
none
none
events
[string]
false
none
none
timeoutMs
integer
false
none
none
hasSecret
boolean
false
none
Whether a secret is configured. The same secret serves two purposes. It signs outgoing payloads with a hash-based message authentication code (HMAC), and it derives the AES-256-GCM key that encrypts sensitive fields. Encrypted fields arrive as data.iv, data.tag, and data.ciphertext; the derivation and a worked decryption example are documented in the webhook event catalog.
createdBy
string
false
none
Identity of the user who created this webhook subscriber, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.
updatedBy
string
false
none
Identity of the user who last updated this webhook subscriber, or deleted_user if that user's IDP reference no longer exists. Present on single-resource GET responses only, omitted on list items.
The OAuth client_id, created directly in the key manager. The portal does not store or persist the client secret — it is supplied per-request when generating a token and is only seen transiently during that request.
Full desired set of label names for the view. Labels present here but not currently attached are attached; labels currently attached but absent here are detached. Omit to leave labels unchanged.
Access token response proxied from the key manager's token endpoint. Field names are the portal's own camelCase, not the underlying OAuth2 token response's snake_case.
{"displayName":"Weather onboarding","id":"weather-onboarding","description":"Guides users through the Weather API onboarding workflow.","agentPrompt":"Follow this workflow to onboard a Weather API user.","status":"PUBLISHED","agentVisibility":"VISIBLE","contentType":"ARAZZO","apiWorkflowDefinition":{},"markdownContent":"string"}
Desired handle for the workflow (unique per org and view), stored as-is.
description
string
false
none
none
agentPrompt
string
false
none
none
status
string
false
none
none
agentVisibility
string
false
none
none
contentType
string
false
none
none
apiWorkflowDefinition
any
false
none
none
oneOf
Name
Type
Required
Restrictions
Description
» anonymous
object
false
none
none
xor
Name
Type
Required
Restrictions
Description
» anonymous
string
false
none
none
continued
Name
Type
Required
Restrictions
Description
markdownContent
string
false
none
none
Enumerated Values
Property
Value
status
DRAFT
status
PUBLISHED
agentVisibility
VISIBLE
agentVisibility
HIDDEN
contentType
ARAZZO
contentType
MD
APIWorkflowPromptRequest
{"displayName":"Weather onboarding","description":"Guides users through the Weather API onboarding workflow.","apis":[{}],"orgHandle":"acme","viewName":"default","id":"weather-onboarding"}