2 Interface Definitions

This chapter describes the REST software interfaces exposed by the Access Portal Service. The Access Portal Service REST interfaces conform to the following:

Each interface conforms to request and response definitions described in Interface Definitions and defines the expected payload for both the request and response.
The response definition is the result of the request.
Multiple requests/responses per payload are supported; each response/request pair is distinguished via a unique transient identifier generated by the client.
The request header must be configured on the client side as follows:
- GET, DELETE - request defines payload type
- PUT, POST - set the Content-type parameter as follows:
  
  Request/response format
  
  Content-type value in header
  
  XML
  
  application/XML
  
  JSON
  
  application/JSON
The OAMAuthnCookie value is used for validation and extraction of the user name. This will be passed into each REST interface call along with the partner (associated webgate name) as cookies.

This chapter covers the following operation categories:

Credential Operations
Policy Operations
Provisioning Operations
Event Operations

2.1 Credential Operations

This section describes the HTTP requests and responses for credential operations that the Access Portal Service can perform via its REST API. Request and response definitions in JSON and XML formats are described. The following operations are available:

Credential Search
Credential List
Credential Add
Credential Update
Credential Delete

2.1.1 Credential Search

The credential search request/response pair enables the search for a credential.
It does not return protected fields.

URI: /idass/am/esso/v1/userwallet/credentials
Method: GET
Category: User

The following table describes the parameters of the credential search request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=base64+url-encoded-payload&Operation=Search&ESSO_Payload_Type= application/json

Field

Description

{ "Context": "uu-encoded, salted SHA256 payload hash",

"ESSO_General": { "ESSO_Version": "1", "ESSO_MaxRequest": "10"},
"ESSO_Requests": [ { "ESSO_Data": { "ESSO_CredentialFilters": [ { "ESSO_Field": "ConfigName",
"ESSO_PolicyName": "ESSO_Group",

"ESSO_Type": "Exact",
"ESSO_Value": "match-value"
} ] } }, { "ESSO_AttributeList": "ConfigName;Description" } ] }

String. Required. Base64 encoded.

String. Required. Interface version.

String. Optional. The maximum number of credentials to return; default is ALL.

Required. Multiple requests per payload allowed.

Required. Multiple filters allowed.

String. Required. Name of the target field. If target field is multi-value, all fields will be searched.

String. Required. Name of the policy to search for. This can be the target application name or the target credential sharing group. Mutually exclusive with the ESSO_Field key.

String. Optional. Regex | Wildcards | Exact. If using ESSO_PolicyName, "Exact" is the only supported type.

String. Required. Matching criteria. Not required if using ESSO_PolicyName.

String. Optional. Attribute list. No secure attributes allowed.

The following table describes the parameters of the credential search response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Result": 0,

"ESSO_Data": {

"ESSO_Credentials": [ {

"ESSO_ID": "credential-GUID",

String. Required. Base64-encoded.

String. Required. Interface version.

Required. Can contain responses to multiple requests

Integer. Required. Overall response result.

Required. Array of credential responses.

String. Required. Returned credential's ID.

"ESSO_Result": 0,

"attributes": {

} }, {

"ESSO_ID": "credential-GUID", "ESSO_Result": 0, "attributes": { }}]}}}}

Integer. Required. Credential result.

String. Required. Key-value pairs of returned credential.

String. Required. Returned credential's ID.

Integer. Required. Credential result.

String. Key-value pairs of returned credential.

The following table describes the parameters of the credential search request in XML format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=base64+url-encoded-payload&Operation=Search&ESSO_Payload_Type= application/xml

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

<ESSO_MaxRequest>10</ESSO_MaxRequest>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Data>

<ESSO_CredentialFilters>

<ESSO_Field>ConfigName</ESSO_Field>

<ESSO_Type>Exact</ESSO_Type>

<ESSO_PolicyName>ESSO_Group</ESSO_PolicyName>

<ESSO_Value>match-value</ESSO_Value>

</ESSO_CredentialFilters>

</ESSO_Data>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Integer. Optional. The maximum number of credentials to return; default is ALL.

String. Optional. If omitted, returns all credentials.

String. Required. Name of the target field. If target field is multi-value, all fields will be searched.

String. Required. Regex | Wildcards | Exact. If using ESSO_PolicyName, "Exact" is the only supported type.

String. Required. Name of the application policy or credential sharing group to search for.
Mutually exclusive with the ESSO_Field key.

String. Required. Matching criteria. Not required if using ESSO_PolicyName.

<ESSO_AttributeList>
ConfigName;Description
</ESSO_AttributeList>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

String. Optional. Attribute list. No secure attributes allowed. Default is ALL.

The following table describes the parameters of the credential search response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>guid of credential</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

<CredDef>credential-here</CredDef>

</attributes>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>guid of credential</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

<CredDef>credential here</CredDef>

</attributes>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

Required

Integer. Required. Interface version.

Can contain responses to multiple requests.

Integer. Required. Overall request result.

String. Required. Returned credential's ID.

Integer. Required. Result of credential operation.

Credential definition.

String. Required. Returned credential's ID.

Integer. Required. Result of credential operation.

Credential definition.

2.1.2 Credential List

The credential list operation provides the ability to list credentials, including protected fields.

URI: /idass/am/esso/v1/userwallet/credentials
Method: GET
Category: User

The following table describes the parameters of the credential list request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=
base-64-encoded-payload&Operation=List&ESSO_Payload_Type=application/json

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General":{

"ESSO_Version": "1"},

"ESSO_Requests": [ { "ESSO_AttributeList": "ConfigName;LastUsed",

"ESSO_Data": {

"ESSO_Credentials": [ {

"ESSO_ID": "target credential ID" },{

"ESSO_ID": "target credential ID"

} ] } } ] }

String. Required. Base64-encoded.

