Management API v2
Current Version
This is the current and recommended version of the Management API. For the deprecated v1 API, see Management API v1.
The Management API v2 follows a CQRS-lite pattern with typed command DTOs for create, update, and patch operations. The generated .NET client also uses typed identifiers such as ClientAppId, SubscriptionId, and TenantId, while the HTTP API still uses UUID strings in paths and JSON payloads.
For cross-cutting behavior that is easier to explain outside the generated endpoint reference, see:
Option Metadata Editor Hints
OptionMetadata exposes additive v2 metadata for configuration editors:
| Field | Description |
|---|---|
dataType | Describes the stored option value semantics. Existing pre-v3 options default to String; new v3 options use more specific values such as Boolean, Integer, TimeSpan, or CommaSeparatedString. |
editorType | Provides a UI hint for editors. Existing pre-v3 options default to Text; new v3 options use hints such as Checkbox, Number, Duration, or Tags. |
These fields are hints only. Option values are still stored as strings, and existing validation/runtime parsing remains authoritative.
Option Target Scope
Each Option belongs to exactly one IDP instance, MFA instance, or tenant. Create commands must therefore set exactly one of applyToIdpInstanceId, applyToMfaInstanceId, or applyToTenantId.
V2 PUT and PATCH commands support changing that target. Assigning one target clears the other two target fields. Commands that assign conflicting targets are rejected. For compatibility with V2 clients generated before these fields were added to the update contract, a PUT command that omits all three target fields retains the current target. PATCH follows normal explicit-field semantics: omitted fields are unchanged, while assigning a new target clears incompatible targets.
User Questionnaire Validation
ProAuthUserQuestionnaireItem supports v2-only validation metadata for profile and MFA detail collection during login:
| Field | Description |
|---|---|
isRequired | Indicates whether a submitted value is mandatory. New and migrated items default to true. Optional items may be blank, but the item id must still be included in the submission. |
minLength / maxLength | Optional string length constraints. minLength must be less than or equal to maxLength. |
validationFormat | Built-in format validation. Supported values are None, Email, PhoneE164, and Regex. |
validationPattern | Required when validationFormat is Regex; otherwise it is ignored. Invalid regular expressions are rejected when the item is configured. |
PhoneE164 is intentionally strict and accepts only numbers matching ^\+[1-9]\d{1,14}$, for example +41791234567.
Client App Key Sets
ClientAppKeySet is the v2 resource for client-owned key material used by ProAuth v3 security features. Use it instead of embedding public keys in feature-specific configuration objects.
Key sets are owned by a client application and are used for:
private_key_jwtclient assertion signing keys- JAR request-object signing keys
self_signed_tls_client_authcertificate public keys- token, UserInfo, ID token, and JWT introspection response encryption keys
Runtime key resolution uses key sets whose status is Active or Retiring and whose validity window is current. See Client App Key Sets for configuration guidance, source types, rotation patterns, and YAML examples.
GetApplicationGroupsByTenant
Responses
OK
GetApplicationGroupsByIdpInstance
Responses
OK
GetApplicationGroup
Responses
OK
GetApplicationGroups
Responses
OK
GetApplicationUsersByTenant
Responses
OK
GetApplicationUsersByIdpInstance
Responses
OK
GetApplicationUser
Responses
OK
GetApplicationUsers
Responses
OK
CertStore
Operations
GetCertStores
Responses
OK
CreateCertStore
Request Body
Responses
Created
UpdateCertStoreBatch
Request Body
Responses
OK
CreateCertStoreBatch
Request Body
Responses
OK
DeleteCertStoreBatch
GetCertStore
Responses
OK
UpdateCertStore
Request Body
Responses
Accepted
PatchCertStore
Request Body
Responses
Accepted
GetAllByType
Responses
OK
GetAllByAppliedSubscriptionId
Responses
OK
GetAllByAppliedTenantId
Responses
OK
GetAllByInstance
Responses
OK
SetCertStoreIdpInstances
Request Body
