Cirrus Identity Identities API

v1.1.0

Base URL

/identities/v1

Permissions

Identities API credentials are managed by organizational admins in the Cirrus Console.

You can validate the permissions associated with your credential under the Miscellaneous category.

Supported Miscellaneous operations:

retrieve permissions for the current API credential

Identities

Identity objects are the top-level records that track information or assets associated with a user.

Supported identities operations:

list all identities
list identities with an attribute collection associated with a specific authority (for example, show all identities with the "alumni" authority)
fetch a single identity by cirrusUid
create a new identity, along with optional associations that may be configured for your environment, such as OrgBrandedID login credentials, generated user identifiers with a specific format, or specific attribute collections
modify an existing identity -- update any of givenName, sn, and mail
search identities by a keyword (searchTerm) -- name and email fields on the identity, and any linked attribute collections, will be searched using this term as a sub-string match

Attribute Collections

Attribute collections are bundles of attributes associated with a specific authority, such as a department or a sign-in credential.

Supported attributeCollections operations:

create a new attribute collection under an authorized authority
modify an existing attribute collection (replace or merge attributes)
delete an existing attribute collection

Remote Credentials

Remote credentials are a special case of an attribute collection, used to pre-link an identity record with a credential issued by a remote authentication provider prior to that credential being seen at a Cirrus Proxy. Remote credentials ensure that authentication at a Cirrus Proxy with a particular remote authentication provider credential results in association with the correct, pre-provisioned identity record.

Because remote credentials represent a remote (external) authentication provider, only the authority and uid (credential identifier) are permitted; no additional attributes may be provided. Remote credential authorities may not be any Cirrus OBID or Gateway Identity Provider EntityID.

Remote credential attribute collections are included in the response of identities read operations that include attributeCollections in their output (i.e., GET /list/byAttributeCollection/{environment} and GET /fetch/{cirrusId}). The attributes member of any remote credential attribute collection will always be an empty object (i.e., "attributes": {}).

Supported remoteCredentials operations:

create a new remote credential
delete an existing remote credential

OrgBrandedIDs

OrgBrandedID is a hosted username and password option included with many Cirrus Identity subscriptions.

Supported OrgBrandedID operations:

create a new OBID and link its attribute collection to an existing identity

Authentication

HTTPBasichttp

Scheme: basic

Miscellaneous

Fetch Permissions

GET

/identities/v1/permissions

Return permissions for the current credential.

Permissions are returned as a JSON object with a structure similar to the following:

{
    "username": "KQRAMJQXENIABXTZ",
    "orgDomain": "athena-institute.net",
    "environments": {
        "prod": {
            "permissions": [
                "admin-all",
                "read",
                "write",
                "delete"
            ],
            "customerUidKeys": ["athena:netId"],
            "attributeAuthorities": ["parking", "foundation"]
        },
        "test": {
            "permissions": [
                "admin-all",
                "read",
                "write",
                "delete"
            ],
            "customerUidKeys": ["athena:netId"],
            "attributeAuthorities": ["parking", "foundation"],
        }
    },
    "obid": [
        "read",
        "write"
    ]
}

Properties in the permissions object:

username: API credential username currently being used
orgDomain: the organizational domain for which the credential was provisioned
environments: there will be two environments listed here, test and prod
- environments.<environment>.permissions: an array of permissions in the specified identity environment:
  - admin-all: API credential has all available identity record permissions, including permissions introduced in the future
  - read: API credential has read access to identity records
  - write: API credential has write access (create/modify) to identity records
- environments.<environment>.customerUidKeys: an array of customer-defined UID keys which the API credential may use when creating identities. Please contact Cirrus Identity Support for additional information.
- environments.<environment>.attributeAuthorities: an array of attribute authority identifiers which the API credential may use when creating identities or creating/modifying attribute collections. Please contact Cirrus Identity Support for additional information.
obid: an array of permissions for OBID accounts. These permissions apply in both the test and prod environments:
- read: API credential has read access to OBID account attribute collections
- write: API credential may auto-create an OBID account at identity creation time, or create an OBID account for a pre-existing identity

Response

200OKIdentitiesApiUserPermissionsModel

Success

401Unauthorized

Unauthorized

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Fetch Permissions

curl -X GET '/identities/v1/permissions'

const response = await fetch('/identities/v1/permissions', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/permissions')
data = response.json()

{
  "username": "KQRAMJQXENIABXTZ",
  "orgDomain": "athena-institute.net",
  "environments": {
    "prod": {
      "permissions": [
        "admin-all",
        "read",
        "write"
      ],
      "customerUidKeys": [
        "athena:netId"
      ],
      "attributeAuthorities": [
        "parking",
        "foundation"
      ]
    },
    "test": {
      "permissions": [
        "admin-all",
        "read",
        "write"
      ],
      "customerUidKeys": [
        "athena:netId"
      ],
      "attributeAuthorities": [
        "parking",
        "foundation"
      ]
    }
  },
  "obid": [
    "read",
    "write"
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "database error: ..."
}