Required.

String. Required. Interface version.

Required. Multiple requests allowed.

String. Optional. ALL (Default) | Attribute List | Protected

String. Optional. If omitted, all credentials are returned.

String. Required. ID of credential to retrieve.

The following table describes the parameters of the credential list response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": 1}, "ESSO_Responses": [ { "ESSO_Result": 0, "ESSO_Data": { "ESSO_Credentials": [ { "ESSO_ID": "target credential ID", "ESSO_Result": 0,

"attributes": { } }, { "ESSO_ID": "target credential ID",

"ESSO_Result": 0,

"attributes": { } } ] } } ] }

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

Required. Multiple requests allowed.

Integer. Required. Overall request result.

Required. Array of returned credentials.

String. Required. Target credential's ID.

Integer. Required. Result of returned credential.

String. Required. Key-value pairs of returned credential.

String. Required. Target credential's ID.

Integer. Required. Result of returned credential.

String. Required. Key-value pairs of returned credential.

The following table describes the parameters of the credential list request in XML format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=
base-64-encoded-payload&Operation=List&ESSO_Payload_Type=application/XML

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

String. Required. Base64-encoded.

Integer. Required. Interface version.

<ESSO_Requests>

<ESSO_Request>

<ESSO_AttributeList>ConfigName;LastUsed
</ESSO_AttributeList>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>{105a3a14-7523-496f-9114-4e0ed6ff7027}
</ESSO_ID>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>{391a3591-4164-44e0-8aa5-2b22c675990}
</ESSO_ID>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

Multiple requests supported.

String. Optional. ALL (default) | Attribute List | PROTECTED

String. Optional. If omitted, all credentials are returned.

String. Required. Target credential's ID.

The following table describes the parameters of the credential list response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>
{105a3a14-7523-496f-9114-4e0ed6ff7027}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

<CredDef>credential-definition</CredDef>

</attributes>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>
{391a3591-4164-44e0-8aa5-2b22c6759a90}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

<CredDef>credential-definition</CredDef>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

String. Required. Target credential's ID.

Integer. Required. Operation request code.

Credential definition.

String. Required. Target credential's ID.

Integer. Required. Operation result code.

Credential definition.

</attributes>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

2.1.3 Credential Add

The credential add operation provides the ability to add credentials to the user's wallet.

URI: /idass/am/esso/v1/userwallet/credentials
Method: POST
Category: User

Oracle recommends including the Modified, LastPwdChange, and LastUsed key-value pairs, which denote the Windows date and time of the credential's creation.

The following table describes the parameters of the credential add request in JSON format.

Field

Description

{"Context": "uu-encoded, slated SHA2-256 payload hash",

String. Required. Base64-encoded.

"ESSO_General": { "ESSO_Version": 1 }, "ESSO_Requests": [ { "ESSO_Data": { "ESSO_Credentials": [ { "ESSO_Identifier": "transient-credential-identifier",

"attributes": { } }, { "ESSO_CredentialType": "OPAM",
"ESSO_Identifier": "transient-credential-identifier",
"attributes": { }}]}}]}

Required.

Integer. Required. Interface version.

Multiple requests supported.

Required. List of credentials.

String. Required. Unique transient identifier used to identify the credential in the request and response.

String. Required. Key-value pairs for credential attributes.

Credential type. "OPAM" permits the checkout of an OPAM credential. Default is not OPAM.

String. Required. Unique transient identifier used to identify the credential in the request and response.

String. Required. Key-value pairs for credential attributes.

The following table describes the parameters of the credential add response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": "1"},

"ESSO_Responses": [ {

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

"ESSO_Result": "0",

"ESSO_Data": {

"ESSO_Credentials": [ {

"ESSO_Identifier": "transient-identifier",

"ESSO_ID": "repository-credential-ID",

"ESSO_Result": "0" },{
"ESSO_Identifer": "transient-identifier",

"ESSO_ID": "repository-credential-ID",
"ESSO_Result": "0" }]}}]}

Overall response result code.

Array of added credentials.

String. Required. Unique transient identifier used to match the operation's data in the request and response.

String. Required. Credential identifier used to identify the credential in the ESSO repository.

String. Required. Unique transient identifier used to match the operation's data in the request and response.

String. Required. Credential identifier used to identify the credential in the ESSO repository.

String. Required. Operation result code.

The following table describes the parameters of the credential add request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_Identifier>transient-credential-identifier</ESSO_Identifier>

<CredDef>credential-definition</CredDef>

</attributes>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_CredentialType>OPAM
</ESSO_CredentialType>

<ESSO_Identifier>transient-credential-identifier
</ESSO_Identifier>

<CredDef>credential-definition</CredDef>

</attributes>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Request></ESSO_Requests></ESSO>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple requests supported.

String. Required. Unique transient credential identifier used to identify the credential in the request and response.

Key-value pairs for the credential definition.

String. Optional. Credential type. "OPAM" allows the checkout of an OPAM credential; default is "not OPAM"

String. Required. Unique transient credential identifier used to identify the credential in the request and response.

Key-value pairs for the credential definition.

The following table describes the parameters of the credential add response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

String. Required. Base64-encoded.

String. Required. Interface version.

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_Identifier>transient-credential-identifier
</ESSO_Identifier>

<ESSO_ID>
{8dcaf202-1554-46e6-8640-74857c98487a}</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_Identifier>transient-credential-identifier
</ESSO_Identifier>

<ESSO_ID>
{7dcaf202-1554-46e6-8640-74857c98487a}</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

Multiple responses supported.

