OneWelcome APIs overview

OneWelcome APIs Overview

Domain/ API: Client RegistrationAPI

Used to register OAuth and OIDC client applications.

OperationDescriptionLogical Endpoint Name [1]MethodEndpoint Path
Create an OAuth/OIDC clientregistration_endpointPOST/auth/oauth2.0/v1/connect/register
Obtain details for an OAuth/OIDC clientregistration_endpointGET/auth/oauth2.0/v1/connect/register
Unregister an OAuth/OIDC clientregistration_endpointDELETE/auth/oauth2.0/v1/connect/register/{client_id}
Proprietary administration endpoint to unregister an OAuth/OIDC clientclients_endpointDELETE/auth/oauth2.0/v1/connect/clients/{client_id}

Domain/ API: ConsentAPI

Manages consents given by user on documents & processing purposes.

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Retrieve documentsdocuments_endpointsGET/consent/v1/documents
View document consent per userdocument_consents endpointGET/consent/v1/document-consents
Give document consent per userdocument_consents_ endpointPOST/consent/v1/document-consents
Revoke document consent per userdocument_consents_ endpointDELETE/consent/v1/document-consents
Retrieve processing purposesprocessing_purposes_ endpointGET/consent/v1/processing-purposes
View attribute consent per userattribute_consents_ endpointGET/consent/v1/attribute-consents
Give attribute consent per userattribute_consents_ endpointPOST/consent/v1/attribute-consents
Revoke attribute consent per userattribute_consents_ endpointDELETE/consent/v1/attribute-consents

Domain/ API: Session ManagementAPI

Controls session servers for an account (but for session creation done via authentication API, SSO).

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Terminate session (logout)terminate_session endpointGET/login/terminate_session

Domain/ API: OAuth/OIDCAPI

Allows applications to delegate authentication & authorisation towards OneWelcome and get SSO (as per OAuth/OIDC specs).

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Obtain OAuth authorization/OIDC authenticationauthorize_endpointGET/auth/oauth2.0/v1/authorize
Obtain OAuth access tokentoken_endpointPOST/auth/oauth2.0/v1/token
Device authorization requestdevice_authorization endpointPOST/auth/oauth2.0/v1/device/code
Device authorization decision endpointdevice_authorization decision_endpointPOST/auth/oauth2.0/v1/device/user
Endpoint to determine the active state and meta-information of an OAuth tokenintrospection_endpointPOST/auth/oauth2.0/v1/introspect
Endpoint to obtain claims about the authenticated end-useruserinfo_endpointGET/auth/oauth2.0/v1/userinfo
Deprecated endpoint to obtain information about and OAuth token and the authenticated End-Usertoken_info_ endpointGET/auth/oauth2.0/v1/token-info

Domain/ API: EventAPI

Used to access events generated by__OneWelcome__.

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Obtain eventsevents_endpointGET/event-api/v2/events
Submit eventsevents_endpointPOST/event-api/v2/events

Domain/ API: NotificationAPI

Notifies external systems of changes in users' consents

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Subscribe to notifications for a single resource typenotification_subscription endpointPOST/notification/v1/subscriptions
Get the details of a subscriptionnotification_subscription endpointGET/notification/v1/subscriptions/{id}
Unsubscribe from notificationsnotification_subscription endpointDELETE/notification/v1/subscriptions/{id}
Retrieve a set of notifications of a subscription with a subscription_idnotification_endpointGET/notification/v1/subscriptions/{id}/notifications

Domain/ API: CredentialAPI

Manages user's credentials (e.g. password, email, phone number).

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Request to make an email address the user's primary emailprimary_email request_endpointPOST/credential/v1/primary-email-request
Endpoint to confirm a user's email addressprimary_email confirmation_endpointPOST/credential/v1/primary-email-confirmation
Unprotected endpoint to confirm a user's email address without authenticating the end userpublic_primary email_confirmation_endpointPOST/credential/v1/public/primary-email-confirmation
Request to make a phone number primaryprimary_phone number_request_endpointPOST​/credential​/v1​/primary-phone-number-request
Change & confirm a user's phone numberprimary_phone number_confirmation_endpointPOST/credential/v1/primary-phone-number-confirmation
Obtain information about the user's passwordmetadata_endpointGET​/credential​/v1​/users​/{user_id}​/password​/metadata
Change password for provided userIDpassword_endpointPUT/credential/v1/users/{user_id}/password

Domain/ API: SAML

Allows applications to delegate authentication to__OneWelcome__and get SSO.

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Web SSO redirectsso_httpredirect endpointGET/auth/saml2.0/v1/SSORedirect/metaAlias/<Brand>
Web SSO postsso_httppost endpointPOST/auth/saml2.0/v1/SSOPOST/metaAlias/<Brand>
Web IDP SLO redirectslo_httpredirect endpointGET/auth/saml2.0/v1/IDPSloRedirect/metaAlias/<Brand>
Web IDP SLO postslo_httppost endpointPOST/auth/saml2.0/v1/IDPSloPOST/metaAlias/<Brand>

Domain/ API: SCIM

Provisions users to__OneWelcome__from a source user repository (users can be created as active or inactive).

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
Create a userSCIM_users endpointPOST

/scim/Users

/scim/v1/Users

Full update of a userSCIM_users endpointPUT

/scim/Users/{userId}

/scim/v1/Users/{userId}

Partial update of a userSCIM_users endpointPATCH

/scim/Users/{userId}

/scim/v1/Users/{userId}

Retrieve a known userSCIM_users endpointGET

/scim/Users/{userId}

/scim/v1/Users/{userId}

Query usersSCIM_users endpointGET

/scim/Users

/scim/v1/Users

Delete a userSCIM_users endpointDELETE

/scim/Users/{userId}

/scim/v1/Users/{userId}

Create a user in employee segmentSCIM_employees endpointPOST/employees/scim/v1/Users
Full update of a user in employee segmentSCIM_employees endpointPUT/employees/scim/v1/Users/{userId}
Partial update of a user in employee segmentSCIM_employees endpointPATCH/employees/scim/v1/Users/{userId}
Retrieve a known user in employee segmentSCIM_employees endpointGET/employees/scim/v1/Users/{userId}
Query users in employee segmentSCIM_employees endpointGET/employees/scim/v1/Users
Delete a user in employee segmentSCIM_employees endpointDELETE/employees/scim/v1/Users/{userId}

Domain/ API: Reverse Look-UpAPI

Used to look-up user(s) at an external look-up service (the URL for this endpoint is configurable in__OneWelcome__).

Operation DescriptionLogical Endpoint Name [1]MethodEndpoint Path
OneWelcome request to user look-up serviceuser_look up_endpointPOSTendpoint not hosted by OneWelcome

[1] Logical endpoint name as defined for endpoint discovery.

Convention: "xxx_endpoint" indicates it's a web-api

  Last updated by Stein Welberg