Fetch Permissions

curl -X GET '/identities/v1/permissions'

const response = await fetch('/identities/v1/permissions', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/permissions')
data = response.json()

{
  "username": "KQRAMJQXENIABXTZ",
  "orgDomain": "athena-institute.net",
  "environments": {
    "prod": {
      "permissions": [
        "admin-all",
        "read",
        "write"
      ],
      "customerUidKeys": [
        "athena:netId"
      ],
      "attributeAuthorities": [
        "parking",
        "foundation"
      ]
    },
    "test": {
      "permissions": [
        "admin-all",
        "read",
        "write"
      ],
      "customerUidKeys": [
        "athena:netId"
      ],
      "attributeAuthorities": [
        "parking",
        "foundation"
      ]
    }
  },
  "obid": [
    "read",
    "write"
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "database error: ..."
}

Identities

List Identities

GET

/identities/v1/list/{environment}

List all identity records for a specific environment (test or prod).

Parameters

environmentIdentityEnvironmenttestprodrequiredpath

identity environment

page_idxinteger>= 11query

requested page index

page_sizeinteger[1, 50]10query

requested number of items per page

sort_keyIdentityListSortKeycirrusUidsngivenNamemailcreateTimelastUpdateTimecreateTimequery

sort key

sort_orderIdentityListSortOrderascdescascquery

sort order

search_termstring | nullquery

optional search term

Response

200OKPage_IdentityModelBase_

Successful Response

401Unauthorized

Unauthorized

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

List Identities

curl -X GET '/identities/v1/list/{environment}'

const response = await fetch('/identities/v1/list/{environment}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/list/{environment}')
data = response.json()

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z"
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

List Identities

curl -X GET '/identities/v1/list/{environment}'

const response = await fetch('/identities/v1/list/{environment}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/list/{environment}')
data = response.json()

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z"
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

List Identities By Attr Collection

GET

/identities/v1/list/byAttributeCollection/{environment}

List all identity records associated with a specific attributeCollectionAuthority (e.g., records containing an alumni attribute collection), or a combination of attributeCollectionAuthority and uid (e.g., find the alumni record with alumni uid of '1234567').

Parameters

environmentIdentityEnvironmenttestprodrequiredpath

identity environment

attributeAuthoritystringrequiredquery

attribute authority identitifer

attributeAuthorityUidstringquery

unique UID assigned by attribute authority

page_idxinteger>= 11query

page_sizeinteger[1, 50]10query

sort_keyIdentityListSortKeyidcirrusUidsngivenNamemailcreateTimelastUpdateTimecreateTimequery

sort_orderIdentityListSortOrderascdescascquery

Response

200OKPage_IdentityModel_

Successful Response

401Unauthorized

Unauthorized

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

List Identities By Attr Collection

curl -X GET '/identities/v1/list/byAttributeCollection/{environment}'

const response = await fetch('/identities/v1/list/byAttributeCollection/{environment}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/list/byAttributeCollection/{environment}')
data = response.json()

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {},
          "createTime": "2024-01-15T09:30:00Z",
          "lastUpdateTime": "2024-01-15T09:30:00Z",
          "credentialLastUsed": "2024-01-15T09:30:00Z",
          "attributeCollectionAuthorityType": "sor"
        }
      ]
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

List Identities By Attr Collection

curl -X GET '/identities/v1/list/byAttributeCollection/{environment}'

const response = await fetch('/identities/v1/list/byAttributeCollection/{environment}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/list/byAttributeCollection/{environment}')
data = response.json()

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {},
          "createTime": "2024-01-15T09:30:00Z",
          "lastUpdateTime": "2024-01-15T09:30:00Z",
          "credentialLastUsed": "2024-01-15T09:30:00Z",
          "attributeCollectionAuthorityType": "sor"
        }
      ]
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Search Identities

GET

/identities/v1/search/{environment}/{searchTerm}

List cirrusUid values for identity records matching search term. Search includes attribute collections.

Parameters

environmentIdentityEnvironmenttestprodrequiredpath

identity environment

searchTermstringrequiredpath

term to use in search; will be sub-string matched against name and email fields in identity and linked attributeCollections

Response

200OKArray<string>

Success

401Unauthorized

Unauthorized

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Search Identities

curl -X GET '/identities/v1/search/{environment}/{searchTerm}'

const response = await fetch('/identities/v1/search/{environment}/{searchTerm}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/search/{environment}/{searchTerm}')
data = response.json()

[
  "2ca73926-1c6a-44e9-8fc1-6c0c835d4a15",
  "2d615256-c822-4435-bf38-d36ba3c0f6c4",
  "9b8dadb8-62c1-4461-a4d7-2201a1cac407"
]

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Search Identities

curl -X GET '/identities/v1/search/{environment}/{searchTerm}'

const response = await fetch('/identities/v1/search/{environment}/{searchTerm}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/search/{environment}/{searchTerm}')
data = response.json()

[
  "2ca73926-1c6a-44e9-8fc1-6c0c835d4a15",
  "2d615256-c822-4435-bf38-d36ba3c0f6c4",
  "9b8dadb8-62c1-4461-a4d7-2201a1cac407"
]

{
  "detail": "not authorized"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Fetch Identity

GET

/identities/v1/fetch/{cirrusUid}

Retrieve a single identity record by cirrusUid.

