oag-oneOfInheritance-noExamples.yaml

openapi: 3.0.0
info:
  title: Okta Access Gateway
  description: Okta Access Gateway
  version: 1.0.0
servers:
  - url: https://{oagHostname}
    variables:
      oagHostname:
        default: oag.domain.tld
        description: Virtual hostname of OAG cluster
tags:
  - name: AccessTokens
    x-displayName: Access Tokens
    description: The Access Tokens API allows you to create access tokens for API requests.
  - name: Application Attributes
    description: The Attributes API allows you to retrieve and manage attributes of your applications.
  - name: Application Behavior
    description: The Behaviors API allows you to retrieve and manage the behavior configurations of your applications.
  - name: Application Health Check
    description: The Health Check API allows you to retrieve and manage the health status configuration for the protected resources of an application.
  - name: Application Offline Mode
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    description: |-
      <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The Application Offline Mode API allows you to manage the offline mode configuration of your applications.

      Offline mode is a feature of Access Gateway that allows it to continue functioning with modified capabilities when the connection to the identity provider (IdP) is lost. This API allows you to manage the offline mode settings at the application level, which applies to all users and IdPs associated with the application.

      > **Note:** This API is available in a Limited Early Access program and may be updated or changed based on feedback. Be aware that the API may change.
  - name: Application Policies
    description: The Policies API allows you to retrieve and manage the policies of your applications.
  - name: Application Protected Resources
    description: The Protected Resources API allows you to retrieve and manage protected resources of your applications.
  - name: Application Session
    description: The Sessions API allows you to retrieve and manage the session configurations of your applications.
  - name: Applications
    description: The Applications API allows you to list and manage Access Gateway applications and application-related configurations.
  - name: Certificates
    description: The Certificates API allows you to list and manage SSL certificates on your Access Gateway instance.
  - name: IDPs
    x-displayName: Identity Providers
    description: The Identity Providers API allows you to list and manage identity providers (IdPs) on your Access Gateway instance.
  - name: IDPs Offline Mode
    x-displayName: Identity Providers Offline Mode
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    description: |-
      <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The Identity Providers Offline Mode API allows you to manage the offline mode configuration for the identity providers (IdPs) on your Access Gateway instance.

      Offline mode is a feature of Access Gateway that allows it to continue functioning with modified capabilities when the connection to the IdP is lost. This API allows you to manage the offline mode settings for each IdP, which determine how Access Gateway handles authentication requests when an IdP is unavailable.

      > **Note:** This API is available in a Limited Early Access program and may be updated or changed based on feedback. Be aware that the API may change.
  - name: IDPs Offline Mode Directory
    x-displayName: Identity Providers Offline Mode Directory
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    description: |-
      <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The Identity Providers Offline Mode Directory API allows you to manage the offline mode directory for the identity providers (IdPs) on your Access Gateway instance.

      The offline mode directory is a component of Access Gateway's offline mode that serves as a backup authentication source when the connection to the IdP is lost. This API allows you to manage the offline mode directory settings for each IdP, which determine how Access Gateway connects to and uses the offline mode directory during failover.

      > **Note:** This API is available in a Limited Early Access program and may be updated or changed based on feedback. Be aware that the API may change.
  - name: IDPs Offline Mode Health Policy
    x-displayName: Identity Providers Offline Mode Health Policy
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    description: |-
      <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The Identity Providers Offline Mode Health Policy API allows you to manage the offline mode health policy for the identity providers (IdPs) on your Access Gateway instance.

      The health policy is a component of Access Gateway's offline mode that determines the health status of an IdP and when to trigger failover to offline mode. This API allows you to manage the health policy settings for each IdP, which determine how Access Gateway monitors the health of the IdP and decides when to switch to offline mode.

      > **Note:** This API is available in a Limited Early Access program and may be updated or changed based on feedback. Be aware that the API may change.
  - name: Settings Authentication Service
    x-displayName: Authentication Service
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    description: |-
      <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The Authentication Service API allows you to manage the settings of the authentication service in your Access Gateway cluster. Authentication service settings at the cluster level apply to all applications and IdPs on the Access Gateway instance.

      > **Note:** This API is available in a Limited Early Access program and may be updated or changed based on feedback. Be aware that the API may change.
paths:
  /api/v2/apps:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    get:
      summary: List all applications
      description: Lists all applications that are configured in Access Gateway
      operationId: listApplication
      parameters:
        - $ref: '#/components/parameters/Expand'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  oneOf: &ref_0
                    - $ref: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                    - $ref: '#/components/schemas/SamlApplicationResponseWithEmbedded'
                  discriminator: &ref_1
                    propertyName: type
                    mapping:
                      OAG_HEADER_BASED: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_ADMINUI: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_NOAUTH: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_SAMPLE_COOKIE: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_SAMPLE_HEADER: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_SAMPLE_POLICY: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_SAMPLE_WIKIPEDIA: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_ACCESSGATE: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_AGILE_PLM: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_APPLICATION_EXPRESS: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_DEMANTRA: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_HCM_CLOUD: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_HYPERION: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_JDE: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_OBIEE: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_PEOPLESOFT: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_WEBCENTER: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      ORACLE_WEBLOGIC: '#/components/schemas/HeaderBasedApplicationResponseWithEmbedded'
                      OAG_SAML: '#/components/schemas/SamlApplicationResponseWithEmbedded'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create an application
      description: |-
        Creates a new application in Access Gateway.

        Newly created applications have the `CREATED` status.
        To make the application available for end users, you must configure the required settings of an application, and then [activate the application](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Applications/#tag/Applications/operation/activateApplication).

        Ensure that you've configured the following settings of your application:
        - [Create at least one protected resource](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Application-Protected-Resources/#tag/Application-Protected-Resources/operation/createProtectedResource).
        - [Create at least one policy](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Application-Policies/#tag/Application-Policies/operation/createPolicy).
        - [Create at least one attribute](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Application-Attributes/#tag/Application-Attributes/operation/createAttribute) (not required for `OAG_NOAUTH` applications).

        Session, behavior and health check configurations are created by default for all applications. Update these configurations as needed.

        This endpoint also creates the default attributes and policies for the application based on the application type specified. To disable creating default attributes and policies, set the `useDefaultHeadersAndPolicies` property to `false` in the request body.

        After creating an application, view the application details in the response. The `_embedded` property includes all the default configurations created for the application (session, behavior, health check, attributes, and policies).
      operationId: createApplication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                - $ref: '#/components/schemas/SamlApplicationCreateRequest'
              discriminator: &ref_2
                propertyName: type
                mapping:
                  OAG_HEADER_BASED: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_ADMINUI: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_NOAUTH: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_SAMPLE_COOKIE: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_SAMPLE_HEADER: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_SAMPLE_POLICY: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_SAMPLE_WIKIPEDIA: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_ACCESSGATE: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_AGILE_PLM: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_APPLICATION_EXPRESS: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_DEMANTRA: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_HCM_CLOUD: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_HYPERION: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_JDE: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_OBIEE: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_PEOPLESOFT: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_WEBCENTER: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  ORACLE_WEBLOGIC: '#/components/schemas/HeaderBasedApplicationCreateRequest'
                  OAG_SAML: '#/components/schemas/SamlApplicationCreateRequest'
      responses:
        '200':
          description: Application created successfully
          content:
            application/json:
              schema:
                oneOf: *ref_0
                discriminator: *ref_1
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve an application
      description: Retrieves details of a specific application by `applicationId`
      operationId: getApplication
      parameters:
        - $ref: '#/components/parameters/Expand'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                oneOf: *ref_0
                discriminator: *ref_1
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace an application
      description: |-
        Replaces an existing application configuration

        Use this endpoint to update the configuration of the specified application.
      operationId: replaceApplication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                - $ref: '#/components/schemas/SamlApplicationUpdateRequest'
              discriminator: &ref_4
                propertyName: type
                mapping:
                  OAG_HEADER_BASED: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_ADMINUI: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_NOAUTH: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_SAMPLE_COOKIE: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_SAMPLE_HEADER: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_SAMPLE_POLICY: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_SAMPLE_WIKIPEDIA: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_ACCESSGATE: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_AGILE_PLM: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_APPLICATION_EXPRESS: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_DEMANTRA: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_HCM_CLOUD: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_HYPERION: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_JDE: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_OBIEE: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_PEOPLESOFT: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_WEBCENTER: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  ORACLE_WEBLOGIC: '#/components/schemas/HeaderBasedApplicationUpdateRequest'
                  OAG_SAML: '#/components/schemas/SamlApplicationUpdateRequest'
      responses:
        '200':
          description: Application updated successfully
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/HeaderBasedApplicationRequest'
                  - $ref: '#/components/schemas/SamlApplicationRequest'
                discriminator: &ref_3
                  propertyName: type
                  mapping:
                    OAG_HEADER_BASED: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_ADMINUI: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_NOAUTH: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_SAMPLE_COOKIE: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_SAMPLE_HEADER: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_SAMPLE_POLICY: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_SAMPLE_WIKIPEDIA: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_ACCESSGATE: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_AGILE_PLM: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_APPLICATION_EXPRESS: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_DEMANTRA: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_HCM_CLOUD: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_HYPERION: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_JDE: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_OBIEE: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_PEOPLESOFT: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_WEBCENTER: '#/components/schemas/HeaderBasedApplicationRequest'
                    ORACLE_WEBLOGIC: '#/components/schemas/HeaderBasedApplicationRequest'
                    OAG_SAML: '#/components/schemas/SamlApplicationRequest'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete an application
      description: |-
        Deletes an application by `applicationId`.