Integer. Required. Overall responses result code.

String. Required. Unique credential identifier used to identify the credential in the request and response.

String. Required. Credential identifier used to identify the credential in the ESSO repository.

Integer. Required. Credential operation result code.

Required

String. Required. Unique credential identifier used to identify the credential in the request and response.

String. Required. Credential identifier used to identify the credential in the ESSO repository.

Integer. Required. Credential operation result code.

2.1.4 Credential Update

The credential update operation provides the ability to update credentials in the user's wallet.

URI: /idass/am/esso/v1/userwallet/credentials
Method: PUT
Category: User

If the LastUsed key is set to NOW on the input, the LastUsed key should be set to the the current Windows time. If the credential operation is a PasswordChange, the keys LastPwdChange and Modified should be updated to the current time, while the OldPassKey key should be updated to the current password of the credential in the repository.

The following table describes the parameters of the credential update request in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Requests": [ {

"ESSO_Update_Delta": "true",

"ESSO_Data": {

"ESSO_Credentials": [ {

"ESSO_ID": "credential-ID",

"attributes": {

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

Required.

String. Required. When set to "true," only values supplied in the credential will be updated.

String. Required. ID of the target credential.

String. Required. Key-value pairs to be updated.

"PASSSWORDCHANGE": "AUTO" }, {

"ESSO_ID": "credential-ID", "attributes": { }, "PASSWORDCHANGE": "AUTO" } ] } } ] }

String. Optional. AUTO | OFF | MANUAL.
AUTO: the server will perform the password reset. MANUAL: the server checks the incoming password against policy. Default is OFF.

String. Required. ID of the target credential.

String. Required. Key-value pairs to be updated.

String. Optional. AUTO | OFF | MANUAL.
AUTO: the server will perform the password reset. MANUAL: the server checks the incoming password against policy. Default is OFF.

The following table describes the parameters of the credential update response in JSON format.

Field

Description

"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1},

"ESSO_Responses": [ {

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

Required. Multiple responses supported.

"ESSO_Result": 0, "ESSO_Data": { "ESSO_Credentials": [ { "ESSO_ID": "ID of credential", "ESSO_Result": 0 }, { "ESSO_ID": "ID of Credential", "ESSO_Result": 0 } ] } } ] }

Integer. Required. Overall response result code.

Required. Array of credentials.

String. Required. Target credential ID.

Integer. Required. Credential operation result code.

String. Required. Target credential ID.

Integer. Required. Credential operation result code.

The following table describes the parameters of the credential update request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Update_Delta>true</ESSO_Update_Delta>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>
{8dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

<CredDef>credential-definition</CredDef>

</attributes>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>
{7dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

<CredDef>credential-definition</CredDef>

</attributes>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple requests supported.

String. Required. When set to "true," only values included in the credential will be updated.

String. Required. Target credential ID.

Key-value pairs to update in target credential.

String. Optional. AUTO | OFF | MANUAL.
AUTO: the server will perform the password reset. MANUAL: the server checks the incoming password against policy. Default is OFF.

String. Required. Target credential ID.

Key-value pairs to update in target credential.

String. Optional. AUTO | OFF | MANUAL.
AUTO: the server will perform the password reset. MANUAL: the server checks the incoming password against policy. Default is OFF.

The following table describes the parameters of the credential update response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>
{8dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>
{7dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Integer. Required. Overall request result code.

String. Required. Target credential ID.

String. Required. Update operation result code.

String. Required. Target credential ID.

String. Required. Update operation result code.

2.1.5 Credential Delete

The credential delete operation provides the ability to delete credentials from the user's wallet.

URI: /idass/am/esso/v1/userwallet/credentials
Method: DELETE
Category: User

The following table describes the parameters of the credential delete request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=base64+url-encoded-payload&ESSO_Payload_Type=application/json

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": 1 }, "ESSO_Requests": [ { "ESSO_Data": { "ESSO_Credentials": [ { "ESSO_ID": "target-credential-ID" }, { "ESSO_ID": "target-credential-ID" } ] } } ] }

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

Multiple requests supported.

Required. Array of returned credentials.

String. Required. Target credential's ID.

The following table describes the parameters of the credential delete response in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Result": 0,

"ESSO_Data": {

"ESSO_Credentials": [{

String. Required. Base64-encoded.

Required.

Integer. Required. Interface version.

Multiple responses supported. Required.

Integer. Required. Overall response result code.

Array of credentials in this operation.

"ESSO_ID": "target-credential-ID", "ESSO_Result": 0 },{ "ESSO_ID": "target-credential-ID", "ESSO_Result": 0 } ] } } ] }

String. required. Target credential's ID.

Integer. Required. Operation result code.

String. required. Target credential's ID.

Integer. Required. Operation result code.

The following table describes the parameters of the credential delete request in XML format. An example request string looks as follows:

/idass/am/esso/v1/userwallet/credentials?ESSO_Payload_Request=base64+url-encoded-payload&ESSO_Payload_Type=application/xml

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

String. Required. Base64-encoded.

Integer. Required. Interface version.

</ESSO_General>

<ESSO_Requests>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>
{8dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>
{7dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Requests>

</ESSO>

Multiple requests supported.

String. Required. Target credential's ID.

The following table describes the parameters of the credential delete response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Credentials>

<ESSO_ID>
{8dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

String. Required. Target credential's ID.

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

<ESSO_Credentials>

<ESSO_ID>
{7dcaf202-1554-46e6-8640-74857c98487a}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Credentials>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

Integer. Required. Operation result code.

