This document summarizes all changes made to Identify REST API for version 5.13.

Audit log endpoint

The AuditUserCreated and AuditUserUpdated models have a new author attribute which contains name of the user who caused those events to happen.

• Affected operations: GET /auditlogs/auditusercreated, GET /auditlogs/audituserupdated.
• Behavior: the returned object has the new author attribute.

There are also new endpoints to get audit data:

• AuditCorrelationError: GET /auditlogs/auditcorrelationerror
• AuditAuthenticationContextMethodClass: GET /auditlogs/auditauthenticationcontextmethodclass
• AuditAttributeServiceConnection: GET /auditlogs/auditattributeserviceconnection
• AuditPersistentPseudonym: GET /auditlogs/auditpersistentpseudonym
• AuditApprovedConsent: GET /auditlogs/auditapprovedconsent

Claim definition endpoint

The ClaimDefinition model has a new newClaimType attribute:

• Affected operations: PUT /claimsdefinitions. Other operations do not use the new attribute.
• Behavior: when the newClaimType attribute has a value, it will replace the value of claimType attribute after the PUT operation is executed successfully.

Connections endpoint

The Connection model has a new newName attribute:

• Affected operations: PUT /connections. Other operations do not use the new attribute.
• Behavior: when the newName attribute has a value, it will replace the value of name attribute after the PUT operation is executed successfully.

The OAuth protocol connection configuration section model has a new updateAccessTokenClaimsOnRefresh attribute:

• Affected operations: POST /connections, PUT /connections.
• Behavior: When the value of updateAccessTokenClaimsOnRefresh attribute is not specify then its default value is false. A false value causes no changes in access token's claims when a client uses a refresh token to exchange for an access token which ensures backward compatibility. You can refer to the Release note 5.13 for more information about the new Update user claims on access token when calling the token endpoint with a refresh token feature.

The OTP authentication connection configuration section model has a new enableRegisterWebAuthnFromMyProfile attribute. Its useAsSecondFactorOnly attribute now can be set to false in some circumstances:

• Affected operations: POST /connections, PUT /connections.

• Behavior (apply to the OTP connection only):

  Name	Description
  useAsSecondFactorOnly	For OTP connections, the default value is true and this attribute can only be set to false when the value of the orderOfFactors attribute is WebAuthn only. For other types of authentication connections, the default value is false
  enableRegisterWebAuthnFromMyProfile	When the value of the orderOfFactors attribute contains the WebAuthn method, you can set this attribute to either true or false. Otherwise, REST API will always reset the attribute to false no matter what value you set it in your REST API's request.

Organization endpoint

• The organization model has a new newName attribute:

  { "displayName": "string", "name": "string", "accessOrganizationName": "string", "passwordExpiryDays": 0, "expiryDisallowLoginDays": 0, "minimumPasswordAge": 0, "forceResetPasswordDefaultValue": true, "id": "string", "description": "string", "newName": "string" (*) }

  1 2 3 4 5 6 7 8 9 10 11 12

  {     "displayName": "string",     "name": "string",     "accessOrganizationName": "string",     "passwordExpiryDays": 0,     "expiryDisallowLoginDays": 0,     "minimumPasswordAge": 0,     "forceResetPasswordDefaultValue": true,     "id": "string",     "description": "string",     "newName": "string" (*) }

• Affected operations: PUT /organizations. Other operations do not use the new attribute.

• Behavior: when the newName attribute has a value, it will replace the value of name attribute after the PUT operation is executed successfully.

Group endpoint

• The Group model has a new newName attribute:

  { "accessOrganizationName": "", "claimValues": [ { "claimType": "", "value": "" } ], "name": "", "newName": "", (*) "description": "", }

  1 2 3 4 5 6 7 8 9 10 11 12

  {     "accessOrganizationName": "",     "claimValues": [         {         "claimType": "",         "value": ""         }     ],     "name": "",     "newName": "", (*)     "description": "", }

• Affected operations: PUT /groups. Other operations do not use the new attribute.

• Behavior: when the newName attribute has a value, it will replace the value of name attribute after the PUT operation is executed successfully.

Claim transformation endpoint

The ClaimTransformation model has a new newName attribute:

• Affected operations: PUT /transformations. Other operations do not use the new attribute.
• Behavior: when the newName attribute has a value, it will replace the value of name attribute after the PUT operation is executed successfully.

UserStatus endpoint

The user status model has a new userId attribute:

• Affected operations: PUT /users/.batchStatus.
• Behavior: when the userId attribute has a value, REST API will use the id (instead of the identityClaim) to find a user and update its status.

Certificate endpoint

The certificate model has a new isExpired and willExpireInTheNext90Days attributes:

• Affected operations: GET /certificate, GET /certificate/{thumbprint}.

• Behavior:

  Name	Description
  isExpired	Specify whether a certificate is expired.
  willExpireInTheNext90Days	Specify whether a certificate will expire in the next 90 days.

Users endpoint

Remove the obsolete API: GET /users/webauthns

The Authenticator model has a new secondFactorConnectionDescription attribute:

• Affected operations: GET /users/authenticators.

• Behavior: return the description text of a second factor connection. If the description is configured in multiple languages, normal browser-language and fallback rules apply.

  

  

System Setup endpoint

Name	Description
secondarySigningCertificate	The secondary Signing certificate is used to rollover the current signing certificate at a specific time in future.
promoteSecondaryCertificateToPrimaryAt	Specifies the specific time stamp (UTC) when Identify will promote the secondary certificate to be the primary one.
secondaryCertificateRetentionDays	Specifies the number of days that Identify needs to retain the demoted secondary certificate.
signingCertificateRolloverCron	The cron expression to schedule the background job to promote the secondary certificate. The quick and simple editor for cron schedule expressions can be found at https://crontab.guru/examples.html.
secondaryAzureKeyVault	The Azure key vault details data to connect to Azure Key Vault service for the secondary signing certificate..
userSelfServiceSettings.canResetPassword	Specifies that user can change the password on IdentifyMe application.
userSelfServiceSettings.canEditDisplayName	Users can edit their display names on the IdentifyMe application.
userSelfServiceSettings.canEditUserCertificate	Users can edit their certificates on the IdentifyMe application.
userSelfServiceSettings.canManageWebAuthn	Users can reset or register their WebAuthn authenticators on the IdentifyMe application.
userSelfServiceSettings.canManageTOTPAuthenticator	Users can reset or register their TOTP authenticators on the IdentifyMe application.
userSelfServiceSettings.canEditUserProfile	Users can access their profile pages on the IdentifyMe application. Whether they can edit display names and claims on the profile page depends on other settings.

New UniqueFreeUserClaimValue endpoints

Those endpoints allows you to manage constraints that ensures uniqueness of values of a free claim definition at the database layer.

• POST /uniquefreeuserclaimvalues: create a new free claim definition constraint by claimType.
• GET /uniquefreeuserclaimvalues: retrieve all free claim definition constraints.
• DELETE /uniquefreeuserclaimvalues: delete all free claim definition constraints.
• DELETE /uniquefreeuserclaimvalues/{claimType}: delete a free claim definition constraint by claimType.