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

Response

200OKIdentityModel

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Fetch Identity

curl -X GET '/identities/v1/fetch/{cirrusUid}'

const response = await fetch('/identities/v1/fetch/{cirrusUid}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/fetch/{cirrusUid}')
data = response.json()

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Fetch Identity

curl -X GET '/identities/v1/fetch/{cirrusUid}'

const response = await fetch('/identities/v1/fetch/{cirrusUid}', {
  method: 'GET',
});

const data = await response.json();

import requests

response = requests.get('/identities/v1/fetch/{cirrusUid}')
data = response.json()

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Create Identity

POST

/identities/v1/create/{environment}

Create an identity record, including optional additions as permitted for your credential:

obid - Create an OrgBrandedID sign-in credential for the identity, inviting the user to set a password for it, e.g.:
```
"obid": true
```
quiet - Suppress any user-facing emails that might be triggered as a result of account creation - e.g., an OrgBrandedID account setup email
```
"quiet": true
```

attributeCollections - Create one or more authorized types of attribute collections for the identity, e.g.:

"attributeCollections": [
    {
        "attributeCollectionAuthority": "alumni",
        "uid": "al-12345",
        "attributes": {
            "alumniId": [
                "al-12345"
            ],
            "givenName": [
                "Alice"
            ],
            "sn": [
                "Arcus"
            ]
        }
    }
]

remoteCredentials - Create one or more remote credentials for the identity, e.g.:

"remoteCredentials": [
    {
        "remoteCredentialAuthority": "https://shib.athena-institute.net/idp/shibboleth",
        "uid": "hugohail123"
    }
]

customerUidGen - Auto-generate an identifier with a format customized to your organization, e.g.:
```
"customerUidGen": "athenaCustomId"
```

Body

application/json

model for creating a new identity record

mailstring<email>required

email address

givenNamestringrequired

given name

snstringrequired

surname

customerUidGenstring | null

optional Cirrus-provided key for generating customer-defined UIDs

obidbooleanfalse

whether to create/link an OrgBrandedID account for mail value

quietbooleanfalse

suppress any user-facing emails that might be triggered as a result of account creation - e.g., an OrgBrandedID account setup email

allowDuplicateEmailbooleanfalse

whether to allow creation of an identity record with an email address already associated with another identity

attributeCollectionsArray<AttributeCollectionInput> | null

optional list of attribute collections to create and link to identity record

remoteCredentialsArray<RemoteCredentialInput> | null

optional list of remote credential (authority, uid) pairs to create and link to identity record

Parameters

environmentIdentityEnvironmenttestprodrequiredpath

identity environment

Response

201CreatedIdentityModel

Successful Response

401Unauthorized

Unauthorized

409Conflict

Conflict

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Create Identity

curl -X POST '/identities/v1/create/{environment}' \
  -H 'Content-Type: application/json' \
  -d '{
    "mail": "user@example.com",
    "givenName": "string",
    "sn": "string",
    "customerUidGen": "string",
    "obid": false,
    "quiet": false,
    "allowDuplicateEmail": false,
    "attributeCollections": [
      {
        "attributeCollectionAuthority": "string",
        "uid": "string",
        "attributes": {}
      }
    ],
    "remoteCredentials": [
      {
        "remoteCredentialAuthority": "string",
        "uid": "string"
      }
    ]
  }'

const response = await fetch('/identities/v1/create/{environment}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "mail": "user@example.com",
      "givenName": "string",
      "sn": "string",
      "customerUidGen": "string",
      "obid": false,
      "quiet": false,
      "allowDuplicateEmail": false,
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {}
        }
      ],
      "remoteCredentials": [
        {
          "remoteCredentialAuthority": "string",
          "uid": "string"
        }
      ]
    }),
});

const data = await response.json();

import requests

payload = {
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": False,
  "quiet": False,
  "allowDuplicateEmail": False,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

response = requests.post('/identities/v1/create/{environment}', json=payload)
data = response.json()