String. Required. Target credential's ID.

Integer. Required. Operation result code.

2.2 Policy Operations

This section describes the HTTP requests and responses for application policy operations that the Access Portal Service can perform via its REST API. Request and response definitions in JSON and XML formats are described. The following operations are available:

Policy Search
Policy List
Policy Add
Policy Update
Policy Delete

2.2.1 Policy Search

The policy search operation provides the ability to search the repository for application policies.

URI: /idass/am/esso/v1/app/policies
Method: GET
Category: User

The following table describes the parameters of the policy search request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Payload_Request=base64+url-encoded-payload
&Operation=Search&ESSO_Payload_Type=application/json

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": "1"}, "ESSO_Requests": { "ESSO_Types": "SharingGroup;PasswordPolicy;WebApplication",

"ESSO_RepositoryID": "policy-ID",
"ESSO_AttributeList": "Description;FormType",
"ESSO_Data": { "ESSO_PolicyFilters": { "ESSO_PolicyFilter": [ { "ESSO_Match_Type": "Match", "ESSO_Enumerated_List": "URL",

"ESSO_Value": "match-value",

"ESSO_PolicyType": "WebApplication;PasswordPolicy",

String. Required. Base64-encoded.

String. Required.

String. Required. Interface version.

Multiple requests supported.

String. Required. ALL | PolicyType1, PolicyType2 Types of application policies to return: WebApplication, WindowsApplication,MainFrameApplication, SSOProtected, Federated, PasswordPolicy

GUID. Optional. Administrators only. Repository ID of target policy.

String. Optional. ALL (Default) | Attribute List. Supports returning metadata subsets.

Optional. Only needed if applying filters.

String. Required. Regex | Wildcards | Match | Exact.

String. Required. Field(s) to match against.
URL | ESSO_Field. Multiple URLs in the application policy supported.

String. Required. Match value.

String. Optional. List of policy types. Overrides
ESSO_Types for this filter only.

"ESSO_Operation": "OR" },

"ESSO_Match_Type": "Exact",

"ESSO_Field": "ConfigName",

"ESSO_Value": "match-value"

} ] } } } }

String. Optional. AND | OR | NOT. Match operation to apply to the next field.

String. Required. Regex | Wildcards | Match | Exact.

String. Required. Field(s) to match against.

String. Required. Match value.

The following table describes the parameters of the policy search response in JSON format.

Field

Description

{

"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1},

"ESSO_Responses": [ {

"ESSO_Data": {

"ESSO_Policies": [ {

"ESSO_Result": 0,

"name": "WebApplication",

"ESSO_PolicyList": [ {

String. Required. Base64-encoded.

Integer. Required. interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

"ESSO_Responses": [ { "ESSO_Data": { "ESSO_Policies": [ { "ESSO_Result": 0, "name": "WebApplication", "ESSO_PolicyList": [ { "ESSO_Result": 0, "ESSO_ID": "7025e50b-f7a6-4f61-9012-4aa2a95733dd" }, { "ESSO_Result": 0, "ESSO_ID": "1736cb10-d746-4652-9e7a-22da35e43fec" }] } ] } } ] }

String. Required. Policy type.

Integer. Required. Operation result code.

String. Required. Target policy's ID.

Integer. Required. Operation result code.

String. Required. Target policy's ID.

The following table describes the parameters of the policy search request in XML format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Payload_Request=base64+url-encoded-payload&Operation=Search&ESSO_Payload_Type=application/XML

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

String. Required. Base64-encoded.

String. Required. Interface version.

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Types>SharingGroup;PasswordPolicy;
WebApplication</ESSO_Types>

<ESSO_RepositoryID>
3d8d102e-d31d-4223-9ddb-ef154e5f8c45
</ESSO_RepositoryID>

<ESSO_AttributeList>Description;FormType</ESSO_AttributeList>

<ESSO_Data>

<ESSO_PolicyFilters>

<ESSO_PolicyFilter>

<ESSO_Match_Type>Regex</ESSO_Match_Type>

<ESSO_Enumerated_List>URL
</ESSO_Enumerated_List>

<ESSO_Value>match-value</ESSO_Value>

<ESSO_PolicyType>WebApplication;PasswordList</ESSO_PolicyType>

<ESSO_Operation>OR</ESSO_Operation>

</ESSO_PolicyFilter>

Multiple requests supported.

String. Required. ALL | PolicyType1, PolicyType2 Types of application policies to return: WebApplication, WindowsApplication,MainFrameApplication, SSOProtected, Federated, PasswordPolicy

GUID. Optional. Administrators only. Repository ID of target policy.

String. Optional. ALL (Default) | Attribute List. Supports returning metadata subsets.

Optional. Only needed if applying filters.

String. Required. Regex | Wildcards | Match | Exact.

String. Required. Field(s) to match against.
URL | ESSO_Field. Multiple URLs in the application policy supported.

String. Required. Match value.

String. Optional. List of policy types. Overrides
ESSO_Types for this filter only.

String. Optional. AND | OR | NOT. Match operation to apply to the next field.

<ESSO_PolicyFilter>

<ESSO_Match_Type>Exact</ESSO_Match_Type>

<ESSO_Field>AT_ConfigType</ESSO_Field>

<ESSO_Value>match-value</ESSO_Value>

</ESSO_PolicyFilter>

</ESSO_PolicyFilters>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

String. Required. Regex | Wildcards | Match | Exact.

String. Required. Field(s) to match against.

String. Required. Match value.

The following table describes the parameters of the policy search response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple responses supported.

String. Required. Overall response result code.