        To delete an application, you must set the status of the application to `INACTIVE`. Use the [Deactivate an application](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Applications/#tag/Applications/operation/deactivateApplication) endpoint to set the application status to `INACTIVE`.
        Deleting an application removes the application and its configurations, including its resources, policies, and attributes. These objects don't need to be deleted separately.
      operationId: deleteApplication
      responses:
        '204':
          description: Application deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/activate:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      summary: Activate an application
      description: Activates a newly created application in Access Gateway. Activate an application after you create it. Access Gateway doesn't automatically activate newly created applications.
      operationId: activateApplication
      responses:
        '200':
          description: Success
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/attributes:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: List all attributes
      description: Lists all attributes for a specific application in Access Gateway
      operationId: listAttributes
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Attribute'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Attributes
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create an attribute
      description: Creates an attribute for an application in Access Gateway
      operationId: createAttribute
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttributeCreateRequest'
      responses:
        '200':
          description: Attribute created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attribute'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Attributes
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/attributes/{attributeId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/AttributeID'
    get:
      summary: Retrieve an attribute
      description: Retrieves details of a specific attribute for an application by `applicationId` and `attributeId`
      operationId: getAttribute
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attribute'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Attributes
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace an attribute
      description: Replaces an existing attribute configuration for an application
      operationId: replaceAttribute
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Attribute'
      responses:
        '200':
          description: Attribute updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Attribute'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Attributes
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete an attribute
      description: Deletes an attribute for an application by `applicationId` and `attributeId`
      operationId: deleteAttribute
      responses:
        '204':
          description: Attribute deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Attributes
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/behavior:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve the application behavior configuration
      description: Retrieves a behavior configuration for an application
      operationId: getBehavior
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Behavior'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Behavior
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace the application behavior configuration
      description: |-
        Replaces the behavior configuration for an application in Access Gateway

        Use this endpoint to define behavior settings for your application. For example, you can configure how your application handles session management and security policies.
      operationId: replaceBehavior
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Behavior'
      responses:
        '200':
          description: Behavior updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Behavior'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Behavior
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/deactivate:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      summary: Deactivate an application
      description: Deactivates an existing application in Access Gateway
      operationId: deactivateApplication
      responses:
        '200':
          description: Success
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/health-check:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve the application health check configuration
      description: Retrieves a health check configuration for an application
      operationId: getHealthCheck
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthCheck'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Health Check
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace the application health check configuration
      description: |-
        Replaces the health check configuration for an application in Access Gateway

        Use this endpoint to define health check settings to monitor application availability.
      operationId: replaceHealthCheck
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HealthCheck'
      responses:
        '200':
          description: Health check configuration updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthCheck'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Health Check
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/maintenance:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      summary: Update an application status to maintenance
      description: |-
        Updates the status of an application to maintenance mode in Access Gateway

        When an application is in maintenance mode, you can perform maintenance tasks on the application. However, the application is unavailable for end users.
      operationId: updateApplicationMaintenance
      responses:
        '200':
          description: Success
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Applications
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/offline-mode:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve the offline mode state for an application
      description: Retrieves the offline mode state for a specific application in Access Gateway, by `applicationId`
      operationId: getApplicationOfflineModeState
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOfflineModeState'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Offline Mode
    post:
      summary: Assign the offline mode state for an application
      description: |-
        Assigns the offline mode state for a specific application in Access Gateway, by `applicationId`.

        Use this endpoint to enable or disable the ability for applications to function in offline mode. When offline mode is enabled, and the Okta IdP is unreachable, the application can failover to offline mode and function with modified capabilities.
      operationId: assignApplicationOfflineModeState
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOfflineModeState'
      responses:
        '200':
          description: Application offline mode state updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOfflineModeState'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Offline Mode
  /api/v2/apps/{applicationId}/offline-mode/group-policy:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve the offline mode group policy for an application
      description: |-
        Retrieves the offline mode group policy for a specific application in Access Gateway, by `applicationId`.

        The offline mode group policy defines how users are grouped for offline mode. It determines which users are affected when offline mode is enabled for the application.
      operationId: getApplicationOfflineModeGroupPolicy
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOfflineModeGroupPolicy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Offline Mode
    put:
      summary: Assign a group to an application's offline mode policy
      description: |-
        Assigns groups to the offline mode policy for a specific application in Access Gateway, by `applicationId`. Users who are in the groups that are assigned to the offline mode application policy can sign in to the application when offline mode is enabled. Users who aren't in the assigned groups are blocked from signing in when offline mode is enabled.

        Before you assign groups to the application, ensure that the groups exist in your LDAP or AD directory. If your groups originate in Okta, sync them to your LDAP or AD server using the [Okta LDAP agent](https://help.okta.com/okta_help.htm?type=oie&id=ext_LDAP_Provisioning) or the [Okta AD agent](https://help.okta.com/okta_help.htm?type=oie&id=ext-ad-agent-install). After syncing the groups, [create the offline mode directory](https://developer.okta.com/docs/api/openapi/oag/oag/tag/IDPs-Offline-Mode-Directory/#tag/IDPs-Offline-Mode-Directory/operation/createOfflineModeDirectory). After you configure the offline mode directory, your groups are available to assign to the offline mode policy.

        > **Note:** If you're using an LDAP user directory, you don't have the `Everyone` group, by default. However, the `Assign a group to an application's offline mode policy` endpoint allows you to still pass `Everyone` in the payload to assign all users to the offline mode policy.
      operationId: assignApplicationOfflineModeGroupPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationOfflineModeGroupPolicy'
      responses:
        '200':
          description: Application Offline mode group policy updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationOfflineModeGroupPolicy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Offline Mode
  /api/v2/apps/{applicationId}/policies:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: List all policies
      description: Lists all policies for a specific application in Access Gateway
      operationId: listPolicies
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Policies
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create a policy
      description: |-
        Creates a policy for an application in Access Gateway

        Policies define access rules and conditions for the application. The application must have protected resources defined before you can create policies.
      operationId: createPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyCreateRequest'
      responses:
        '200':
          description: Policy created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Policies
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/policies/{policyId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/PolicyID'
    get:
      summary: Retrieve a policy
      description: Retrieves details of a specific policy for an application by `applicationId` and `policyId`
      operationId: getPolicy
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Policies
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace a policy
      description: Replaces an existing policy configuration for an application
      operationId: replacePolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Policy'
      responses:
        '200':
          description: policy updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Policies
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete a policy
      description: Deletes a policy for an application by `applicationId` and `policyId`
      operationId: deletePolicy
      responses:
        '204':
          description: Policy deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Policies
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/resources:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: List all protected resources
      description: Lists all protected resources for a specific application in Access Gateway
      operationId: listProtectedResources
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ProtectedResource'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Protected Resources
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create a protected resource
      description: |-
        Creates a protected resource for an application in Access Gateway

        Protected resources are resources that require authentication and authorization.
      operationId: createProtectedResource
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProtectedResourceCreateRequest'
      responses:
        '200':
          description: Protected resource created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResource'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Protected Resources
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/resources/{protectedResourceId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProtectedResourceID'
    get:
      summary: Retrieve a protected resource
      description: Retrieves details of a specific protected resource by `applicationId` and `protectedResourceId`
      operationId: getResource
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResource'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Protected Resources
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace a protected resource
      description: Replaces an existing protected resource configuration for an application
      operationId: replaceResource
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProtectedResource'
      responses:
        '200':
          description: Protected resource updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProtectedResource'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Protected Resources
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete a protected resource
      description: Deletes a protected resource for an application by `applicationId` and `protectedResourceId`
      operationId: deleteProtectedResource
      responses:
        '204':
          description: Protected resource deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Protected Resources
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/apps/{applicationId}/session:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      summary: Retrieve the application session configuration
      description: Retrieves a session configuration for an application
      operationId: getSession
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Session'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.read
      tags:
        - Application Session
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace the application session configuration
      description: |-
        Replaces the session configuration for an application in Access Gateway

        Use this endpoint to define session management settings.
      operationId: replaceSession
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Session'
      responses:
        '200':
          description: Session updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Session'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.app.manage
      tags:
        - Application Session
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/certificates:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    get:
      summary: List all certificates
      description: |-
        Lists all certificates configured in Access Gateway.
        This request returns a list of certificates with their details.
      operationId: listCertificates
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Certificate'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.cert.read
      tags:
        - Certificates
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/certificates/{certificateId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/CertificateID'
    get:
      summary: Retrieve a certificate
      description: Retrieves a certificate by `certificateId`
      operationId: getCertificate
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Certificate'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.cert.read
      tags:
        - Certificates
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/idps:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    get:
      summary: List all IdPs
      description: Lists all identity providers (IdPs) that are configured in Access Gateway
      operationId: listIDPs
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/IdP'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create an IdP
      description: |
        Creates an identity provider (IdP) in Access Gateway
      operationId: createIDP
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/OktaIdPRequest'
                - $ref: '#/components/schemas/Auth0IdPRequest'
              discriminator: &ref_5
                propertyName: type
                mapping:
                  IDP_OKTA: '#/components/schemas/OktaIdPRequest'
                  IDP_AUTH0: '#/components/schemas/Auth0IdPRequest'
      responses:
        '200':
          description: IdP created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdP'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/idps/{idpId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    parameters:
      - $ref: '#/components/parameters/IdPID'
    get:
      summary: Retrieve an IdP
      description: |
        Retrieves an identity provider (IdP) integration by `idpId`

        This request returns the IdP configuration and its properties.
      operationId: getIDP
      parameters:
        - $ref: '#/components/parameters/IdPID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdP'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    put:
      summary: Replace an IdP
      description: |-
        Replaces an existing identity provider (IdP) configuration

        Use this endpoint to update the configuration of the specified IdP.
      operationId: replaceIDP
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/OktaIdPRequest'
                - $ref: '#/components/schemas/Auth0IdPRequest'
              discriminator: &ref_6
                propertyName: type
                mapping:
                  IDP_OKTA: '#/components/schemas/OktaIdPRequest'
                  IDP_AUTH0: '#/components/schemas/Auth0IdPRequest'
      responses:
        '200':
          description: IdP updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdP'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    delete:
      summary: Delete an IdP
      description: |
        Deletes an identity provider (IdP) by `idpId`

        Deleting the IdP configuration removes it from Access Gateway. To successfully delete an IDP, ensure that it doesn't have any applications associated with it. Use the [Replace an application endpoint](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Applications/#tag/Applications/operation/replaceApplication) to remove the application's IdP configuration before deleting the IdP.
      operationId: deleteIDP
      responses:
        '204':
          description: IdP deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/idps/{idpId}/offline-mode:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/IdPID'
    get:
      summary: Retrieve the failover mode for an IdP
      description: |-
        Retrieves the failover mode for the specified identity provider (IdP) by `idpId`.

        The failover mode determines how Access Gateway handles authentication requests when the selected IdP is unavailable.
      operationId: getIdPOfflineModeFailoverMode
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeFailoverMode'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs Offline Mode
    post:
      summary: Assign the failover mode for an IdP
      description: |-
        Assigns the failover mode for the specified identity provider (IdP) by `idpId`.