Request Body

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": false,
  "quiet": false,
  "allowDuplicateEmail": false,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "identity record(s) for email \"user@domain.edu\" already exist: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": "OBID Error: account for \"user@domain.edu\" exists and is linked to other identity records: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": "attribute collection for (authority = \"sorId\", uid = \"sorUid\") already exists for identity UID = \"60ebb104-e6de-481e-aeed-b9f53083d05b\""
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Create Identity

curl -X POST '/identities/v1/create/{environment}' \
  -H 'Content-Type: application/json' \
  -d '{
    "mail": "user@example.com",
    "givenName": "string",
    "sn": "string",
    "customerUidGen": "string",
    "obid": false,
    "quiet": false,
    "allowDuplicateEmail": false,
    "attributeCollections": [
      {
        "attributeCollectionAuthority": "string",
        "uid": "string",
        "attributes": {}
      }
    ],
    "remoteCredentials": [
      {
        "remoteCredentialAuthority": "string",
        "uid": "string"
      }
    ]
  }'

const response = await fetch('/identities/v1/create/{environment}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "mail": "user@example.com",
      "givenName": "string",
      "sn": "string",
      "customerUidGen": "string",
      "obid": false,
      "quiet": false,
      "allowDuplicateEmail": false,
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {}
        }
      ],
      "remoteCredentials": [
        {
          "remoteCredentialAuthority": "string",
          "uid": "string"
        }
      ]
    }),
});

const data = await response.json();

import requests

payload = {
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": False,
  "quiet": False,
  "allowDuplicateEmail": False,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

response = requests.post('/identities/v1/create/{environment}', json=payload)
data = response.json()

Request Body

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": false,
  "quiet": false,
  "allowDuplicateEmail": false,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "identity record(s) for email \"user@domain.edu\" already exist: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": "OBID Error: account for \"user@domain.edu\" exists and is linked to other identity records: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": "attribute collection for (authority = \"sorId\", uid = \"sorUid\") already exists for identity UID = \"60ebb104-e6de-481e-aeed-b9f53083d05b\""
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Modify Identity

PATCH

/identities/v1/modify/{cirrusUid}

Modify core attributes of identity record.

The attributes that may be modified are:

givenName
sn
mail

Any combination of these attributes may be provided; only provided attribute values will be updated. Attributes with a value of null will be ignored (treated the same as omitting them).

If the mail attribute value is present on another identity in the same environment, a 409 Conflict error will be returned. If you wish to override this behavior, and allow duplicate email values, pass true for the boolean parameter, allowDuplicateEmail.

The updated identity record is returned upon success.

Body

application/json

model for modifying base properties on existing identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

surname

allowDuplicateEmailbooleanfalse

whether to allow creation of an identity record with an email address already associated with another identity

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

Response

200OKIdentityModel

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

409Conflict

Conflict

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Modify Identity

curl -X PATCH '/identities/v1/modify/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "mail": "user@example.com",
    "givenName": "string",
    "sn": "string",
    "allowDuplicateEmail": false
  }'

const response = await fetch('/identities/v1/modify/{cirrusUid}', {
  method: 'PATCH',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "mail": "user@example.com",
      "givenName": "string",
      "sn": "string",
      "allowDuplicateEmail": false
    }),
});

const data = await response.json();

import requests

payload = {
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "allowDuplicateEmail": False
}

response = requests.patch('/identities/v1/modify/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "allowDuplicateEmail": false
}

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "identity record(s) for email \"user@domain.edu\" already exist: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Modify Identity

curl -X PATCH '/identities/v1/modify/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "mail": "user@example.com",
    "givenName": "string",
    "sn": "string",
    "allowDuplicateEmail": false
  }'

const response = await fetch('/identities/v1/modify/{cirrusUid}', {
  method: 'PATCH',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "mail": "user@example.com",
      "givenName": "string",
      "sn": "string",
      "allowDuplicateEmail": false
    }),
});

const data = await response.json();

import requests

payload = {
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "allowDuplicateEmail": False
}

response = requests.patch('/identities/v1/modify/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "allowDuplicateEmail": false
}

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "identity record(s) for email \"user@domain.edu\" already exist: c2a34150-8f43-4f52-9601-3e7518ef0f34"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Attribute Collections

Create Attribute Collection

POST

/identities/v1/attributeCollections/create/{cirrusUid}

Create a new attribute collection under an authorized authority for an existing identity record.

Body

application/json

attribute collection model

attributeCollectionAuthoritystringrequired

identifier of attribute collection authority

uidstringrequired

unique identifier for attribute authority collection instance

attributesobject[object Object]

object of attribute keys and list of values

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

Response

201CreatedAttributeCollectionCreateOrModifyOutput

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

409Conflict

Conflict

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Create Attribute Collection

curl -X POST '/identities/v1/attributeCollections/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {}
  }'

const response = await fetch('/identities/v1/attributeCollections/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }),
});

const data = await response.json();

import requests

payload = {
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

response = requests.post('/identities/v1/attributeCollections/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "record already exists"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Create Attribute Collection

curl -X POST '/identities/v1/attributeCollections/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {}
  }'

const response = await fetch('/identities/v1/attributeCollections/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }),
});

const data = await response.json();

import requests

payload = {
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

response = requests.post('/identities/v1/attributeCollections/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "record already exists"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Modify Attribute Collection

PUT

/identities/v1/attributeCollections/modify/{cirrusUid}

Modify a specific attribute collection under an authorized authority for an identity record.