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>PasswordPolicy</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
3458-fafcd-3829-adfe-4822
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>SharingGroup</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
e37c2142-41d7-48da-8d6d-bf4fdbc8f807</ESSO_ID>

String. Required. Policy type.

String. Required. Target policy's ID.

String. Required. Policy retrieval result code.

String. Required. Policy type.

String. Required. Target policy's ID.

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_ID>
1c81852e-4910-4a95-8f1c-77CSG</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

String. Required. Policy retrieval result code.

String. Required. Target policy's ID

2.2.2 Policy List

The policy list operation provides the ability to get a list of policies from the repository.

URI: /idass/am/esso/v1/app/policies
Method: GET
Category: User, Admin

The following table describes the parameters of the policy list request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Payload_Request=base64+url-encoded-payload&Operation=List&ESSO_Payload_Type=application/json

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": "1"}, "ESSO_Requests": { "ESSO_Request": { "ESSO_RepositoryID": "3d8d102e-d31d-4223-9ddb-ef154e5f8c45", "ESSO_AttributeList": "Description;FormType",
"ESSO_Data": { "ESSO_Policies": { "ESSO_PolicyType": [ { "name": "Federated", "ESSO_PolicyList": {

"ESSO_Policy": { "ESSO_ID": "56729f5b-9cde-4a3b-be01-9f5dff5fd7a1" } } }, { "name": "SharingGroup", "ESSO_PolicyList": {

"ESSO_Policy": [ {

"ESSO_ID": "635029a9-bc17-42d6-b973-3510b01c5e91"}, {

"ESSO_ID": "725029a9-bc17-42d6-b973-3510b01c5e91" }

] } } ] } } } } }

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

String. Administrator only. Target repository ID.

String. Optional. ALL (Default) | Attribute List. Supports returning metadata subsets.

Required.

String. Required. Policy type.

String. Optional. Allows policy retrieval by ID; if not specified, all policies of the selected type will be returned.

String. Optional. IDs of policies to return.

String. Required. Policy type.

String. Optional. Allows policy retrieval by ID; if not specified, all policies of the selected type will be returned.

String. Optional. IDs of policies to return.

The following table describes the parameters of the policy list response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Data": {

"ESSO_Policies": [ {

"ESSO_Result": 0,

"name": "Federated",

"ESSO_PolicyList": [ {

"ESSO_Result": 0,

"ESSO_ID": "cb4aac9d-0b03-485b-b34a-e9d40c69d611" } ] { },

"name": "SharingGroup",

"ESSO_PolicyList": [ {

"ESSO_Result": 0,

"ESSO_ID": "1736cb10-d746-4652-9e7a-22da35e43fec" }

] } ] } } ] }

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

String. Required. Policy type.

Integer. Required. Policy list operation result code.

String. Required. Target policy ID.

Integer. Required. Policy list operation result code.

String. Required. Target policy ID.

The following table describes the parameters of the policy list request in XML format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Payload_Request=base64+url-encoded-payload&Operation=List&ESSO_Payload_Type=application/XML

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_RepositoryID>
3d8d102e-d31d-4223-9ddb-ef154e5f8c45</ESSO_RepositoryID>

<ESSO_AttributeList>Description;FormType
</ESSO_AttributeList>

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>Federated</name>

String. Required. Base64-encoded.

String. Required. Interface version.

String. Optional. Administrator only. Target repository ID.

String. Optional. ALL (Default) | Attribute List. Supports returning metadata subsets.

String. Required. Policy type.

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
609e0d44-3815-4064-a204-7061b2be917f</ESSO_ID>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>PasswordPolicy</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
1c81852e-4910-4a95-8f1c-77CSG</ESSO_ID>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_ID>
11128fbf-6242-48ac-8714-2b2234a36e119</ESSO_ID>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

String. Optional. Allows policy retrieval by ID; if not specified, all policies of the selected type will be returned.

String. Optional. ID of policy to return.

String. Required. Policy type.

String. Optional. Allows policy retrieval by ID; if not specified, all policies of the selected type will be returned.

String. Optional. ID of policy to return.

The following table describes the parameters of the policy list response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>Federated</name>

<ESSO_PolicyList>

<ESSO_Policy>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple responses supported.

String. Required. Overall response result code.

String. Required. Policy type.

<ESSO_ID>
609e0d44-3815-4064-a204-7061b2be917f</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>PasswordPolicy</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
3458-fafcd-3829-adfe-4822</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

String. Required. Target policy ID.

String. Required. Policy list operation result code.

String. Required. Policy type.

String. Required. Target policy ID.

String. Required. Policy list operation result code.

</ESSO_Policy>

<ESSO_Policy>

<ESSO_ID>
fa0f3b29-9b74-49e3-a15a-2d5978ce3a31</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

String. Required. Target policy ID.

String. Required. Policy list operation result code.

2.2.3 Policy Add

The policy add operation provides the ability to add policies to the repository.

URI: /idass/am/esso/v1/app/policies
Method: POST

The following table describes the parameters of the policy add request in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": "1" },

"ESSO_Requests": {

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

"ESSO_RepositoryID": "3d8d102e-d31d-4223-9ddb-ef154e5f8c45", "ESSO_Data": { "ESSO_Policies": { "ESSO_PolicyType": [ { "name": "WebApplication", "ESSO_Policy": { } }, { "name": "SSOProtected", "ESSO_Policy": { } } ] } } } }

String. Optional. Administrator only. Target repository ID.

String. Required. Policy type.

String. Required. Policy data.

String. Required. Policy type.

String. Required. Policy data.

