Admin API: Flow
Operations on flow in the Odudu admin API, one section each. Every request carries a bearer token; the index says which audience it needs and how a refusal is shaped.
GET /admin/tenants/{tenant}/flow/executions
Requires the "manage-tenant" capability.
Answers the steps in order, and available: every authenticator name a step may name, from the registry a login dispatches through. The ETag covers the steps alone.
Path parameters
| Name | Type | Required | Details |
|---|---|---|---|
tenant | string | yes | The tenant being administered, addressed by name. |
Responses
200 OK
Body: application/json
| Field | Type | Required | Details |
|---|---|---|---|
items | array of object | yes | The tenant’s sign-in flow, in the order the steps run. |
items[] | object | yes | |
items[].index | integer | yes | The step’s position, counted from 0. Constraints: at least 0. |
items[].authenticator | string | yes | The sign-in step this entry runs, one of available. |
items[].requirement | string | yes | required always runs, alternative is one of several of which one suffices, conditional runs only when it applies to the user, disabled is skipped. Constraints: one of required, alternative, conditional, disabled. |
available | array of string | yes | Every authenticator a step may name. |
401 RFC 9457 problem details
Body: application/problem+json, an RFC 9457 problem document described under problem details.
403 RFC 9457 problem details
Body: application/problem+json, an RFC 9457 problem document described under problem details.
PUT /admin/tenants/{tenant}/flow/executions
Requires the "manage-tenant" capability.
Refused with 400, each of its own type: an empty list (about:blank#flow-empty), a list where every step is disabled (#flow-no-enabled-step), a list nothing in which can start a login (#flow-no-first-challenge), an authenticator name the registry does not resolve (#flow-unknown-authenticator), or the same authenticator named twice (#flow-duplicate-authenticator); the last two carry errors[] naming the step. Replaces the whole list. If-Match is mandatory: the matching GET answers an ETag, an absent header is refused with 428, and a stale one with 412 — a last-write-wins here would silently reinstate what another administrator has just removed.
Path parameters
| Name | Type | Required | Details |
|---|---|---|---|
tenant | string | yes | The tenant being administered, addressed by name. |
Request body
Body: application/json
| Field | Type | Required | Details |
|---|---|---|---|
(body) | array of object | yes | |
[] | object | yes | |
[].authenticator | string | yes | The sign-in step to run. Constraints: at least 1 character. |
[].requirement | string | yes | required, alternative, conditional or disabled. Constraints: one of required, alternative, conditional, disabled. |
Responses
200 OK
Body: application/json
| Field | Type | Required | Details |
|---|---|---|---|
items | array of object | yes | The tenant’s sign-in flow, in the order the steps run. |
items[] | object | yes | |
items[].index | integer | yes | The step’s position, counted from 0. Constraints: at least 0. |
items[].authenticator | string | yes | The sign-in step this entry runs, one of available. |
items[].requirement | string | yes | required always runs, alternative is one of several of which one suffices, conditional runs only when it applies to the user, disabled is skipped. Constraints: one of required, alternative, conditional, disabled. |
available | array of string | yes | Every authenticator a step may name. |
401 RFC 9457 problem details
Body: application/problem+json, an RFC 9457 problem document described under problem details.
403 RFC 9457 problem details
Body: application/problem+json, an RFC 9457 problem document described under problem details.
Documentation coverage: 12 of 12 fields described (100%).