Body

application/json

attribute collection model

attributeCollectionAuthoritystringrequired

identifier of attribute collection authority

uidstringrequired

unique identifier for attribute authority collection instance

attributesobject[object Object]

object of attribute keys and list of values

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

overwritebooleanfalsequery

completely overwrite attributes (true) or merge (default, false)

Response

200OKAttributeCollectionCreateOrModifyOutput

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Modify Attribute Collection

curl -X PUT '/identities/v1/attributeCollections/modify/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {}
  }'

const response = await fetch('/identities/v1/attributeCollections/modify/{cirrusUid}', {
  method: 'PUT',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }),
});

const data = await response.json();

import requests

payload = {
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

response = requests.put('/identities/v1/attributeCollections/modify/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Modify Attribute Collection

curl -X PUT '/identities/v1/attributeCollections/modify/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {}
  }'

const response = await fetch('/identities/v1/attributeCollections/modify/{cirrusUid}', {
  method: 'PUT',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }),
});

const data = await response.json();

import requests

payload = {
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

response = requests.put('/identities/v1/attributeCollections/modify/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Delete Attribute Collection

DELETE

/identities/v1/attributeCollections/delete/{cirrusUid}

Delete a specific attribute collection under an authorized authority from an identity record.

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

attributeAuthoritystringrequiredquery

identifier of attribute collection authority

attributeAuthorityUidstringrequiredquery

unique identifier for attribute collection

Response

204No Content

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Delete Attribute Collection

curl -X DELETE '/identities/v1/attributeCollections/delete/{cirrusUid}'

const response = await fetch('/identities/v1/attributeCollections/delete/{cirrusUid}', {
  method: 'DELETE',
});

const data = await response.json();

import requests

response = requests.delete('/identities/v1/attributeCollections/delete/{cirrusUid}')
data = response.json()

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Delete Attribute Collection

curl -X DELETE '/identities/v1/attributeCollections/delete/{cirrusUid}'

const response = await fetch('/identities/v1/attributeCollections/delete/{cirrusUid}', {
  method: 'DELETE',
});

const data = await response.json();

import requests

response = requests.delete('/identities/v1/attributeCollections/delete/{cirrusUid}')
data = response.json()

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Remote Credentials

Create Remote Credential

POST

/identities/v1/remoteCredentials/create/{cirrusUid}

Create a new remote credential under an existing identity record.

Body

application/json

remote credential model

remoteCredentialAuthoritystringrequired

identifier of remote credential authority

uidstringrequired

unique identifier at remote credential authority

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

Response

201CreatedAttributeCollectionCreateOrModifyOutput

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

409Conflict

Conflict

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Create Remote Credential

curl -X POST '/identities/v1/remoteCredentials/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "remoteCredentialAuthority": "string",
    "uid": "string"
  }'

const response = await fetch('/identities/v1/remoteCredentials/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }),
});

const data = await response.json();

import requests

payload = {
  "remoteCredentialAuthority": "string",
  "uid": "string"
}

response = requests.post('/identities/v1/remoteCredentials/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "remoteCredentialAuthority": "string",
  "uid": "string"
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "record already exists"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Create Remote Credential

curl -X POST '/identities/v1/remoteCredentials/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "remoteCredentialAuthority": "string",
    "uid": "string"
  }'

const response = await fetch('/identities/v1/remoteCredentials/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }),
});

const data = await response.json();

import requests

payload = {
  "remoteCredentialAuthority": "string",
  "uid": "string"
}

response = requests.post('/identities/v1/remoteCredentials/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "remoteCredentialAuthority": "string",
  "uid": "string"
}

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "record already exists"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Delete Remote Credential

DELETE

/identities/v1/remoteCredentials/delete/{cirrusUid}

Delete a specific remote credential under an identity record.

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

remoteCredentialAuthoritystringrequiredquery

identifier of remote credential authority

remoteCredentialUidstringrequiredquery

unique identifier at remote credential authority

Response

204No Content

Successful Response

401Unauthorized

Unauthorized

404Not Found

Not Found

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Delete Remote Credential

curl -X DELETE '/identities/v1/remoteCredentials/delete/{cirrusUid}'

const response = await fetch('/identities/v1/remoteCredentials/delete/{cirrusUid}', {
  method: 'DELETE',
});

const data = await response.json();

import requests

response = requests.delete('/identities/v1/remoteCredentials/delete/{cirrusUid}')
data = response.json()

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Delete Remote Credential

curl -X DELETE '/identities/v1/remoteCredentials/delete/{cirrusUid}'

const response = await fetch('/identities/v1/remoteCredentials/delete/{cirrusUid}', {
  method: 'DELETE',
});

const data = await response.json();

import requests

response = requests.delete('/identities/v1/remoteCredentials/delete/{cirrusUid}')
data = response.json()

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Obid

Create Obid

POST

/identities/v1/obids/create/{cirrusUid}

Create a new OrgBrandedID sign-in credential for an existing identity record, sending an onboarding email to the designated email address. The quiet flag can be used to suppress the OrgBrandedID account setup email.