The following table describes the parameters of the policy add response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Data": {

"ESSO_Result": 0,

"ESSO_PolicyList": [ {

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

"ESSO_Identifier": "transient-identifier",

"ESSO_Result": 0,

"ESSO_ID": "312eab5d-62c9-4e9c-af31-8b6d18807526"

},{

"ESSO_Identifier": "transient-identifier",

"ESSO_Result": 0,

"ESSO_ID": "412eab5d-62c9-4e9c-af31-8b6d18807526" }

] } } ] }

String. Required. Unique transient identifier to match response data to the appropriate data in the request.

String. Required. Operation result code.

String. Required. ID of the added policy.

String. Required. Unique transient identifier to match response data to the appropriate data in the request.

String. Required. Operation result code.

String. Required. ID of the added policy.

The following table describes the parameters of the policy add request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_RepositoryID>
3d8d102e-d31d-4223-9ddb-ef154e5f8c45
</ESSO_RepositoryID>

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>WebApplication</name>

<ESSO_PolicyList>

<ESSO_Policy>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>PasswordPolicy</name>

<ESSO_PolicyList>

<ESSO_Policy>

</ESSO_Policy>

String. Required. Base64-encoded.

String. Required. Interface version.

String. Optional. Administrator only. Target repository ID.

String. Required. Policy type.

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

The following table describes the parameters of the policy add response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
4e02bfd2-a734-4ff4-a31a-8a6933417b3d</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0</ESSO_Identifier>

<ESSO_ID>
ca654a16-f638-462b-a2e9-5f30cd9cd59e</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0003</ESSO_Identifier>

<ESSO_ID>
4df7399c-e923-4d16-a2ad-e22fce680a05</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0</ESSO_Identifier>

<ESSO_ID>
626fc22a-d5ba-4221-83e7-a0908be616a1</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple responses supported.

String. Required. Overall response result code.

String. Required. Newly added policy's ID.

String. Required. Operation result code.

String. Required. Newly added policy's ID.

String. Required. Operation result code.

String. Required. Newly added policy's ID.

String. Required. Operation result code.

String. Required. Newly added policy's ID.

String. Required. Operation result code.

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

2.2.4 Policy Update

The policy update operation provides the ability to update policies in the repository.

URI: /idass/am/esso/v1/app/policies
Method: PUT

The following table describes the parameters of the policy update request in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": "1"}, "ESSO_Requests": { "ESSO_RepositoryID": "3d8d102e-d31d-4223-9ddb-ef154e5f8c45", "ESSO_Data": { "ESSO_Policies": { "ESSO_PolicyType": [ {

"name": "WebApplication",

"ESSO_Policy": {

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

String. Optional. Administrator only. Target repository ID.

String. Required. Policy type.

Policy data.

} }, {

"name": "SSOProtected",

"ESSO_Policy": {

} } ] } } } }

String. Required. Policy type.

Policy data.

The following table describes the parameters of the policy update response in JSON format.

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1},

"ESSO_Responses": [ {

"ESSO_Result": 0,

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

"ESSO_Data": {

"ESSO_PolicyList": [ {

"ESSO_Result": 0,

"ESSO_ID": "5529e0e0-435d-4ae3-a97b-66eb64e05499"},{

"ESSO_Result": 0,

"ESSO_ID": "6529e0e0-435d-4ae3-a97b-66eb64e05499"

} ] } } ] }

Integer. Required. Operation result code.

Target policy ID.

Integer. Required. Operation result code.

Target policy ID.

The following table describes the parameters of the policy update request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_RepositoryID>
3d8d102e-d31d-4223-9ddb-ef154e5f8c45
</ESSO_RepositoryID>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

String. Optional. Administrator only. Target repository ID.

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>WebApplication</name>

<ESSO_PolicyList>

<ESSO_Policy>

''

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>PasswordPolicy</name>

<ESSO_PolicyList>

<ESSO_Policy>

''

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests></ESSO>

String. Required. Policy type.

The following table describes the parameters of the policy update response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

String. Required. Base64-encoded.

Required.

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
4e02bfd2-a734-4ff4-a31a-8a6933417b3d
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0</ESSO_Identifier>

<ESSO_ID>
ca654a16-f638-462b-a2e9-5f30cd9cd59e
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0003</ESSO_Identifier>

<ESSO_ID>
4df7399c-e923-4d16-a2ad-e22fce680a05
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_Identifier>0</ESSO_Identifier>

<ESSO_ID>
626fc22a-d5ba-4221-83e7-a0908be616a1
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

String. Required. Interface version

Required. Multiple responses supported.

String. Required. Overall response result code.

String. Required. Target policy ID.

String. Required. Operation result code.

String. Required. Target policy ID.

String. Required. Operation result code.

String. Required. Target policy ID.

String. Required. Operation result code.

String. Required. Target policy ID.

String. Required. Operation result code.

2.2.5 Policy Delete

The policy delete operation provides the ability to delete policies from the repository.

URI: /idass/am/esso/v1/app/policies
Method: DELETE
Category: User, Admin

The following table describes the parameters of the policy delete request in JSON format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Request_Payload=base64+url-encoded-payload&ESSO_Payload_Type=application/json

Field

Description

{"Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": "1" },

"ESSO_Requests": {

"ESSO_Request": {

"ESSO_RepositoryID": "3d8d102e-d31d-4223-9ddb-ef154e5f8c45",

"ESSO_Data": {

"ESSO_Policies": {

"ESSO_Policy_Type": [ {

"name": "WebApplication",

"ESSO_PolicyList": {

"ESSO_Policy": [ {

"ESSO_ID": "3e8d102e-d31d-4223-9ddb-ef154e5f8c45"

}, ] } }, {

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

String. Optional. Administrator only. Target repository ID.

