/** * Agilicus API * Agilicus is API-first. Modern software is controlled by other software, is open, is available for you to use the way you want, securely, simply. The OpenAPI Specification in YAML format is available on [www](https://www.agilicus.com/www/api/agilicus-openapi.yaml) for importing to other tools. A rendered, online viewable and usable version of this specification is available at [api](https://www.agilicus.com/api). You may try the API inline directly in the web page. To do so, first obtain an Authentication Token (the simplest way is to install the Python SDK, and then run `agilicus-cli --issuer https://MYISSUER get-token`). You will need an org-id for most calls (and can obtain from `agilicus-cli --issuer https://MYISSUER list-orgs`). The `MYISSUER` will typically be `auth.MYDOMAIN`, and you will see it as you sign-in to the administrative UI. This API releases on Bearer-Token authentication. To obtain a valid bearer token you will need to Authenticate to an Issuer with OpenID Connect (a superset of OAUTH2). Your \"issuer\" will look like https://auth.MYDOMAIN. For example, when you signed-up, if you said \"use my own domain name\" and assigned a CNAME of cloud.example.com, then your issuer would be https://auth.cloud.example.com. If you selected \"use an Agilicus supplied domain name\", your issuer would look like https://auth.myorg.agilicus.cloud. For test purposes you can use our [Python SDK](https://pypi.org/project/agilicus/) and run `agilicus-cli --issuer https://auth.MYDOMAIN get-token`. This API may be used in any language runtime that supports OpenAPI 3.0, or, you may use our [Python SDK](https://pypi.org/project/agilicus/), our [Typescript SDK](https://www.npmjs.com/package/@agilicus/angular), or our [Golang SDK](https://git.agilicus.com/pub/sdk-go). 100% of the activities in our system our API-driven, from our web-admin, through our progressive web applications, to all internals: there is nothing that is not accessible. For more information, see [developer resources](https://www.agilicus.com/developer). * * The version of the OpenAPI document: 2025.12.16 * Contact: dev@agilicus.com * * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech). * https://openapi-generator.tech * Do not edit the class manually. */ import { AuthenticationAttribute } from './authenticationAttribute'; export interface _IssuerClient { /** * Unique identifier */ readonly id?: string; /** * Unique identifier */ readonly issuer_id?: string; /** * issuer client id */ name: string; /** * issuer client secret */ secret?: string; /** * application associated with client */ application?: string; /** * org_id associated with client */ org_id?: string; /** * List of organisation IDs which are allowed to authenticate using this client. If a user is not a member of one of these organisations, their authentication attempt will be denied. Note that this list intersects with `organisation_scope`. For example, if `organisation_scope` is `here-and-down` and this list contains two organisations below the current organisation, only those two will be allowed, despite there potentially being more sub organisations. If the list is empty, no restrictions are applied by this field. Note that other restrictions may be applied, such as by `organisation_scope`. */ restricted_organisations?: Array; /** * The Service Provider\'s metadata file required for the SAML protocol. */ saml_metadata_file?: string; /** * The properties from the agilicus id token to map to the user id. This can be changed if your application relies on an upstream user_id to map the user, for example SID or email. You can see what is available by logging into the admin portal and finding the token in local storage. When changing this ensure that you are requesting an appropriate saml_scope. For example in order to use federated_claims you need the federated:id scope. */ id_mapping?: Array; /** * The set of scopes to request for the agilicus oidc token when mapping to saml. */ saml_scopes?: Array; /** * How to limit which organisations are allowed to authenticate using this client. Note that this interacts with `restricted_organisations`: that list, if not empty, further limits the allowed organisations. * `any` indicates that there are no restrictions. All organisations served by the issuer will be allowed to log in using this client. * `here-only` indicates that only the organisation referenced by `org_id` may be used. * `here-and-down` indicates that the organisation referenced by `org_id` and its children may be used. */ organisation_scope?: IssuerClient.OrganisationScopeEnum; /** * List of redirect uris */ redirects?: Array; /** * When to present an mfa challenge to a user upon login. If the system determines that an MFA challenge is required, and the user does not yet have a authenticatin mechanism valid for this login session, the user will be presented with the option to enrol a new mechanism. * `always` means that the user will always be required to validate against a second factor. * `user_preference` means that the whether the user is required to validate depends on the user\'s preferences. A user could choose to always require MFA for their logins, or they could decide not to. Note that in this case, other policy could override the preference to force the user to authenticate with MFA even if the user indicated that they prefer not to. * `trust_upstream` means to always perform MFA, but that the upstream IDP will be trusted to have performed MFA if the upstream indicates that it has done so. Otherwise, MFA will be performed by the system after the upstream returns the to Issuer. */ mfa_challenge?: IssuerClient.MfaChallengeEnum; /** * Whether a client is allowed to use single sign-on * `user_preference` means that the user will have the option to \'remember\' their upstream identity selection for single sign-on. * `never` means that the given client will not allow single sign-on. The user will be required to present credentials for each login to applications with this client id. */ single_sign_on?: IssuerClient.SingleSignOnEnum; /** * A list of attributes to derive from information about the user. The user\'s information returned to the relying party making a request using this client will be extended with these attributes. Only one attribute for a given `attribute_name` can exist per-client at a time. Add an attribute to this list when the default attributes do not provide sufficient information for the client application, or for when the client application expects the attributes to be named differently. */ attributes?: Array; } export interface IssuerClient extends _IssuerClient { _builtin_original?: _IssuerClient; _remove_builtin_extensions?: () => void; } export declare class IssuerClientImpl implements _IssuerClient { _builtin_original?: _IssuerClient; readonly id: string | undefined; readonly issuer_id: string | undefined; name: string; secret: string | undefined; application: string | undefined; org_id: string | undefined; restricted_organisations: Array | undefined; saml_metadata_file: string | undefined; id_mapping: Array | undefined; saml_scopes: Array | undefined; organisation_scope: IssuerClient.OrganisationScopeEnum | undefined; redirects: Array | undefined; mfa_challenge: IssuerClient.MfaChallengeEnum | undefined; single_sign_on: IssuerClient.SingleSignOnEnum | undefined; attributes: Array | undefined; constructor(base: _IssuerClient); _remove_builtin_extensions(): void; } export declare namespace IssuerClient { type OrganisationScopeEnum = 'any' | 'here_and_down' | 'here_only'; const OrganisationScopeEnum: { any: OrganisationScopeEnum; here_and_down: OrganisationScopeEnum; here_only: OrganisationScopeEnum; }; type MfaChallengeEnum = 'always' | 'user_preference' | 'trust_upstream'; const MfaChallengeEnum: { always: MfaChallengeEnum; user_preference: MfaChallengeEnum; trust_upstream: MfaChallengeEnum; }; type SingleSignOnEnum = 'user_preference' | 'never'; const SingleSignOnEnum: { user_preference: SingleSignOnEnum; never: SingleSignOnEnum; }; } export declare function newIssuerClientImpl(base: _IssuerClient): IssuerClientImpl;