Body

application/json

model for creating a new OBID account

givenNamestring | null

first name

surnamestringrequired

last name

emailstring<email>required

email address

quietbooleanfalse

suppress OrgBrandedID account setup email

Parameters

cirrusUidstringrequiredpath

cirrusUid of identity record

Response

201CreatedAttributeCollectionCreateOrModifyOutput

Success

401Unauthorized

Unauthorized

404Not Found

Not Found

409Conflict

Conflict

422Unprocessable EntityHTTPValidationError

Validation Error

500Internal Server Error

Internal Server Error

Authorization

HTTPBasichttp (basic)

Create Obid

curl -X POST '/identities/v1/obids/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "givenName": "string",
    "surname": "string",
    "email": "user@example.com",
    "quiet": false
  }'

const response = await fetch('/identities/v1/obids/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "givenName": "string",
      "surname": "string",
      "email": "user@example.com",
      "quiet": false
    }),
});

const data = await response.json();

import requests

payload = {
  "givenName": "string",
  "surname": "string",
  "email": "user@example.com",
  "quiet": False
}

response = requests.post('/identities/v1/obids/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "givenName": "string",
  "surname": "string",
  "email": "user@example.com",
  "quiet": false
}

{
  "cirrusUid": "a82113d1-7072-494f-91c5-be3dbe2db08d",
  "attributeCollection": {
    "attributeCollectionAuthority": "https://athena-guest.idp.cirrusidentity.com/idp",
    "uid": "cuid-8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c",
    "attributes": {
      "urn:oid:2.5.4.4": [
        "Arcus"
      ],
      "urn:oid:0.9.2342.19200300.100.1.3": [
        "aarcus@athena-institute.net"
      ],
      "urn:oid:2.16.840.1.113730.3.1.241": [
        "Alice Arcus"
      ],
      "urn:oid:2.5.4.3": [
        "Alice Arcus"
      ],
      "urn:oid:0.9.2342.19200300.100.1.1": [
        "8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c"
      ],
      "urn:oid:2.5.4.42": [
        "Alice"
      ],
      "scope": [
        "athena-guest.idp.cirrusidentity.com"
      ],
      "urn:oid:1.3.6.1.4.1.5923.1.1.1.6": [
        "8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c@athena-guest.idp.cirrusidentity.com"
      ]
    },
    "createTime": "2025-10-31T19:12:08+00:00",
    "lastUpdateTime": "2025-10-31T19:12:08+00:00",
    "attributeCollectionAuthorityType": "obid"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "OBID Error: Account for [user@domain.edu] exists and cannot be created again."
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Create Obid

curl -X POST '/identities/v1/obids/create/{cirrusUid}' \
  -H 'Content-Type: application/json' \
  -d '{
    "givenName": "string",
    "surname": "string",
    "email": "user@example.com",
    "quiet": false
  }'

const response = await fetch('/identities/v1/obids/create/{cirrusUid}', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "givenName": "string",
      "surname": "string",
      "email": "user@example.com",
      "quiet": false
    }),
});

const data = await response.json();

import requests

payload = {
  "givenName": "string",
  "surname": "string",
  "email": "user@example.com",
  "quiet": False
}

response = requests.post('/identities/v1/obids/create/{cirrusUid}', json=payload)
data = response.json()

Request Body

{
  "givenName": "string",
  "surname": "string",
  "email": "user@example.com",
  "quiet": false
}

{
  "cirrusUid": "a82113d1-7072-494f-91c5-be3dbe2db08d",
  "attributeCollection": {
    "attributeCollectionAuthority": "https://athena-guest.idp.cirrusidentity.com/idp",
    "uid": "cuid-8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c",
    "attributes": {
      "urn:oid:2.5.4.4": [
        "Arcus"
      ],
      "urn:oid:0.9.2342.19200300.100.1.3": [
        "aarcus@athena-institute.net"
      ],
      "urn:oid:2.16.840.1.113730.3.1.241": [
        "Alice Arcus"
      ],
      "urn:oid:2.5.4.3": [
        "Alice Arcus"
      ],
      "urn:oid:0.9.2342.19200300.100.1.1": [
        "8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c"
      ],
      "urn:oid:2.5.4.42": [
        "Alice"
      ],
      "scope": [
        "athena-guest.idp.cirrusidentity.com"
      ],
      "urn:oid:1.3.6.1.4.1.5923.1.1.1.6": [
        "8a37d4f4-d09f-4ac5-bf67-9e38f987bf1c@athena-guest.idp.cirrusidentity.com"
      ]
    },
    "createTime": "2025-10-31T19:12:08+00:00",
    "lastUpdateTime": "2025-10-31T19:12:08+00:00",
    "attributeCollectionAuthorityType": "obid"
  }
}