        The failover mode determines how Access Gateway handles authentication requests when the selected IdP is unavailable.
      operationId: assignIdPOfflineModeFailoverMode
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdPOfflineModeFailoverMode'
      responses:
        '200':
          description: Failover mode updated successfully for the IdP
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeFailoverMode'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode
  /api/v2/idps/{idpId}/offline-mode/directories:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/IdPID'
    get:
      summary: List all offline mode directories
      description: Lists all offline mode directories for the specified identity provider (IdP) by `idpId`
      operationId: listOfflineModeDirectories
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/IdPOfflineModeDirectory'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs Offline Mode Directory
    post:
      summary: Create an offline mode directory
      description: |-
        Creates an offline mode directory for the specified identity provider (IdP) by `idpId`.

        When you create an offline mode directory, your LDAP configuration is saved in Access Gateway, and Access Gateway can connect to your LDAP to sync the groups and users into the offline mode directory. During an IdP failover, Access Gateway uses the offline mode directory as the authentication source to authenticate users and allow them to access their applications based on the group mappings in the directory.
      operationId: createOfflineModeDirectory
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdPOfflineModeDirectory'
      responses:
        '200':
          description: Offline mode directory created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeDirectory'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode Directory
  /api/v2/idps/{idpId}/offline-mode/directories/{directoryId}:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/IdPID'
      - $ref: '#/components/parameters/DirectoryID'
    get:
      summary: Retrieve an offline mode directory
      description: Retrieves an offline mode directory for the specified identity provider (IdP) by `idpId` and `directoryId`
      operationId: getOfflineModeDirectory
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeDirectory'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs Offline Mode Directory
    put:
      summary: Replace an offline mode directory
      description: Replaces an existing offline mode directory for the specified identity provider (IdP) by `idpId` and `directoryId`
      operationId: replaceOfflineModeDirectory
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdPOfflineModeDirectory'
      responses:
        '200':
          description: Offline mode directory updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeDirectory'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode Directory
    delete:
      summary: Delete an offline mode directory
      description: Deletes an offline mode directory for the specified identity provider (IdP) by `idpId` and `directoryId`
      operationId: deleteOfflineModeDirectory
      responses:
        '204':
          description: Offline mode directory deleted successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode Directory
  /api/v2/idps/{idpId}/offline-mode/health-policy:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/IdPID'
    get:
      summary: Retrieve an offline mode health policy
      description: Retrieves the offline mode health policy for the specified identity provider (IdP) by `idpId`
      operationId: getOfflineModeHealthPolicy
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeHealthPolicy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.read
      tags:
        - IDPs Offline Mode Health Policy
    put:
      summary: Replace an offline mode health policy
      description: Replaces the offline mode health policy for the specified identity provider (IdP) by `idpId`
      operationId: replaceOfflineModeHealthPolicy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdPOfflineModeHealthPolicy'
      responses:
        '200':
          description: Offline mode health policy updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdPOfflineModeHealthPolicy'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode Health Policy
  /api/v2/idps/{idpId}/offline-mode/test-directory-connection:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/IdPID'
    post:
      summary: Test a directory connection
      description: |-
        Tests the connection to the offline mode directory for the specified identity provider (IdP) by `idpId`.

        This endpoint connects to the node that is running the authentication service to perform the test and then a successful test returns an HTTP 204 No Content response. Use this endpoint to verify if the offline mode directory is properly configured and can be connected successfully.
      operationId: testDirectoryConnection
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IdPOfflineModeDirectoryTestRequest'
      responses:
        '204':
          description: Connection test successful
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
        '502':
          $ref: '#/components/responses/ErrorBadGateway'
        '503':
          $ref: '#/components/responses/ErrorServiceUnavailable'
      security:
        - jwtBearerAuth:
            - okta.oag.idp.manage
      tags:
        - IDPs Offline Mode Directory
  /api/v2/oauth/token:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
    post:
      summary: Create an access token
      description: |
        Creates an access token for your Access Gateway. Use the access token to authenticate API requests. Authentication is performed using a signed JWT assertion in the `client_assertion` parameter of the request body, not through HTTP headers.

        This endpoint only supports the OAuth 2.0 client credentials grant type. It returns access tokens based on the request parameters. You're not able to use any other OAuth 2.0 grant types, such as `password` or `refresh_token`, with this endpoint.
      operationId: createAccessToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AuthRequest'
            examples:
              AuthRequest:
                $ref: '#/components/examples/AuthRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
      security: []
      tags:
        - AccessTokens
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: true
  /api/v2/settings/authentication-service:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    get:
      summary: Retrieve the authentication service setting
      description: Retrieves the current authentication service setting for Access Gateway
      operationId: getAuthenticationServiceSetting
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationServiceSetting'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
      security:
        - jwtBearerAuth:
            - okta.oag.authenticationService.read
      tags:
        - Settings Authentication Service
    post:
      summary: Enable the authentication service setting
      description: Enables the authentication service setting for Access Gateway
      operationId: enableAuthenticationServiceSetting
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationServiceSetting'
      responses:
        '200':
          description: Authentication service setting enabled successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationServiceSetting'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
      security:
        - jwtBearerAuth:
            - okta.oag.authenticationService.manage
      tags:
        - Settings Authentication Service
    delete:
      summary: Disable the authentication service setting
      description: Disables the authentication service setting for Access Gateway
      operationId: disableAuthenticationServiceSetting
      responses:
        '204':
          description: Authentication service setting disabled successfully
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
      security:
        - jwtBearerAuth:
            - okta.oag.authenticationService.manage
      tags:
        - Settings Authentication Service
  /api/v2/settings/authentication-service/health-check:
    x-okta-team-detail:
      x-team-slack: amp-eng-resource-management-platform
    x-okta-lifecycle:
      lifecycle: EA
      isGenerallyAvailable: false
      SKUs: []
    get:
      summary: Retrieve the authentication service health check
      description: Retrieves the current health check status of the authentication service for Access Gateway
      operationId: getAuthenticationServiceHealthCheck
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationServiceHealthCheck'
        '400':
          $ref: '#/components/responses/ErrorBadRequest'
        '401':
          $ref: '#/components/responses/ErrorUnauthorized'
        '403':
          $ref: '#/components/responses/ErrorForbidden'
        '404':
          $ref: '#/components/responses/ErrorResourceNotFound'
        '429':
          $ref: '#/components/responses/ErrorTooManyRequests'
        '500':
          $ref: '#/components/responses/ErrorInternalServerError'
      security:
        - jwtBearerAuth:
            - okta.oag.authenticationService.read
      tags:
        - Settings Authentication Service
components:
  parameters:
    ApplicationID:
      name: applicationId
      in: path
      required: true
      description: Identifier of the application
      schema:
        type: string
        format: uuid
    AttributeID:
      in: path
      name: attributeId
      required: true
      description: Identifier of the attribute
      schema:
        type: string
        format: uuid
    CertificateID:
      in: path
      name: certificateId
      required: true
      description: Identifier of the certificate
      schema:
        type: string
        format: uuid
    DirectoryID:
      in: path
      name: directoryId
      required: true
      description: Identifier of the directory
      schema:
        type: string
        format: uuid
    Expand:
      in: query
      name: expand
      description: Use the `expand` query parameter to return additional items in the `_embedded` object
      required: false
      schema:
        type: array
        items:
          type: string
          enum:
            - healthCheck
            - behavior
            - session
            - resources
            - policies
            - attributes
            - ebsAgent
            - ebsClassic
    IdPID:
      in: path
      name: idpId
      required: true
      description: Identifier of the IdP
      schema:
        type: string
        format: uuid
    PolicyID:
      in: path
      name: policyId
      required: true
      description: Identifier of the policy
      schema:
        type: string
        format: uuid
    ProtectedResourceID:
      in: path
      name: protectedResourceId
      required: true
      description: Identifier of the protected resource
      schema:
        type: string
        format: uuid
  responses:
    ErrorBadRequest:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BadRequest'
    ErrorUnauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Unauthorized'
    ErrorForbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Forbidden'
    ErrorResourceNotFound:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ResourceNotFound'
    ErrorTooManyRequests:
      description: Too Many Requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TooManyRequests'
    ErrorInternalServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/InternalServerError'
    ErrorBadGateway:
      description: Bad Gateway
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BadGateway'
    ErrorServiceUnavailable:
      description: Service Unavailable
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ServiceUnavailable'
  schemas:
    ApplicationCreateRequest:
      type: object
      discriminator: *ref_2
    ApplicationCreateResponse:
      type: object
      discriminator: *ref_1
    ApplicationOfflineModeGroupPolicy:
      type: object
      properties:
        groups:
          type: array
          description: Array of group objects
          items:
            type: object
            properties:
              name:
                type: string
                description: The name of the group
      required:
        - groups
    ApplicationOfflineModeState:
      type: object
      properties:
        state:
          type: string
          description: Indicates the offline mode state of the application
          enum:
            - ACTIVE
            - INACTIVE
            - TEST
          x-enumDescriptions:
            ACTIVE: Active offline mode means that Access Gateway uses the offline mode configuration to handle authentication and authorization when the IdP is unreachable.
            INACTIVE: Inactive offline mode means that Access Gateway doesn't use the offline mode configuration to handle authentication and authorization when the IdP is unreachable. Access Gateway uses the online mode configuration instead.
            TEST: Test offline mode means that Access Gateway simulates offline mode for an application while the IdP is still reachable. This allows you to test the offline mode configuration before activating it.
      required:
        - state
    ApplicationRequest:
      type: object
      properties:
        description:
          type: string
          description: Application description
        groups:
          type: array
          items:
            type: string
          description: Array of group IDs from your Okta org that are granted access to the application
        id:
          type: string
          format: uuid
          description: Unique identifier of the application
          readOnly: true
        idpId:
          type: string
          format: uuid
          description: IdP identifier
        label:
          type: string
          description: The name of the application, and also the tile name in your Okta tenant. The label must be unique.
        name:
          type: string
          description: Application name
          readOnly: true
        postLoginUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$
          description: The default URL that end users are directed to after they sign in
        status:
          type: string
          description: Application status
          enum:
            - CREATED
            - ACTIVE
            - INACTIVE
            - MAINTENANCE
          readOnly: true
        type:
          $ref: '#/components/schemas/ApplicationType'
      discriminator:
        propertyName: type
        mapping:
          OAG_HEADER_BASED: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_ADMINUI: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_NOAUTH: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_SAMPLE_COOKIE: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_SAMPLE_HEADER: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_SAMPLE_POLICY: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_SAMPLE_WIKIPEDIA: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_ACCESSGATE: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_AGILE_PLM: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_APPLICATION_EXPRESS: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_DEMANTRA: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_HCM_CLOUD: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_HYPERION: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_JDE: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_OBIEE: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_PEOPLESOFT: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_WEBCENTER: '#/components/schemas/HeaderBasedApplicationRequest'
          ORACLE_WEBLOGIC: '#/components/schemas/HeaderBasedApplicationRequest'
          OAG_SAML: '#/components/schemas/SamlApplicationRequest'
    ApplicationResponse:
      type: object
      discriminator: *ref_3
    ApplicationType:
      description: Application type
      type: string
      enum:
        - OAG_ADMINUI
        - OAG_HEADER_BASED
        - OAG_NOAUTH
        - OAG_SAMPLE_COOKIE
        - OAG_SAMPLE_HEADER
        - OAG_SAMPLE_POLICY
        - OAG_SAMPLE_WIKIPEDIA
        - ORACLE_ACCESSGATE
        - ORACLE_AGILE_PLM
        - ORACLE_APPLICATION_EXPRESS
        - ORACLE_DEMANTRA
        - ORACLE_HCM_CLOUD
        - ORACLE_HYPERION
        - ORACLE_JDE
        - ORACLE_OBIEE
        - ORACLE_PEOPLESOFT
        - ORACLE_WEBCENTER
        - ORACLE_WEBLOGIC
        - OAG_SAML
      x-enumDescriptions:
        OAG_HEADER_BASED: Applications that use header-based authentication. Access Gateway passes user attributes in HTTP headers to the application, which uses these attributes to identify the user and manage sessions.
        OAG_ADMINUI: The Access Gateway Admin UI, which is the interface that admins use to manage Access Gateway.
        OAG_NOAUTH: Applications that don't require authentication. Use this type to manage access to public resources or to test Access Gateway functionality without authentication.
        OAG_SAMPLE_COOKIE: A sample application that demonstrates cookie-based authentication.
        OAG_SAMPLE_HEADER: A sample application that demonstrates header-based authentication.
        OAG_SAMPLE_POLICY: A sample application that demonstrates policy enforcement.
        OAG_SAMPLE_WIKIPEDIA: A sample application preconfigured to provide access to Wikipedia with header-based authentication.
        ORACLE_ACCESSGATE: Oracle Access Gateway applications.
        ORACLE_AGILE_PLM: Oracle Agile Product Lifecycle Management (PLM) applications.
        ORACLE_APPLICATION_EXPRESS: Oracle Application Express (APEX) applications.
        ORACLE_DEMANTRA: Oracle Demantra applications.
        ORACLE_HCM_CLOUD: Oracle Human Capital Management (HCM) Cloud applications.
        ORACLE_HYPERION: Oracle Hyperion applications.
        ORACLE_JDE: Oracle JD Edwards EnterpriseOne (JDE) applications.
        ORACLE_OBIEE: Oracle Business Intelligence Enterprise Edition (OBIEE) applications.
        ORACLE_PEOPLESOFT: Oracle PeopleSoft applications.
        ORACLE_WEBCENTER: Oracle WebCenter applications.
        ORACLE_WEBLOGIC: Oracle WebLogic Server applications.
        OAG_SAML: <x-lifecycle class="ea"></x-lifecycle>SAML applications that use Security Assertion Markup Language (SAML) 2.0 for single sign-on (SSO) authentication.
    ApplicationUpdateRequest:
      type: object
      properties:
        description:
          type: string
          description: Application description
        groups:
          type: array
          items:
            type: string
          description: Array of group IDs from your Okta org that are granted access to the application
        label:
          type: string
          description: The name of the application, and also the tile name in your Okta tenant. The label must be unique.
        postLoginUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$
          description: The default URL that end users are directed to after they sign in
        type:
          $ref: '#/components/schemas/ApplicationType'
      discriminator: *ref_4
    Attribute:
      type: object
      properties:
        active:
          type: boolean
          default: true
          description: Indicates whether to send the attribute to a protected resource. If set to `true`, the attribute is sent.
        delimiter:
          type: string
          default: ':'
          description: The delimiter to use when `multiValueProcessor` is set to `SELECT_ALL`. This delimiter is used to concatenate multiple values into a single string.
        id:
          type: string
          format: uuid
          description: Unique identifier of the attribute
          readOnly: true
        index:
          type: integer
          default: 0
          minimum: 0
          maximum: 99
          description: |-
            The index of the `value` that's used when `multiValueProcessor` is set to `SELECT_INDEX`