String. Required. Policy type.

String. Required. Target policy ID.

"name": "SSOProtected", "ESSO_PolicyList": { "ESSO_Policy": [ { "ESSO_ID": "78d102e-d31d-4223-9ddb-ef154e5f8c45" } ] } } ] } } } } }

String. Required. Policy type.

String. Required. Target policy ID.

The following table describes the parameters of the policy delete response in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Result": 0,

"ESSO_Data": {

"ESSO_PolicyList": [ {

"ESSO_Result": 0,

"ESSO_ID": "9e6285dc-0db6-432c-84fe-de4d6cc52b02"}, {

"ESSO_Result": 0,

"ESSO_ID":
"8e6285dc-0db6-432c-84fe-de4d6cc52b02"
} ] } } ] }

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

Integer. Required. Operation result code.

String. Required. Target policy ID.

Integer. Required. Operation result code.

String. Required. Target policy ID.

The following table describes the parameters of the policy delete request in XML format. An example request string looks as follows:

/idass/am/esso/v1/app/policies?ESSO_Request_Payload=base64+url-encoded-payload&ESSO_Payload_Type=application/xm

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_RepositoryID>
3d8d102e-d31d-4223-9ddb-ef154e5f8c45
</ESSO_RepositoryID>

<ESSO_Data>

<ESSO_Policies>

<ESSO_PolicyType>

<name>WebApplication</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
bcc6ac7f-7773-44e5-b952-a4ae3eec9515
</ESSO_ID>

</ESSO_Policy>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

String. Optional. Administrator only. Target repository ID.

String. Required. Policy type.

String. Required. Target policy ID.

<ESSO_Policy>

<ESSO_ID>
ab4f9632-4670-400b-9b5b-b9479c4a9e3f
</ESSO_ID>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

<ESSO_PolicyType>

<name>Federated</name>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
93d31e9c-e961-4457-a1dc-d1625ce659df
</ESSO_ID>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_PolicyType>

</ESSO_Policies>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests></ESSO>

String. Required. Target policy ID.

String. Required. Policy type.

String. Required. Target policy ID.

The following table describes the parameters of the policy delete response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Response>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

<ESSO_PolicyList>

<ESSO_Policy>

<ESSO_ID>
d384b40a-b3f9-41ea-9ef6-b06a5f907824
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

<ESSO_Policy>

<ESSO_ID>
93d31e9c-e961-4457-a1dc-d1625ce659df
</ESSO_ID>

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple responses supported.

String. Required. Overall response result code.

String. Required. Target policy ID.

String. Required. Operation result code.

String. Required. Target policy ID.

<ESSO_Result>0</ESSO_Result>

</ESSO_Policy>

</ESSO_PolicyList>

</ESSO_Data>

</ESSO_Response>

</ESSO_Responses>

</ESSO>

String. Required. Operation result code.

2.3 Provisioning Operations

This section describes the HTTP requests and responses for creating credential provisioning instructions that allow credential delegation, as well as revocation of existing delegations, via the Access Portal Service REST API. Request and response definitions in JSON and XML formats are described.

URI: /idass/am/esso/v1/userwallet/provisioining
Method: POST
Category: User, Admin

The following table describes the parameters of the provisioning instruction create request in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": "1" },

"ESSO_Requests": [ {

"ESSO_Data": {

"ESSO_Instructions": [

{

"ESSO_Identifier": "transient-identifier",

"ESSO_Type": "DELEGATE",

"ESSO_TargetUser": "target-username",

"ESSO_ExceutionTime": "DateTime" },

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple requests supported.

String. Required. Unique transient identifier to match the operation's response with its request.

String. Required. DELEGATE | REVOKE.
Provisioning operation type.

String. Required. Target user account ID.

String. Optional. Desired instruction execution time in the following format:
year:month:day hour:minute:second:millisecond.
If not specified, instruction is executed immediately.

{ "ESSO_Identifier": "transient-identifier",

"ESSO_Type": "REVOKE",

"ESSO_TargetUser": "target-username",

"ESSO_ExceutionTime": "DateTime" }

] } } ] }

String. Required. Unique transient identifier to match the operation's response with its request.

String. Required. DELEGATE | REVOKE.
Provisioning operation type.

String. Required. Target user account ID.

String. Optional. Desired instruction execution time in the following format:
year:month:day hour:minute:second:millisecond.
If not specified, instruction is executed immediately.

The following table describes the parameters of the provisioning instruction create response in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": 1 },

"ESSO_Responses": [ {

"ESSO_Result": 0,

"ESSO_Data": {

"ESSO_Instructions": [ {

"ESSO_ID": "{43041556-d7cd-4a10-b480-2d575f1e917e}",

"ESSO_Result": 0 }, {

"ESSO_ID": "{53041556-d7cd-4a10-b480-2d575f1e917e}",

"ESSO_Result": 0 }

} ] } } ] }

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

String. Optional. ID of newly created provisioning instruction. Present only if operation was successful.

String. Required. Operation result code.

String. Optional. ID of newly created provisioning instruction. Present only if operation was successful.

String. Required. Operation result code.

The following table describes the parameters of the provisioning instruction create request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Data>

<ESSO_Instructions>

<ESSO_Identifier>transient-identifier
</ESSO_Identifier>

<ESSO_Type>DELEGATE</ESSO_Type>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple requests supported.

String. Required. Unique transient identifier to match the operation's response data with its request data.

String. Required. DELEGATE | REVOKE
Provisioning operation type.