Responses
Accepted
AddCertStoreIdpInstance
Request Body
Responses
Accepted
RemoveCertStoreIdpInstance
Request Body
Responses
Accepted
ClaimRule
Operations
GetClaimRules
Responses
OK
CreateClaimRule
Request Body
Responses
Created
UpdateClaimRuleBatch
Request Body
Responses
OK
CreateClaimRuleBatch
Request Body
Responses
OK
DeleteClaimRuleBatch
GetClaimRule
Responses
OK
UpdateClaimRule
Request Body
Responses
Accepted
PatchClaimRule
Request Body
Responses
Accepted
SetClaimRuleClientApps
Request Body
Responses
Accepted
AddClaimRuleClientApp
Request Body
Responses
Accepted
RemoveClaimRuleClientApp
Request Body
Responses
Accepted
ClientAppAuthenticationConfiguration
Operations
GetClientAppAuthenticationConfigurations
Responses
OK
CreateClientAppAuthenticationConfiguration
Request Body
Responses
Created
GetClientAppAuthenticationConfiguration
Responses
OK
UpdateClientAppAuthenticationConfiguration
Request Body
Responses
Accepted
DeleteClientAppAuthenticationConfiguration
Responses
No Content
PatchClientAppAuthenticationConfiguration
Request Body
Responses
Accepted
UpdateClientAppAuthenticationConfigurations
Request Body
Responses
OK
CreateClientAppAuthenticationConfigurations
Request Body
Responses
OK
DeleteClientAppAuthenticationConfigurations
ClientApp
Operations
GetClientApps
Responses
OK
CreateClientApp
Request Body
Responses
Created
UpdateClientAppBatch
Request Body
Responses
OK
CreateClientAppBatch
Request Body
Responses
OK
DeleteClientAppBatch
GetClientApp
Responses
OK
UpdateClientApp
Request Body
Responses
Accepted
PatchClientApp
Request Body
Responses
Accepted
GetClientAppsBySubscriptionId
Responses
OK
SetTenants
Request Body
Responses
Accepted
AddTenant
Request Body
Responses
Accepted
RemoveTenant
Request Body
Responses
Accepted
SetClientAppIdpInstances
Request Body
Responses
Accepted
AddClientAppIdpInstance
Request Body
Responses
Accepted
RemoveClientAppIdpInstance
Request Body
Responses
Accepted
SetClientAppMfaInstances
Request Body
Responses
Accepted
AddClientAppMfaInstance
Request Body
Responses
Accepted
RemoveClientAppMfaInstance
Request Body
Responses
Accepted
SetClaimRules
Request Body
Responses
Accepted
AddClaimRule
Request Body
Responses
Accepted
RemoveClaimRule
Request Body
Responses
Accepted
SetAllowedTokenExchangeClientApps
Request Body
Responses
Accepted
AddAllowedTokenExchangeClientApp
Request Body
Responses
Accepted
RemoveAllowedTokenExchangeClientApp
Request Body
Responses
Accepted
SetAuthorizedProAuthGroups
Request Body
Responses
Accepted
AddAuthorizedProAuthGroup
Request Body
Responses
Accepted
RemoveAuthorizedProAuthGroup
Request Body
Responses
Accepted
SetAuthorizedProAuthUsers
Request Body
Responses
Accepted
AddAuthorizedProAuthUser
Request Body
Responses
Accepted
RemoveAuthorizedProAuthUser
Request Body
Responses
Accepted
ClientAppFederatedConfiguration
Operations
GetClientAppFederatedConfigurations
Responses
OK
CreateClientAppFederatedConfiguration
Request Body
Responses
Created
UpdateClientAppFederatedConfigurationBatch
CreateClientAppFederatedConfigurationBatch
DeleteClientAppFederatedConfigurationBatch
GetClientAppFederatedConfiguration
Responses
OK
UpdateClientAppFederatedConfiguration
Request Body
Responses
Accepted
DeleteClientAppFederatedConfiguration
Responses
No Content
PatchClientAppFederatedConfiguration
Request Body
Responses
Accepted
GetClientAppFederatedConfigurationsByClientAppId
Responses
OK
ClientAppKeySet
Operations
GetByClientAppId
Responses
OK
GetClientAppKeySets
Responses
OK
CreateClientAppKeySet
Request Body
Responses
Created
GetClientAppKeySet
Responses
OK
UpdateClientAppKeySet
Request Body
Responses
Accepted
PatchClientAppKeySet
Request Body
Responses
Accepted
UpdateClientAppKeySets
Request Body
Responses
OK
CreateClientAppKeySets
Request Body
Responses
OK
DeleteClientAppKeySets
ClientAppMetadata
Operations
GetClientAppMetadataByClientAppId
Responses
OK
CreateClientAppMetadata
GetClientAppMetadata
Responses
OK
UpdateClientAppMetadata
DeleteClientAppMetadata
Responses
Bad Request
PatchClientAppMetadata
ClientAppRedirectUri
Operations
GetClientAppRedirectUris
Responses
OK
CreateClientAppRedirectUri
Request Body
Responses
Created
UpdateClientAppRedirectUriBatch
CreateClientAppRedirectUriBatch