            The index is zero-based, so the first value has an index of `0`, the second value has an index of `1`, and so on.
        multiValueProcessor:
          type: string
          description: |-
            Use this property to process attributes with multiple values that are returned from the source

            If the `value` that's received from the source contains multiple values separated by `,` (commas), you can use this property to specify which value to send to the protected resource.
          enum:
            - SELECT_INDEX
            - SELECT_ALL
            - RECORD_COUNT
          default: SELECT_INDEX
          x-enumDescriptions:
            SELECT_INDEX: This option allows you to select a specific value from a multi-valued attribute based on its index. The index must be specified in the `index` property.
            SELECT_ALL: This option concatenates all values of a multi-valued attribute into a single string, separated by a specified delimiter. The delimiter must be defined in the `delimiter` property.
            RECORD_COUNT: This option returns the count of values in a multi-valued attribute. It provides the total number of records present in the attribute.
        name:
          type: string
          description: The name of the attribute
          maxLength: 128
        source:
          type: string
          description: The data source for the contents of the attribute
          enum:
            - IDP
            - STATIC
            - SECRET
            - APP_CONTEXT
            - AUTH_CONTEXT
            - OID
          x-enumDescriptions:
            IDP: Selecting this data source means that the `value` that's based on this attribute is sourced from the IdP, your Okta tenant
            STATIC: Selecting this data source means that the value of the attribute is fixed and defined by the `value` property
            SECRET: Selecting this data source means that the `value` of the attribute is a static protected value. It's used as a secret key by the application to trust the headers, which originate from Access Gateway.
            APP_CONTEXT: Selecting this data source means that the `value` of the attribute is based on the application context. This means that the value is dynamically generated based on the application settings.
            AUTH_CONTEXT: Selecting this data source means that the `value` of the attribute comes from the authentication context, which includes the remote address and session ID
            OID: Selecting this data source means that the `value` of the attribute comes from the object identifier (OID) data source. The OID data source is available in the Oracle E-Business Suite and other application types that provide LDAP support. You can use it to retrieve the Oracle GUID.
        type:
          type: string
          enum:
            - HEADER
            - COOKIE
          description: The method that's used to pass attributes. You can pass attributes in a header or in a cookie.
        value:
          type: string
          description: The dynamic value of the attribute that's based on the `source`
    AttributeCreateRequest:
      allOf:
        - $ref: '#/components/schemas/Attribute'
        - type: object
          required:
            - name
            - source
            - value
            - type
    Auth0IdPRequest:
      allOf:
        - $ref: '#/components/schemas/IDPRequest'
        - type: object
          properties:
            clientId:
              type: string
              description: The client ID for the Auth0 IdP
            clientSecret:
              type: string
              description: The client secret for the Auth0 IdP
            domain:
              type: string
              description: Domain configured for Auth0 tenant. The domain must be unique per IdP. Creating another IDP with the same domain returns an error.
            tenant:
              type: string
              description: IdP tenant name
            type:
              type: string
              enum:
                - IDP_AUTH0
          required:
            - type
            - domain
            - tenant
            - clientId
            - clientSecret
      type: object
    AuthRequest:
      type: object
      properties:
        client_assertion:
          type: string
          description: Signed JWT token
          example: <jwt_token>
        client_assertion_type:
          type: string
          description: Specifies the format and type of the client assertion being sent for authentication
          enum:
            - urn:ietf:params:oauth:client-assertion-type:jwt-bearer
        grant_type:
          type: string
          description: Determines the mechanism Okta uses to authorize the creation of the tokens
          enum:
            - client_credentials
        scope:
          type: string
          description: Space-separated list of scopes
          example: okta.oag.idp.read okta.oag.app.read
          enum:
            - okta.oag.idp.read
            - okta.oag.idp.manage
            - okta.oag.app.read
            - okta.oag.app.manage
            - okta.oag.cert.read
            - okta.oag.authenticationService.manage
            - okta.oag.authenticationService.read
    AuthResponse:
      type: object
      properties:
        access_token:
          type: string
          description: An access token
        expires_in:
          type: integer
          description: The number of seconds until the access token expires
        scope:
          type: string
          description: Space-separated list of scopes
          enum:
            - okta.oag.idp.read
            - okta.oag.idp.manage
            - okta.oag.app.read
            - okta.oag.app.manage
            - okta.oag.cert.read
            - okta.oag.authenticationService.manage
            - okta.oag.authenticationService.read
        token_type:
          type: string
          description: |-
            The token type