{
  "detail": "not authorized"
}

{
  "detail": "record not found"
}

{
  "detail": "OBID Error: Account for [user@domain.edu] exists and cannot be created again."
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

{
  "detail": "database error: ..."
}

Models

AttributeCollectionAuthorityType

string

enum for deployment patterns

stringsorobidgateway

Example

"sor"

AttributeCollectionCreateOrModifyOutput

object

wrapper for returning attribute collections along with cirrusUid

cirrusUidstringrequired

cirrusUid of identity record

attributeCollectionAttributeCollectionOutputrequired

output attribute collection model

Show child attributes

attributeCollectionAuthoritystringrequired

identifier of attribute collection authority

uidstringrequired

unique identifier for attribute authority collection instance

attributesobject[object Object]

object of attribute keys and list of values

createTimestring<date-time>required

attribute collection creation timestamp

lastUpdateTimestring<date-time>required

attribute collection last update timestamp

credentialLastUsedstring | null

last time used, if attribute collection represents a credential

attributeCollectionAuthorityTypeAttributeCollectionAuthorityTypesorobidgatewayrequiredread only

type of attribute collection authority

Example

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

Example

{
  "cirrusUid": "string",
  "attributeCollection": {
    "attributeCollectionAuthority": "string",
    "uid": "string",
    "attributes": {},
    "createTime": "2024-01-15T09:30:00Z",
    "lastUpdateTime": "2024-01-15T09:30:00Z",
    "credentialLastUsed": "2024-01-15T09:30:00Z",
    "attributeCollectionAuthorityType": "sor"
  }
}

AttributeCollectionInput

object

attribute collection model

attributeCollectionAuthoritystringrequired

identifier of attribute collection authority

uidstringrequired

unique identifier for attribute authority collection instance

attributesobject[object Object]

object of attribute keys and list of values

Example

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {}
}

AttributeCollectionOutput

object

output attribute collection model

attributeCollectionAuthoritystringrequired

identifier of attribute collection authority

uidstringrequired

unique identifier for attribute authority collection instance

attributesobject[object Object]

object of attribute keys and list of values

createTimestring<date-time>required

attribute collection creation timestamp

lastUpdateTimestring<date-time>required

attribute collection last update timestamp

credentialLastUsedstring | null

last time used, if attribute collection represents a credential

attributeCollectionAuthorityTypeAttributeCollectionAuthorityTypesorobidgatewayrequiredread only

type of attribute collection authority

Example

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {},
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "credentialLastUsed": "2024-01-15T09:30:00Z",
  "attributeCollectionAuthorityType": "sor"
}

Example

{
  "attributeCollectionAuthority": "string",
  "uid": "string",
  "attributes": {},
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "credentialLastUsed": "2024-01-15T09:30:00Z",
  "attributeCollectionAuthorityType": "sor"
}

HTTPValidationError

object

detailArray<ValidationError>

Show child attributes

locArray<string | integer>required

Show child attributes

Any of

string

integer

msgstringrequired

typestringrequired

inputany

ctxobject

Example

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "ctx": {}
    }
  ]
}

IdentitiesApiUserPermissionsModel

object

model for user/permissions model (for identities API)

usernamestringrequired

orgDomainstringrequired

environmentsobject[object Object]

Map of linkgroup names to linkgroup permissions

obidArray<string>

List of OBID permissions

Example

{
  "username": "string",
  "orgDomain": "string",
  "environments": {},
  "obid": []
}

IdentityCreateInput

object

model for creating a new identity record

mailstring<email>required

email address

givenNamestringrequired

given name

snstringrequired

surname

customerUidGenstring | null

optional Cirrus-provided key for generating customer-defined UIDs

obidbooleanfalse

whether to create/link an OrgBrandedID account for mail value

quietbooleanfalse

suppress any user-facing emails that might be triggered as a result of account creation - e.g., an OrgBrandedID account setup email

allowDuplicateEmailbooleanfalse

whether to allow creation of an identity record with an email address already associated with another identity

attributeCollectionsArray<AttributeCollectionInput> | null

optional list of attribute collections to create and link to identity record

remoteCredentialsArray<RemoteCredentialInput> | null

optional list of remote credential (authority, uid) pairs to create and link to identity record

Example

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": false,
  "quiet": false,
  "allowDuplicateEmail": false,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

Example

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "customerUidGen": "string",
  "obid": false,
  "quiet": false,
  "allowDuplicateEmail": false,
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {}
    }
  ],
  "remoteCredentials": [
    {
      "remoteCredentialAuthority": "string",
      "uid": "string"
    }
  ]
}

IdentityEnvironment

string

enum for allowed linking environments

stringtestprod

Example

"test"

IdentityListSortKey

string

enum for allowed fields to sort identity list by

stringidcirrusUidsngivenNamemailcreateTimelastUpdateTime

Example

"id"