<ESSO_TargetUser>target-username
</ESSO_TargetUser>

<ESSO_ExecutionTime>DateTime
</ESSO_ExecutionTime>

</ESSO_Instructions>

<ESSO_Instructions>

<ESSO_Identifier>transient-identifier</ESSO_Identifier>

<ESSO_Type>REVOKE</ESSO_Type>

<ESSO_TargetUser>target-username
</ESSO_TargetUser>

<ESSO_ExecutionTime>DateTime
</ESSO_ExecutionTime>

</ESSO_Instructions>

</ESSO_Data>

</ESSO_Request>

</ESSO_Requests>

</ESSO>

String. Required. Target user account ID.

String. Optional. Desired instruction execution time in the following format:
year:month:day hour:minute:second:millisecond.
If not specified, instruction is executed immediately.

String. Required. Unique transient identifier to match the operation's response data with its request data.

String. Required. DELEGATE | REVOKE
Provisioning operation type.

String. Required. Target user account ID.

String. Optional. Desired instruction execution time in the following format:
year:month:day hour:minute:second:millisecond.
If not specified, instruction is executed immediately.

The following table describes the parameters of the provisioning instruction create response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

String. Required. Base64-encoded.

Integer. Required. Interface version.

</ESSO_General>

<ESSO_Responses>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data />

<ESSO_Instructions>

<ESSO_ID>
{53041556-d7cd-4a10-b480-2d575f1e917e}
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Instructions>

<ESSO_Instructions>

<ESSO_ID>
{73041556-d7cd-4a10-b480-2d575f1e917
</ESSO_ID>

<ESSO_Result>0</ESSO_Result>

</ESSO_Instructions>

</ESSO_Responses>

</ESSO>

Multiple responses supported.

Integer. Required. Overall response result code.

String. Optional. ID of newly created provisioning instruction. Present only if operation was successful.

Integer. Required. Operation result code.

String. Optional. ID of newly created provisioning instruction. Present only if operation was successful.

Integer. Required. Operation result code.

2.4 Event Operations

This section describes the HTTP requests and responses for adding events to the Access Portal Service's event log via the Access Portal Service REST API.
Request and response definitions in JSON and XML formats are described.

URI: //idass/am/esso/v1/audit/events
Method: POST
Category: User, Admin

The following table describes the parameters of the event add request in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash",

"ESSO_General": {

"ESSO_Version": "1" },

"ESSO_Requests": [ {

"ESSO_Data": {

"ESSO_Events": [ {

"data": {

} }, {

"data": {

} } ] } } ] }

String. Required. Base64-encoded.

String. Required. Interface version.

Multiple requests supported.

Required. Array of events to add.

Required. Data of event to add.

The following table describes the parameters of the event add response in JSON format.

Field

Description

{ "Context": "uu-encoded, salted SHA2-256 payload hash", "ESSO_General": { "ESSO_Version": 1 }, "ESSO_Responses": [ { "ESSO_Result": 0, "ESSO_Data": { "ESSO_Events": [ { "ESSO_ID": "{43041556-d7cd-4a10-b480-2d575f1e917e}", "ESSO_Result": 0 }, { "ESSO_ID": "{53041556-d7cd-4a10-b480-2d575f1e917e}", "ESSO_Result": 0 } ] } } ] }

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

String. Optional. ID of newly added event.
Present only if operation was successful.

Integer. Required. Operation result code.

String. Optional. ID of newly added event.
Present only if operation was successful.

Integer. Required. Operation result code.

The following table describes the parameters of the event add request in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Requests>

<ESSO_Request>

<ESSO_Data>

<ESSO_Events><ESSO_Event>

<ESSO_Identifier>transient-identifier
</ESSO_Identifier>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple requests supported.

String. Required. Unique transient identifier to match the operation's response data with its request data.

<data>

<! - event-data ->

</data>

</ESSO_Event>

<ESSO_Event />

<ESSO_Identifier>transient-identifier
</ESSO_Identifier>

<data>

<! - event-data ->

</data>

</ESSO_Events>

</ESSO_Data>

</ESSO_Request></ESSO_Requests></ESSO>

Event data.

String. Required. Unique transient identifier to match the operation's response data with its request data.

Event data.

The following table describes the parameters of the event add response in XML format.

Field

Description

<?xml version="1.0" encoding="UTF-8"?>

<ESSO>

<Context>uu-encoded, salted SHA2-256 payload hash</Context>

<ESSO_General>

<ESSO_Version>1</ESSO_Version>

</ESSO_General>

<ESSO_Responses>

<ESSO_Result>0</ESSO_Result>

<ESSO_Data>

String. Required. Base64-encoded.

Integer. Required. Interface version.

Multiple responses supported.

Integer. Required. Overall response result code.

<ESSO_Events>

<ESSO_Event>

<ESSO_Result>0</ESSO_Result>

<ESSO_ID>
{43041556-d7cd-4a10-b480-2d575f1e917e}
</ESSO_ID>

</ESSO_Event>

<ESSO_Event>

<ESSO_Result>0</ESSO_Result>

<ESSO_ID>
{53041556-d7cd-4a10-b480-2d575f1e917e}
</ESSO_ID>

</ESSO_Event>

</ESSO_Events>

</ESSO_Data>

</ESSO_Responses>

</ESSO>

Integer. Required. Operation result code.

String. Optional. ID of newly added event.
Only present if the operation was successful.

Integer. Required. Operation result code.

String. Optional. ID of newly added event.
Only present if the operation was successful.

Request/response format	Content-type value in header
XML	`application/XML`
JSON	`application/JSON`