            The value is generally `Bearer` except for a few instances of token exchange.
    AuthenticationServiceHealthCheck:
      type: object
      properties:
        details:
          type: string
          description: Additional details about the health status of the authentication service
        lastChecked:
          type: string
          format: date-time
          description: Timestamp of the last health check performed on the authentication service
        status:
          type: string
          description: Health status of the authentication service
          enum:
            - HEALTHY
            - DEGRADED
            - UNHEALTHY
            - INITIALIZING
            - UNKNOWN
          x-enumDescriptions:
            HEALTHY: The authentication service is operating normally.
            DEGRADED: The authentication service is experiencing issues that may impact performance or functionality, but it's still operational.
            UNHEALTHY: The authentication service is unhealthy and may be non-operational or have significant performance issues.
            INITIALIZING: The authentication service is in the process of starting up and isn't fully operational yet. Health checks are still being performed, but the status is unknown until the initialization process is complete.
            UNKNOWN: The health status of the authentication service can't be determined at this time. This can be due to a failure in performing health checks or insufficient data to assess the status.
    AuthenticationServiceSetting:
      type: object
      properties:
        certificateId:
          type: string
          format: uuid
          description: The ID of the certificate to use for the authentication service
        database:
          type: object
          description: The database configuration for the authentication service
          properties:
            type:
              type: string
              description: The type of database used for the authentication service
              enum:
                - mysql
            host:
              type: string
              description: The hostname of the database server
            port:
              type: integer
              description: The port number for the database server
            name:
              type: string
              description: The name of the database
            username:
              type: string
              description: The username for database authentication
              writeOnly: true
            password:
              type: string
              description: The password for database authentication
              writeOnly: true
        publicDomain:
          type: string
          description: The external domain of the authentication service where end users are authenticated. The domain must be registered with a domain registrar.
        serverNodes:
          type: array
          items:
            type: string
          description: A list of hostnames of nodes in the Access Gateway cluster where the authentication service runs
    BadGateway:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: BAD_GATEWAY
            message:
              type: string
              example: Received an invalid response from the upstream server
    BadRequest:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              description: Validation error code
              example: BAD_REQUEST
            message:
              type: string
              example: Request validation failed
    Behavior:
      description: Application behavior configuration
      type: object
      properties:
        customLoginUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: This URL is used to redirect users to a custom login page. The URL must be valid and fully qualified.
        error:
          type: string
          enum:
            - OAG_ERROR_PATH
            - APP_ERROR_PATH
            - NO_APP_ERROR_PATH
            - CUSTOM_URL
          description: Allows you to define error endpoints to call when errors occur.
          x-enumDescriptions:
            OAG_ERROR_PATH: This option lets you define an error path for an app. By default, it shows the generic Access Gateway error page
            APP_ERROR_PATH: This option displays an app-hosted error page. Set the app-hosted error page with the `errorPath` property. The `errorPath` must be a valid path in your app.
            NO_APP_ERROR_PATH: Access Gateway doesn't perform any error behavior
            CUSTOM_URL: This option redirects the user to a custom URL for error handling. Set the custom URL with the `postErrorUrl` property.
        errorManaged:
          type: boolean
          description: Indicates whether you manage error behavior in your IdP
        errorPath:
          type: string
          description: This is the path to the error endpoint URL. It can be a relative path within the application domain.
        globalTokenRevocation:
          type: boolean
          description: Indicates whether an IdP can send a logout signal in case of a security event
        inactive:
          type: string
          enum:
            - OAG_DEFAULT_PAGE
            - CUSTOM_URL
          description: Allows you to define the end-user experience when an application is inactive
          x-enumDescriptions:
            OAG_DEFAULT_PAGE: This option displays default Access Gateway "App offline" page
            CUSTOM_URL: This option redirects the user to a custom URL for inactivity. Set the custom URL with the `inactiveUrl` property.
        inactiveUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: If you use `CUSTOM_URL` as the `inactive` method, then `inactiveUrl` is the URL where end users are directed when an app is inactive.
        login:
          type: string
          enum:
            - OAG_LOGIN_PATH
            - APP_LOGIN_PATH
            - NO_APP_LOGIN_PATH
            - CUSTOM_URL
          description: Allows you to define login endpoints when users sign in and create user sessions
          x-enumDescriptions:
            OAG_LOGIN_PATH: This option shows the Access Gateway local authentication module (Auth Module) sign-in page. Use a valid relative path in the protected app. The **Auth module** must refer to a previously defined Auth Module.
            APP_LOGIN_PATH: This option uses the associated unprotected path to an app-hosted sign-in page. Use a valid relative path in the protected app.
            NO_APP_LOGIN_PATH: This option doesn't use a login path
            CUSTOM_URL: This option redirects the user to a custom URL after they sign in. Set the custom URL with the `loginPath` property.
        loginManaged:
          type: boolean
          description: Indicates whether you manage sign-in behavior in your IdP
        loginPath:
          type: string
          description: |-
            The path to the login endpoint URL. It can be relative or fully qualified, depending on which `login` method you use. It's executed after the user successfully signs in.

            > **Note:** The URL must be unique across the login, logout, and error behaviors. Access Gateway doesn't support using the same URL for multiple behaviors. The URL can't overlap with an existing defined policy.
        logout:
          type: string
          enum:
            - OAG_LOGOUT_PATH
            - OAG_LOGOUT_PATH2
            - APP_LOGOUT_PATH
            - NO_APP_LOGOUT_PATH
            - CUSTOM_URL
          description: Allows you to define logout endpoints that help terminate user sessions
          x-enumDescriptions:
            OAG_LOGOUT_PATH: This option signs the user out of Access Gateway and the application. Set the logout path with the `logoutPath` property.
            OAG_LOGOUT_PATH2: This option signs the user out of Access Gateway and the application, with a different path
            APP_LOGOUT_PATH: This option signs the user out of the application only
            NO_APP_LOGOUT_PATH: This option does not sign the user out of the application
            CUSTOM_URL: This option redirects the user to a custom URL for logout. Set the custom URL with the `postLogoutUrl` property
        logoutPath:
          type: string
          description: |-
            The path to the relative endpoint URL. Redirect users to this path when they sign out.

            > **Note:** The URL must be unique across the login, logout, and error behaviors. Access Gateway doesn't support using the same URL for multiple behaviors. The URL can't overlap with an existing defined policy.
        maintenance:
          type: string
          enum:
            - OAG_DEFAULT_PAGE
            - CUSTOM_URL
          description: Allows you to define the end-user experience when an application is in maintenance mode
          x-enumDescriptions:
            OAG_DEFAULT_PAGE: This option displays the default Access Gateway "App maintenance" page
            CUSTOM_URL: This option redirects the user to a custom URL for maintenance. Set the custom URL with the `maintenanceUrl` property.
        maintenanceUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: If you use `CUSTOM_URL` as the `maintenance` method, then `maintenanceUrl` is the URL where end users are directed when an app is in maintenance mode.
        noSession:
          type: string
          enum:
            - OAG_DEFAULT_PAGE
            - IDP_REDIRECT
            - IDP_FORCE_AUTHN
            - CUSTOM_URL
          description: Allows you to define the end-user experience when Access Gateway has no session or the current session expires for an application
          x-enumDescriptions:
            OAG_DEFAULT_PAGE: When no there's no session or an expired session, this option displays the Access Gateway "No session" page
            IDP_REDIRECT: This option redirects the end user to Okta to reauthenticate. If their Okta session is still active, the end user is silently redirected back to the app with a refreshed app session.
            IDP_FORCE_AUTHN: This option redirects the end user to Okta to reauthenticate, even if their Okta session is active
            CUSTOM_URL: This option redirects the end user to a custom URL. Set the custom URL with the `noSessionUrl` property
        noSessionUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: The URL where an end user is redirected when no session or a session expiry is detected
        policyDenied:
          type: string
          enum:
            - OAG_DEFAULT_PAGE
            - STATUS_CODE_403
            - CUSTOM_URL
          description: Allows you to define the end-user experience when Access Gateway denies access to a resource if the user doesn't meet the requirements of a policy
          x-enumDescriptions:
            OAG_DEFAULT_PAGE: When a policy denial is detected, this option displays the default Access Gateway policy failure page
            STATUS_CODE_403: This option returns a blank page with the HTTP 403 Forbidden error
            CUSTOM_URL: This option redirects the end user to a custom URL when the user doesn't fulfill the requirements of a policy. Set the custom URL with the `policyDeniedUrl` property.
        policyDeniedUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: The URL where an end user is redirected when a policy denial is detected
        postErrorUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: If you use `CUSTOM_URL` as the `error` method, then `postErrorUrl` is the URL where end users are directed after an error occurs. The URL must be valid and fully qualified.
        postLogoutUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: If you use `CUSTOM_URL` as the `logout` method, then `postLogoutUrl` is the URL where end users are directed after they sign out
        sessionIntegrityFailure:
          type: string
          enum:
            - OAG_DEFAULT_PAGE
            - IGNORE
            - IDP_FORCE_AUTHN
            - IDP_REDIRECT
            - STATUS_CODE_405
            - CUSTOM_URL
          description: |-
            Allows you to define the end-user experience when Access Gateway detects a session integrity failure.

            For example, a session integrity failure can occur when end users change networks while maintaining an active app session.
          x-enumDescriptions:
            OAG_DEFAULT_PAGE: When a session integrity failure is detected, this option displays the default Access Gateway security warning page
            IGNORE: This option means that session integrity isn't enforced
            IDP_FORCE_AUTHN: This option forces the end user to Okta so that they reauthenticate. After they sign in again, they're returned to the application.
            IDP_REDIRECT: This option redirects the end user to Okta so that they reauthenticate. If their Okta session is still active, the end user is silently redirected back to the app with a refreshed app session.
            STATUS_CODE_405: This option returns a blank page with the HTTP 405 Method Not Allowed error
            CUSTOM_URL: This option redirects the end user to a custom URL when a session integrity failure is detected. Set the custom URL with the `sessionIntegrityFailureUrl` property.
        sessionIntegrityFailureUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: The URL where an end user is redirected when a session integrity failure is detected
        singleLogout:
          type: boolean
          description: |-
            Indicates whether both the Access Gateway application session and IdP session are terminated when a user signs out. When `singleLogout` is `true`, both sessions are terminated.

            When it's `false`, only the Access Gateway application session is terminated.
        universalLogout:
          type: boolean
          description: |-
            Indicates whether the user's Access Gateway and application sessions are terminated when they sign out. When it's `true`, users must sign in again to use Access Gateway or their applications.

            When it's `false`, only the Access Gateway application session is terminated.

            > **Note:** Universal logout doesn't sign the user out of Okta.
    BehaviorSAML:
      description: Application behavior configuration
      type: object
      properties:
        globalTokenRevocation:
          type: boolean
          description: Indicates whether an IdP can send a logout signal in case of a security event
        globalTokenRevocationEndpoint:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(/.*)?$
          description: The URL where Access Gateway listens for logout signals from the IdP in case of a security event. This property is required when `globalTokenRevocation` is set to `true`.
        singleLogout:
          type: boolean
          description: |-
            Indicates whether both the Access Gateway application session and IdP session are terminated when a user signs out. When `singleLogout` is `true`, both sessions are terminated.

            When it's `false`, only the Access Gateway application session is terminated.
        universalLogout:
          type: boolean
          description: |-
            Indicates whether the user's Access Gateway and application sessions are terminated when they sign out. When it's `true`, users must sign in again to use Access Gateway or their applications.

            When it's `false`, only the Access Gateway application session is terminated.