IdentityListSortOrder

string

enum for allowed orders to sort identity list by

stringascdesc

Example

"asc"

IdentityModel

object

full identity model

cirrusUidstringrequired

cirrusUid of identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

Surname

createTimestring<date-time>required

identity creation timestamp

lastUpdateTimestring<date-time>required

identity last update timestamp

attributeCollectionsArray<AttributeCollectionOutput> | null

list of AttributeCollectionOutput

Example

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

Example

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z",
  "attributeCollections": [
    {
      "attributeCollectionAuthority": "string",
      "uid": "string",
      "attributes": {},
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "credentialLastUsed": "2024-01-15T09:30:00Z",
      "attributeCollectionAuthorityType": "sor"
    }
  ]
}

IdentityModelBase

object

base identity model

cirrusUidstringrequired

cirrusUid of identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

Surname

createTimestring<date-time>required

identity creation timestamp

lastUpdateTimestring<date-time>required

identity last update timestamp

Example

{
  "cirrusUid": "string",
  "mail": "string",
  "givenName": "string",
  "sn": "string",
  "createTime": "2024-01-15T09:30:00Z",
  "lastUpdateTime": "2024-01-15T09:30:00Z"
}

IdentityModifyInput

object

model for modifying base properties on existing identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

surname

allowDuplicateEmailbooleanfalse

whether to allow creation of an identity record with an email address already associated with another identity

Example

{
  "mail": "user@example.com",
  "givenName": "string",
  "sn": "string",
  "allowDuplicateEmail": false
}

LinkGroup

object

linkgroup model

permissionsArray<string>

List of permissions for org + link group

customerUidKeysArray<string>

List of Customer UID tenantShortName:attributeCollectionAuthority pairs

attributeAuthoritiesArray<string>

List of Customer attribute authorities

Example

{
  "permissions": [],
  "customerUidKeys": [],
  "attributeAuthorities": []
}

OrgBrandedIdAccountCreateInput

object

model for creating a new OBID account

givenNamestring | null

first name

surnamestringrequired

last name

emailstring<email>required

email address

quietbooleanfalse

suppress OrgBrandedID account setup email

Example

{
  "givenName": "string",
  "surname": "string",
  "email": "user@example.com",
  "quiet": false
}

Page_IdentityModelBase_

object

itemsArray<IdentityModelBase>required

list of items on this page

Show child attributes

cirrusUidstringrequired

cirrusUid of identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

Surname

createTimestring<date-time>required

identity creation timestamp

lastUpdateTimestring<date-time>required

identity last update timestamp

total_itemsinteger>= 0required

total number of items

page_cntinteger>= 0required

total number of pages

page_sizeinteger>= 0required

number of items on this page

page_idxinteger>= 1required

current page index

Example

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z"
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

Example

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z"
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

Page_IdentityModel_

object

itemsArray<IdentityModel>required

list of items on this page

Show child attributes

cirrusUidstringrequired

cirrusUid of identity record

mailstring | null

email address

givenNamestring | null

given name

snstring | null

Surname

createTimestring<date-time>required

identity creation timestamp

lastUpdateTimestring<date-time>required

identity last update timestamp

attributeCollectionsArray<AttributeCollectionOutput> | null

list of AttributeCollectionOutput

total_itemsinteger>= 0required

total number of items

page_cntinteger>= 0required

total number of pages

page_sizeinteger>= 0required

number of items on this page

page_idxinteger>= 1required

current page index

Example

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {},
          "createTime": "2024-01-15T09:30:00Z",
          "lastUpdateTime": "2024-01-15T09:30:00Z",
          "credentialLastUsed": "2024-01-15T09:30:00Z",
          "attributeCollectionAuthorityType": "sor"
        }
      ]
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

Example

{
  "items": [
    {
      "cirrusUid": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "createTime": "2024-01-15T09:30:00Z",
      "lastUpdateTime": "2024-01-15T09:30:00Z",
      "attributeCollections": [
        {
          "attributeCollectionAuthority": "string",
          "uid": "string",
          "attributes": {},
          "createTime": "2024-01-15T09:30:00Z",
          "lastUpdateTime": "2024-01-15T09:30:00Z",
          "credentialLastUsed": "2024-01-15T09:30:00Z",
          "attributeCollectionAuthorityType": "sor"
        }
      ]
    }
  ],
  "total_items": 0,
  "page_cnt": 0,
  "page_size": 0,
  "page_idx": 1
}

RemoteCredentialInput

object

remote credential model

remoteCredentialAuthoritystringrequired

identifier of remote credential authority

uidstringrequired

unique identifier at remote credential authority

Example

{
  "remoteCredentialAuthority": "string",
  "uid": "string"
}

ValidationError

object

locArray<string | integer>required

Show child attributes

Any of

string

integer

msgstringrequired

typestringrequired

inputany

ctxobject

Example

{
  "loc": [
    "string"
  ],
  "msg": "string",
  "type": "string",
  "ctx": {}
}