DeleteClientAppRedirectUriBatch
GetClientAppRedirectUri
Responses
OK
UpdateClientAppRedirectUri
Request Body
Responses
Accepted
DeleteClientAppRedirectUri
Responses
No Content
PatchClientAppRedirectUri
Request Body
Responses
Accepted
GetClientAppRedirectUrisByClientAppId
Responses
OK
ClientAppRequestUri
Operations
GetClientAppRequestUriByClientAppId
Responses
OK
GetClientAppRequestUris
Responses
OK
CreateClientAppRequestUri
GetClientAppRequestUri
Responses
OK
UpdateClientAppRequestUri
PatchClientAppRequestUri
UpdateClientAppRequestUris
CreateClientAppRequestUris
DeleteClientAppRequestUris
ClientAppResource
Operations
GetClientAppResources
Responses
OK
CreateClientAppResource
Request Body
Responses
Created
UpdateClientAppResourceBatch
CreateClientAppResourceBatch
DeleteClientAppResourceBatch
GetClientAppResource
Responses
OK
UpdateClientAppResource
Request Body
Responses
Accepted
PatchClientAppResource
Request Body
Responses
Accepted
GetClientAppResourcesByClientAppId
Responses
OK
ClientAppRole
Operations
GetClientAppRoles
Responses
OK
CreateClientAppRole
Request Body
Responses
Created
UpdateClientAppRoleBatch
CreateClientAppRoleBatch
DeleteClientAppRoleBatch
GetClientAppRole
Responses
OK
UpdateClientAppRole
Request Body
Responses
Accepted
PatchClientAppRole
Request Body
Responses
Accepted
GetClientAppRolesByClientAppId
Responses
OK
ClientAppScope
Operations
GetClientAppScopes
Responses
OK
CreateClientAppScope
Request Body
Responses
Created
UpdateClientAppScopeBatch
CreateClientAppScopeBatch
DeleteClientAppScopeBatch
GetClientAppScope
Responses
OK
UpdateClientAppScope
Request Body
Responses
Accepted
PatchClientAppScope
Request Body
Responses
Accepted
GetClientAppScopesByClientAppId
Responses
OK
ClientAppSecret
Operations
GetClientAppSecrets
Responses
OK
CreateClientAppSecret
Request Body
Responses
Created
UpdateClientAppSecretBatch
CreateClientAppSecretBatch
DeleteClientAppSecretBatch
GetClientAppSecret
Responses
OK
UpdateClientAppSecret
Request Body
Responses
Accepted
PatchClientAppSecret
Request Body
Responses
Accepted
GetClientAppSecretsByClientAppId
Responses
OK
CustomAsset
Operations
GetCustomAsset
Responses
OK
UpdateCustomAsset
Request Body
Responses
Accepted
PatchCustomAsset
Request Body
Responses
Accepted
GetCustomAssets
Responses
OK
CreateCustomAsset
Request Body
Responses
Created
UpdateCustomAssetBatch
CreateCustomAssetBatch
DeleteCustomAssetBatch
CreateCustomAssetByExpander
Request Body
Responses
Created
GetSupportedMimetypes
Responses
OK
Customer
Operations
GetCustomers
Responses
OK
CreateCustomer
UpdateCustomerBatch
CreateCustomerBatch
DeleteCustomerBatch
GetCustomer
Responses
OK
UpdateCustomer
Request Body
Responses
Accepted
PatchCustomer
CustomView
Operations
GetCustomView
Responses
OK
UpdateCustomView
PatchCustomView
GetCustomViews
Responses
OK
CreateCustomView
UpdateCustomViewBatch
CreateCustomViewBatch
DeleteBatch
CreateCustomViewFromTemplate
Request Body
Responses
Created
GetAllTemplateViews
Responses
OK
GetTemplateViewContent
Responses
OK
GetForUser
Responses
OK
GetForGroup
Responses
OK
GetForClientApp
Responses
OK
IdpInstance
Operations
GetIdpInstances
Responses
OK
CreateIdpInstance
Request Body
Responses
Created
UpdateIdpInstanceBatch
Request Body
Responses
OK
CreateIdpInstanceBatch
Request Body
Responses
OK
DeleteIdpInstanceBatch
GetIdpInstance
Responses
OK
UpdateIdpInstance
Request Body
Responses
Accepted
PatchIdpInstance
Request Body
Responses
Accepted
GetIdpInstancesByTenantAndClientApp
Responses
OK
GetIdpInstancesByTenantId
Responses
OK
GetIdpInstancesBySubscription
Responses
OK
GenerateScimToken
Responses
Bad Request
GetHealthStatus
Responses
OK
SetIdpInstanceTenants
Request Body
Responses
Accepted
AddIdpInstanceTenant
Request Body
Responses
Accepted
RemoveIdpInstanceTenant
Request Body
Responses
Accepted
SetCertStores
Request Body
Responses
Accepted
AddCertStore
Request Body
Responses
Accepted
RemoveCertStore
Request Body
Responses
Accepted
SetIdpInstanceClientApps
Request Body
Responses
Accepted
AddIdpInstanceClientApp
Request Body
Responses
Accepted
RemoveIdpInstanceClientApp
Request Body
Responses
Accepted
SetIdpInstanceMfaInstances
Request Body
Responses
Accepted
AddIdpInstanceMfaInstance
Request Body
Responses
Accepted