            > **Note:** Universal logout doesn't sign the user out of Okta.
    Certificate:
      type: object
      properties:
        certificate:
          type: string
          description: Base64-encoded certificate with DER encoding
          writeOnly: true
        commonName:
          type: string
          description: The name of the certificate, typically the domain name
          readOnly: true
        expiresOn:
          type: string
          format: date
          description: The date when the certificate expires
          readOnly: true
        id:
          type: string
          format: uuid
          description: Unique identifier of the certificate
          readOnly: true
        key:
          type: string
          description: Base64-encoded private key of the SSL certificate
          writeOnly: true
        san:
          type: array
          items:
            type: string
          description: List of subject alternative names (SANs) for the certificate
          readOnly: true
        selfSigned:
          type: boolean
          description: Whether or not the certificate and key pair are self-signed. Set to `true` to generate a self-signed certificate.
        validFrom:
          type: string
          format: date
          description: The date when the certificate becomes valid
          readOnly: true
        validityRemaining:
          type: integer
          description: The number of days until expiration
          readOnly: true
    Error:
      type: object
      properties:
        details:
          type: object
          description: Additional details about the error
          additionalProperties: true
        errorCode:
          type: string
          description: An Okta code for this type of error
        message:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
    Forbidden:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: FORBIDDEN
            message:
              type: string
              example: Insufficient permission
    HeaderBasedApplicationCreateRequest:
      allOf:
        - $ref: '#/components/schemas/HeaderBasedApplicationRequest'
      type: object
      properties:
        useDefaultHeadersAndPolicies:
          type: boolean
          default: true
          writeOnly: true
          description: |-
            Create default attributes and policies in the application based on the application template for the provided application type.
            If this property is set to `false`, you must create attributes and policies manually after the application is created.
            This property is not applicable for SAML applications.
      required:
        - type
        - label
        - publicDomain
        - idpId
        - certificateId
        - postLoginUrl
        - loadBalanced
    HeaderBasedApplicationRequest:
      allOf:
        - $ref: '#/components/schemas/ApplicationRequest'
        - type: object
          properties:
            certificateId:
              type: string
              format: uuid
              description: Certificate identifier
            contentRewrite:
              type: boolean
              description: Indicates whether Access Gateway attempts to rewrite redirects and URLs in an app's HTML content
            debug:
              type: boolean
              description: Indicates whether debug logging is enabled for the application
              default: false
            hostHeaderValue:
              type: string
              description: The value of the host header that's passed to the back-end protected web resources. It uses the fully qualified external name.
            loadBalanced:
              type: boolean
              description: Indicates whether the application is load balanced. If `loadBalanced` is `true`, you can distribute the request load for an application across multiple servers.
              default: false
            localNetworkAccessRestriction:
              type: boolean
              default: false
              description: Indicates whether local network access restriction is enabled. If `localNetworkAccessRestriction` is `true`, Access Gateway only allows proxy requests from local network IP addresses.
            maxFileSize:
              type: integer
              description: Maximum file upload size allowed by the application, in megabytes (MB). The default value is 1 (1 MB). Setting it to 0 (zero) allows for an unlimited file upload size.
              default: 1
            proxyReadTimeout:
              type: integer
              description: Defines a timeout in seconds for reading a response from the proxied server. The timeout counter takes effect only between two successive read operations, not for the transmission of the whole response. If the proxied server doesn't transmit anything within this time, the connection is closed.
              default: 60
              maximum: 99999999
              minimum: 1
            proxyRedirect:
              type: boolean
              description: Indicates whether the application is a proxy redirect application. If `proxyRedirect` is `true`, Access Gateway redirects the browser to the protected resource URL.
            publicDomain:
              type: string
              description: The URL of the domain that's entered by users to gain access to this application. The domain must be registered with a domain registrar.
              format: hostname
            type:
              type: string
              description: Application type
              enum:
                - OAG_HEADER_BASED
                - OAG_ADMINUI
                - OAG_NOAUTH
                - OAG_SAMPLE_COOKIE
                - OAG_SAMPLE_HEADER
                - OAG_SAMPLE_POLICY
                - OAG_SAMPLE_WIKIPEDIA
                - ORACLE_ACCESSGATE
                - ORACLE_AGILE_PLM
                - ORACLE_APPLICATION_EXPRESS
                - ORACLE_DEMANTRA
                - ORACLE_HCM_CLOUD
                - ORACLE_HYPERION
                - ORACLE_JDE
                - ORACLE_OBIEE
                - ORACLE_PEOPLESOFT
                - ORACLE_WEBCENTER
                - ORACLE_WEBLOGIC
            usePublicDomainAsHostHeader:
              type: boolean
              description: |-
                Indicates whether the application sends a host header to the protected resource.
                * If it's set to `true`, Access Gateway uses the public domain name as the host header value.
                * If it's set to `false`, Access Gateway uses the `hostHeaderValue` as the host header value if `hostHeaderValue` is specified.
                * If it's set to `false` and `hostHeaderValue` isn't specified, Access Gateway uses the protected resource hostname as the host header value.
      type: object
    HeaderBasedApplicationResponseWithEmbedded:
      allOf:
        - $ref: '#/components/schemas/HeaderBasedApplicationRequest'
        - type: object
          properties:
            _embedded:
              type: object
              description: Additional configuration settings for applications that are returned when you use the `expand` query parameter
              readOnly: true
              x-order: 99
              properties:
                healthCheck:
                  $ref: '#/components/schemas/HealthCheck'
                session:
                  $ref: '#/components/schemas/Session'
                behavior:
                  $ref: '#/components/schemas/Behavior'
                protectedResources:
                  type: array
                  items:
                    $ref: '#/components/schemas/ProtectedResource'
                  description: Protected resource servers configuration
                attributes:
                  type: array
                  items:
                    $ref: '#/components/schemas/Attribute'
                  description: Attributes configuration
                policies:
                  type: array
                  items:
                    $ref: '#/components/schemas/Policy'
                  description: Authorization policies configuration
    HeaderBasedApplicationUpdateRequest:
      allOf:
        - $ref: '#/components/schemas/ApplicationUpdateRequest'
        - type: object
          properties:
            certificateId:
              type: string
              format: uuid
              description: Certificate identifier
            contentRewrite:
              type: boolean
              description: Indicates whether Access Gateway attempts to rewrite redirects and URLs in an app's HTML content
            hostHeaderValue:
              type: string
              description: The value of the host header that's passed to the back-end protected web resources. It uses the fully qualified external name.
            loadBalanced:
              type: boolean
              description: Indicates whether the application is load balanced. If `loadBalanced` is `true`, you can distribute the request load for an application across multiple servers.
              default: false
            localNetworkAccessRestriction:
              type: boolean
              default: false
              description: Indicates whether local network access restriction is enabled. If `localNetworkAccessRestriction` is `true`, Access Gateway only allows proxy requests from local network IP addresses.
            maxFileSize:
              type: integer
              description: Maximum file upload size allowed by the application, in megabytes (MB). The default value is 1 (1 MB). Setting it to 0 (zero) allows for an unlimited file upload size.
              default: 1
            proxyReadTimeout:
              type: integer
              description: Defines a timeout in seconds for reading a response from the proxied server. The timeout counter takes effect only between two successive read operations, not for the transmission of the whole response. If the proxied server doesn't transmit anything within this time, the connection is closed.
              default: 60
              maximum: 99999999
              minimum: 1
            proxyRedirect:
              type: boolean
              description: Indicates whether the application is a proxy redirect application. If `proxyRedirect` is `true`, Access Gateway redirects the browser to the protected resource URL.
            publicDomain:
              type: string
              description: The URL of the domain that's entered by users to gain access to this application. The domain must be registered with a domain registrar.
              format: hostname
            type:
              type: string
              description: Application type
              enum:
                - OAG_HEADER_BASED
                - OAG_ADMINUI
                - OAG_NOAUTH
                - OAG_SAMPLE_COOKIE
                - OAG_SAMPLE_HEADER
                - OAG_SAMPLE_POLICY
                - OAG_SAMPLE_WIKIPEDIA
                - ORACLE_ACCESSGATE
                - ORACLE_AGILE_PLM
                - ORACLE_APPLICATION_EXPRESS
                - ORACLE_DEMANTRA
                - ORACLE_HCM_CLOUD
                - ORACLE_HYPERION
                - ORACLE_JDE
                - ORACLE_OBIEE
                - ORACLE_PEOPLESOFT
                - ORACLE_WEBCENTER
                - ORACLE_WEBLOGIC
            usePublicDomainAsHostHeader:
              type: boolean
              description: |-
                Indicates whether the application sends a host header to the protected resource.
                * If it's set to `true`, Access Gateway uses the public domain name as the host header value.
                * If it's set to `false`, Access Gateway uses the `hostHeaderValue` as the host header value if `hostHeaderValue` is specified.
                * If it's set to `false` and `hostHeaderValue` isn't specified, Access Gateway uses the protected resource hostname as the host header value.
      type: object
    HealthCheck:
      description: |-
        A health check configuration for load balanced applications

        [`loadBalanced`](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Applications/#tag/Applications/operation/createApplication!path=allOf/loadBalanced&t=request) must be set to `true` in the application configuration to enable a health check.
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether health checks are allowed for protected resource URLs in load balanced applications. Health checks are allowed if `enabled` is `true`.
          default: false
        healthyThreshold:
          type: integer
          description: Number of successful responses that must be returned before a host is considered healthy
          default: 3
          minimum: 1
          maximum: 10
        interval:
          type: integer
          description: Interval between health check requests (in seconds)
          default: 10
          minimum: 2
          maximum: 300
        method:
          type: string
          enum:
            - GET
          default: GET
          description: HTTP request method for health checks. `GET` is the only supported method.
        path:
          type: string
          description: The URI path to the resource that's used in health checks
          default: /
        statusCode:
          type: integer
          description: HTTP response status code that web resources return as part of a successful health check
          default: 200
        timeout:
          type: integer
          description: The amount of time, in seconds, that a health check HTTP request can take before it's considered a failure
          default: 1
          minimum: 1
          maximum: 60
        unhealthyThreshold:
          type: integer
          description: Number of unsuccessful responses that must be returned before a host is considered unhealthy
          default: 3
          minimum: 1
          maximum: 10
    IDPRequest:
      type: object
      properties:
        description:
          type: string
          description: Enter a description for the IdP
        name:
          type: string
          description: Enter a name for the IdP
        type:
          type: string
          description: |-
            IdP type

            There are two types of IdPs that you can create:

            * `IDP_OKTA` connects to Okta's IdP
            * `IDP_AUTH0` connects to Auth0's IdP
          enum:
            - IDP_OKTA
            - IDP_AUTH0
      required:
        - type
      discriminator: *ref_5
    IDPUpdateRequest:
      type: object
      properties:
        description:
          type: string
          description: Enter a description for the IdP
        name:
          type: string
          description: Enter a name for the IdP
      discriminator: *ref_6
    IdP:
      type: object
      properties:
        description:
          type: string
          description: Short description of the IdP
        domain:
          type: string
          description: IdP domain
        id:
          type: string
          description: Unique identifier of the IdP
          format: uuid
        name:
          type: string
          description: Name of the IdP
        tenant:
          type: string
          description: IdP tenant name
        type:
          type: string
          description: IdP type
          enum:
            - IDP_OKTA
            - IDP_AUTH0
        validationStatus:
          type: object
          description: |-
            The validation status of the IdP

            This object contains information about the status of the IdP connection, including whether the IdP is valid and any permissions associated with it.
          properties:
            valid:
              type: boolean
              description: Indicates whether the IdP is valid
            permissions:
              type: array
              description: List of permissions associated with the IdP
              items:
                type: string
    IdPOfflineModeDirectory:
      type: object
      properties:
        config:
          type: object
          description: |-
            Additional configuration settings for the directory server of the IdP.

            See [Manage your LDAP integration](https://help.okta.com/okta_help.htm?type=oie&id=ext_LDAP_Provisioning) and [What Is LDAP & How Does It Work?](https://www.okta.com/identity-101/what-is-ldap/)
          required:
            - userSearchDn
            - groupSearchDn
          properties:
            usernameLDAPAttribute:
              type: string
              description: The LDAP attribute that's used to represent usernames in the directory server of the IdP
            uniqueIdAttribute:
              type: string
              description: The LDAP attribute that's used to represent unique IDs in the directory server of the IdP
            userSearchDn:
              type: string
              description: The distinguished name (DN) in an LDAP directory that Access Gateway uses to start searching for user entries. It defines the "base" location within the directory tree to perform user lookups.
            userObjectClasses:
              type: array
              items:
                type: string
              description: |-
                The list of LDAP object classes that define what types of "user" entries exist in your directory server. An object class is a template in an LDAP schema that describes the attributes an entry must or may have.

                Object classes allow Access Gateway to identify which entries in the directory server represent user accounts. Common object classes for users include `person`, and `user`, but the specific object classes can vary based on your directory schema.
            userObjectFilter:
              type: string
              description: An LDAP filter string that defines criteria for selecting user objects during directory searches
            groupNameLDAPAttribute:
              type: string
              description: The LDAP attribute that's used to represent group names in the directory server of the IdP
            groupSearchDn:
              type: string
              description: The distinguished name (DN) in an LDAP directory that Access Gateway uses to start searching for group entries. It defines the "base" location within the directory tree to perform group lookups.
            groupObjectClasses:
              type: array
              items:
                type: string
              description: |-
                The list of LDAP object classes that define what types of "group" entries exist in your directory server. An object class is a template in an LDAP schema that describes the attributes that an entry must or may have.

                Object classes allow Access Gateway to identify which entries in the directory server represent group accounts. Common object classes for groups include `groupOfNames`, `groupOfUniqueNames`, and `group`, but the specific object classes can vary based on your directory schema.
            memberAttribute:
              type: string
              description: The LDAP attribute used to indicate the members of a group in your directory server.
            memberUserAttribute:
              type: string
              description: The LDAP attribute in user entries that's used to match or reference user accounts in group membership listings within the directory
            rdnLdapAttribute:
              type: string
              description: |-
                The LDAP attribute used for relative distinguished names (RDNs). By default, Access Gateway uses `uid` for `OPEN_LDAP` directories and `cn` for `ACTIVE_DIRECTORY` directories, but you can specify a different attribute if your directory server uses a different setup.

                In LDAP, each entry's DN is assembled from one or more RDNs, which are attribute-value pairs. The `rdnLdapAttribute` specifies which LDAP attribute forms the RDN for each entry when constructing or parsing DNs.

                If `rdnLdapAttribute` is set to `cn` (common name), then an entry DN for a user might be:
                `cn=jsmith,ou=users,dc=example,dc=com`
                Here, `cn` is the RDN attribute for this entry.
        connection:
          type: object
          description: Connection configuration settings for the directory server of the IdP
          properties:
            connectionUrl:
              type: string
              description: The connection URL for the directory server of the IdP
            bindDn:
              type: string
              description: The bind distinguished name (DN) for the directory server of the IdP
            bindCredential:
              type: string
              description: The bind credential (password) for the directory server of the IdP
              writeOnly: true
        id:
          type: string
          description: Unique identifier of the directory
          format: uuid
          readOnly: true
        type:
          type: string
          description: The directory vendor type
          enum:
            - OPEN_LDAP
            - ACTIVE_DIRECTORY
          x-enumDescriptions:
            OPEN_LDAP: OpenLDAP directory server
            ACTIVE_DIRECTORY: Microsoft Active Directory server
      required:
        - type
        - connection
        - config
    IdPOfflineModeDirectoryTestRequest:
      type: object
      properties:
        bindCredential:
          type: string
          description: The bind credential (password) for the directory server of the IdP
          writeOnly: true
        bindDn:
          type: string
          description: The bind distinguished name (DN) for the directory server of the IdP
          writeOnly: true
        connectionUrl:
          type: string
          description: The connection URL for the directory server of the IdP
          writeOnly: true
      required:
        - connectionUrl
        - bindDn
        - bindCredential
    IdPOfflineModeFailoverMode:
      type: object
      properties:
        mode:
          type: string
          description: |-
            Indicates the failover mode of the IdP when the IdP is unreachable or disconnected from Access Gateway (offline mode).

            The failover mode is the behavior of the IdP when Access Gateway can't connect to Okta. Access Gateway can automatically detect when the IdP is unreachable and can then switch to offline mode to maintain functionality.
          enum:
            - AUTOMATIC
            - DISABLED
          x-enumDescriptions:
            AUTOMATIC: In automatic failover mode, when the IdP is unreachable, Access Gateway automatically switches to offline mode.
            DISABLED: In disabled failover mode, Access Gateway doesn't switch to offline mode when the IdP is unreachable.
      required:
        - mode
    IdPOfflineModeHealthPolicy:
      type: object
      properties:
        failureThreshold:
          type: integer
          description: |-
            The number of consecutive failed health checks that must occur before marking the Okta IdP service as unhealthy.

            The Okta IdP service is considered unhealthy when Access Gateway can't connect to the IdP after a certain number of retry attempts. After the Okta IdP reaches the failure threshold, failover to offline mode (if failover is enabled) is triggered and sign in requests are redirected to the offline mode IdP.
          default: 3
          minimum: 1
          maximum: 10
        healthCheckInterval:
          type: integer
          description: The amount of time, in seconds, between health check requests
          default: 60
          minimum: 60
          maximum: 300
          enum:
            - 60
            - 120
            - 180
            - 240
            - 300
        maxRetries:
          type: integer
          description: The maximum number of retry attempts for failed health checks
          default: 3
          minimum: 0
          maximum: 5
        recoveryCooldownInterval:
          type: integer
          description: The interval, in seconds, before offline mode is exited and Access Gateway connects to the Okta IdP. The recovery cooldown is used after the `successThreshold` is met and the Okta IdP is marked healthy again. After the recovery cooldown interval, Access Gateway attempts to connect to the Okta IdP and exit offline mode.
          default: 360
          minimum: 120
          maximum: 6000
        successThreshold:
          type: integer
          description: The number of consecutive successful health checks that must occur before marking the Okta IdP service as healthy
          default: 2
          minimum: 1
          maximum: 10
        timeout:
          type: integer
          description: The amount of time, in seconds, that a health check HTTPS request can take before it's considered a failure
          default: 3
          minimum: 1
          maximum: 10
    InternalServerError:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: INTERNAL_SERVER_ERROR
            message:
              type: string
              example: An unexpected error occurred on the server side
    OktaIdPRequest:
      allOf:
        - $ref: '#/components/schemas/IDPRequest'
        - type: object
          properties:
            apiToken:
              type: string
              description: Access token for the IdP
            domain:
              type: string
              description: Okta org domain/custom domain (if configured). The domain must be unique per IdP. Creating another IDP with the same domain returns an error.
            type:
              type: string
              description: IdP type
              enum:
                - IDP_OKTA
          required:
            - type
            - domain
            - apiToken
      type: object
    Policy:
      type: object
      properties:
        active:
          type: boolean
          default: true
          description: Policy status
        caseSensitive:
          type: boolean
          description: Indicates whether the policy resource is case sensitive
          default: true
        customDirective:
          type: string
          format: multi-line string
          description: |-
            Custom NGINX directives that handle special requirements not covered by the policy type.
            There is no limit to the number of directives you can add, but each directive must be on its own line.
        description:
          type: string
          description: Policy description
        id:
          type: string
          format: uuid
          description: Unique identifier of the policy
          readOnly: true
        name:
          type: string
          description: Policy name
        regexRule:
          type: string
          description: |-
            Regular expression (regex) that can control authorization for the given resource

            See [Protected Rule resource-matching rule expressions](https://help.okta.com/okta_help.htm?type=oag&id=policy-protected-rule-expressions).
        resourcePath:
          type: string
          description: The path to the resource that the policy manages
        rule:
          type: string
          enum:
            - NO_AUTH
            - PROTECTED
            - PROTECTED_REGEX
            - ADAPTIVE
            - CUSTOM
          description: |-
            Policy type

            See [Policy types](https://help.okta.com/okta_help.htm?type=oag&id=ext_oag_about_pol_types)
          x-enumDescriptions:
            NO_AUTH: The resource is not protected by any policy
            PROTECTED: This policy requires a valid session (authenticated user) to access the associated resource
            PROTECTED_REGEX: This policy requires a valid session and an expression that determines who can access the resource
            ADAPTIVE: This policy extends the Not Protected policy, but passes header information to the underlying app
            CUSTOM: This policy extends the Protected Rule policy, but supports entering a regular expression as the URI
    PolicyCreateRequest:
      allOf:
        - $ref: '#/components/schemas/Policy'
        - type: object
          required:
            - name
            - resourcePath
            - rule
    ProtectedResource:
      type: object
      properties:
        active:
          type: boolean
          default: true
          description: Indicates whether the protected resource is active or not. If set to `true`, the resource is considered active and is used for routing requests.
        assignedWeight:
          type: integer
          default: 1
          minimum: 0
          maximum: 100
          description: |-
            The associated weight assigned to the protected resource. This weight is used to determine how requests are distributed among multiple protected resources.

            You can assign a value from `0` to `100`. `0` (zero) means that a host isn't in use.

            For example, a weight value of `1` routes an equal number of requests to each protected web resource.
            A weight value of `2` routes twice as many requests to protected web resources with this weight than those with a weight of `1`. If one protected web resource has a weight of `1` and the other has a weight of `2`, `66%` of the total requests are routed to the resource with a weight of `2`.
        calculatedWeight:
          type: number
          format: float
          description: The calculated weight percentage that's based on the assigned weight distribution of all resources in the application. Values are represented as decimals. For example, `1.0` equals 100% distribution and `0.5` equals 50% distribution.
          readOnly: true
        hostname:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?/?$
          description: |-
            The hostname of the protected web resource URL

            The URL must include the protocol, host, and port.
        id:
          type: string
          format: uuid
          description: Unique identifier of the protected resource
          readOnly: true
    ProtectedResourceCreateRequest:
      allOf:
        - $ref: '#/components/schemas/ProtectedResource'
        - type: object
          required:
            - hostname
    ResourceNotFound:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: NOT_FOUND
            message:
              type: string
              example: The requested resource could not be found
    SamlApplicationCreateRequest:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      allOf:
        - $ref: '#/components/schemas/SamlApplicationRequest'
      type: object
      required:
        - type
        - label
        - idpId
        - clientId
        - acsUrl
        - postLoginUrl
        - logoutUrl
    SamlApplicationProperties:
      type: object
      properties:
        acsUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?(?:\?[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?(?:#[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?$
          description: The Assertion Consumer Service (ACS) URL where the SAML assertion is sent after authentication
        binding:
          type: string
          description: The SAML binding that's used for communication between the service provider (SP) and IdP
          enum:
            - HTTP_POST
            - HTTP_REDIRECT
          default: HTTP_POST
        clientId:
          type: string
          description: The unique identifier of the SP entity
        clientSignature:
          type: boolean
          description: Indicates whether SAML requests are expected to be signed by the SP or not. When `clientSignature` is `true`, SAML requests are signed by the SP and you must provide a value for `spCertificate`. When it's `false`, SAML requests aren't signed by the SP and the `spCertificate` value is ignored.
          default: false
        encryptAssertion:
          type: boolean
          description: Indicates whether SAML assertions are required to be encrypted by the IdP or not. When `encryptAssertion` is `true`, the SAML assertion must be encrypted by the IdP before it's sent to the SP. When it's `false`, the assertion can be sent without encryption.
          default: false
        encryptionAlgorithm:
          type: string
          description: The encryption algorithm that's used for SAML assertions
          enum:
            - AES128_CBC
            - AES256_CBC
            - TRIPLE_DES_CBC
          default: AES256_CBC
        keyTransportAlgorithm:
          type: string
          description: The key transport algorithm that's used for SAML assertions
          enum:
            - RSA_OAEP
            - RSA_OAEP_256
            - RSA_V1_5
          default: RSA_OAEP_256
          x-enumDescriptions:
            RSA_OAEP: RSA Encryption Scheme (RSAES) that uses Optimal Asymmetric Encryption Padding (OAEP) using SHA-1 and Mask Generation Function 1 (MGF1) with SHA-1
            RSA_OAEP_256: RSAES that uses OAEP with SHA-256 and MGF1 with SHA-256
            RSA_V1_5: RSA v1.5 padding
        logoutUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?(?:\?[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?(?:#[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?$
          description: The single logout URL for the SAML application. This is the URL where users are redirected to initiate the logout process with the Identity Provider (IdP) when [`singleLogout`](https://developer.okta.com/docs/api/openapi/oag/oag/tag/Application-Behavior/#tag/Application-Behavior/operation/replaceBehavior!path=singleLogout&t=request) is set to `true` in the application behavior configuration.
        nameIdFormat:
          type: string
          description: The `NameID` format that's used for SAML assertions
          enum:
            - EMAIL_ADDRESS
            - PERSISTENT
            - TRANSIENT
            - UNSPECIFIED
          default: UNSPECIFIED
          x-enumDescriptions:
            EMAIL_ADDRESS: The `NameID` is in the format of an email address.
            PERSISTENT: The `NameID` is a persistent, opaque identifier that doesn't change across sessions. It's typically used when the SP needs to recognize the user across multiple sessions without revealing their actual identity.
            TRANSIENT: The `NameID` is a temporary identifier that's generated for a single session. It changes with each new session and isn't meant to be stored or reused by the SP.
            UNSPECIFIED: The `NameID` format isn't specified. The IdP and SP may use a default format or determine the format based on other factors.
        postLoginUrl:
          type: string
          format: uri
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]{1,5})?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?(?:\?[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?(?:#[A-Za-z0-9._~!$&'()*+,;=:@%/?-]*)?$
          description: Relay state URL where end users are directed after they sign in. This is typically the URL of the application dashboard or homepage.
        signAssertion:
          type: boolean
          description: Indicates whether SAML assertions are expected to be signed by the IdP or not. When `signAssertion` is `true`, SAML assertions are signed by the IdP. When it's `false`, SAML assertions are sent without a signature.
          default: true
        signDocument:
          type: boolean
          description: Indicates whether SAML responses are expected to be signed by the IdP or not. When `signDocument` is `true`, SAML responses are signed by the IdP. When it's `false`, SAML responses are sent without a signature.
          default: false
        signingAlgorithm:
          type: string
          description: The signing algorithm that's used for SAML requests and responses
          enum:
            - RSA_SHA1
            - RSA_SHA256
            - RSA_SHA256_MGF1
            - RSA_SHA512
            - RSA_SHA512_MGF1
          default: RSA_SHA256
          x-enumDescriptions:
            RSA_SHA1: RSA signature with SHA-1 hashing algorithm
            RSA_SHA256: RSA signature with SHA-256 hashing algorithm
            RSA_SHA256_MGF1: RSA signature with SHA-256 hashing algorithm and MGF1 mask generation function
            RSA_SHA512: RSA signature with SHA-512 hashing algorithm
            RSA_SHA512_MGF1: RSA signature with SHA-512 hashing algorithm and MGF1 mask generation function
        spCertificate:
          type: string
          description: The Base64-encoded public certificate of the SP. This is required when `clientSignature`, `encryptAssertion`, `signAssertion`, or `signDocument` are set to `true`.
          writeOnly: true
        type:
          type: string
          description: The application type
          enum:
            - OAG_SAML
    SamlApplicationRequest:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      allOf:
        - $ref: '#/components/schemas/ApplicationRequest'
        - $ref: '#/components/schemas/SamlApplicationProperties'
        - type: object
          properties:
            idpMetadata:
              type: string
              description: Base64-encoded metadata about the IdP that's used to set up the SAML integration
              readOnly: true
      type: object
    SamlApplicationResponse:
      $ref: '#/components/schemas/SamlApplicationRequest'
    SamlApplicationResponseWithEmbedded:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      allOf:
        - $ref: '#/components/schemas/SamlApplicationRequest'
        - type: object
          properties:
            _embedded:
              type: object
              description: |-
                Additional configuration settings for applications that are returned when you use the `expand` query parameter. This object returns different settings based on the application type.

                SAML applications don't use Access Gateway as a proxy. As a result, the `_embedded` object doesn't return protected resources, health checks, application policy settings, and session settings. The application session is controlled by the application itself and none of the session settings are returned in the `_embedded` object.

                For SAML applications, the `_embedded` object only returns the `behavior` and `attributes` settings. Many of the application behavior settings are related to the application session only and aren't applicable for SAML applications. `singleLogout`, `universalLogout`, `globalTokenRevocation`, and `globalTokenRevocationEndpoint` are the only applicable behavior settings for SAML applications.
              readOnly: true
              x-order: 99
              properties:
                behavior:
                  $ref: '#/components/schemas/BehaviorSAML'
                attributes:
                  type: array
                  items:
                    $ref: '#/components/schemas/Attribute'
                  description: Attributes configuration
    SamlApplicationUpdateRequest:
      allOf:
        - $ref: '#/components/schemas/ApplicationUpdateRequest'
        - $ref: '#/components/schemas/SamlApplicationProperties'
      type: object
    ServiceUnavailable:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: SERVICE_UNAVAILABLE
            message:
              type: string
              example: The server is currently unable to handle the request due to initializing
    Session:
      description: Application session configuration
      type: object
      properties:
        auth:
          type: string
          enum:
            - HEADER
            - NOAUTH
            - IWA
            - EBS
          description: Authentication type
        browserSessionExpiration:
          type: boolean
          description: Indicates whether app sessions expire when the browser is closed. If `browserSessionExpiration` is `true`, the app session expires when the browser is closed.
        deepLinking:
          type: boolean
          description: Indicates whether your application dynamically redirects browsers to application URIs after sign-in. If `deepLinking` is `false`, the browser redirects to the post sign-in URL after sign-in.
        enforceDeepLinkingDomain:
          type: boolean
          description: Indicates whether your application only allows deep links that share the public domain name. If a deep link domain doesn't match the public domain name, Access Gateway only uses the post login URL.
        idleSession:
          type: boolean
          description: Indicates whether app sessions can expire after a certain amount of idle time. If `idleSession` is `true`, the session expires after a period of inactivity, determined by the `idleSessionTimeout` value.
        idleSessionTimeout:
          type: integer
          description: |-
            The amount of idle time, in seconds, before an app session expires. This value is ignored if `idleSession` is `false`.
            The maximum value for this field is determined by the `maxSessionTimeout` value. The value of `idleSessionTimeout` must be less than or equal to `maxSessionTimeout`.
          minimum: 60
          default: 3600
        maxSession:
          type: boolean
          description: Indicates whether app sessions can expire after a certain amount of time, regardless of activity. If `maxSession` is `true`, the session expires after a period of time, determined by the `maxSessionTimeout` value.
        maxSessionTimeout:
          type: integer
          description: |-
            The amount of time, in seconds, before an app session expires, regardless of activity. This value is ignored if `maxSession` is `false`.
            The minimum value for this field is determined by the `idleSessionTimeout` value. The value of `maxSessionTimeout` must be greater than or equal to `idleSessionTimeout`.
            Setting `maxSessionTimeout` to `0` means that the app session never expires which is similar to setting `maxSession` to `false`.
          default: 28800
    TooManyRequests:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: TOO_MANY_REQUESTS
            message:
              type: string
              example: API rate limit exceeded
    Unauthorized:
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          properties:
            errorCode:
              type: string
              example: UNAUTHORIZED
            message:
              type: string
              example: Authentication is required or has failed
  securitySchemes:
    jwtBearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Enter the JWT bearer token in the format: Bearer {token}'
x-tagGroups:
  - name: Access Tokens
    tags:
      - AccessTokens
  - name: Applications
    tags:
      - Applications
      - Application Attributes
      - Application Behavior
      - Application Health Check
      - Application Policies
      - Application Protected Resources
      - Application Session
      - Application Offline Mode
  - name: Certificates
    tags:
      - Certificates
  - name: Identity Providers
    tags:
      - IDPs
      - IDPs Offline Mode
      - IDPs Offline Mode Directory
      - IDPs Offline Mode Health Policy
  - name: Settings
    tags:
      - Settings Authentication Service