controllers

func (*ApiController) AddAdapter ¶

func (c *ApiController) AddAdapter()

AddAdapter @Title AddAdapter @Tag Adapter API @Description add adapter @Param body body object.Adapter true "The details of the adapter" @Success 200 {object} controllers.Response The Response object @router /add-adapter [post]

func (*ApiController) AddApplication ¶

func (c *ApiController) AddApplication()

AddApplication @Title AddApplication @Tag Application API @Description add an application @Param body body object.Application true "The details of the application" @Success 200 {object} controllers.Response The Response object @router /add-application [post]

func (*ApiController) AddCert ¶

func (c *ApiController) AddCert()

AddCert @Title AddCert @Tag Cert API @Description add cert @Param body body object.Cert true "The details of the cert" @Success 200 {object} controllers.Response The Response object @router /add-cert [post]

func (*ApiController) AddEnforcer ¶

func (c *ApiController) AddEnforcer()

AddEnforcer @Title AddEnforcer @Tag Enforcer API @Description add enforcer @Param enforcer body object true "The enforcer object" @Success 200 {object} object.Enforcer @router /add-enforcer [post]

func (*ApiController) AddForm ¶

func (c *ApiController) AddForm()

AddForm @Title AddForm @Tag Form API @Description add form @Param body body object.Form true "The details of the form" @Success 200 {object} controllers.Response The Response object @router /add-form [post]

func (*ApiController) AddGroup ¶

func (c *ApiController) AddGroup()

AddGroup @Title AddGroup @Tag Group API @Description add group @Param body body object.Group true "The details of the group" @Success 200 {object} controllers.Response The Response object @router /add-group [post]

func (*ApiController) AddInvitation ¶

func (c *ApiController) AddInvitation()

AddInvitation @Title AddInvitation @Tag Invitation API @Description add invitation @Param body body object.Invitation true "The details of the invitation" @Success 200 {object} controllers.Response The Response object @router /add-invitation [post]

func (*ApiController) AddKey ¶

func (c *ApiController) AddKey()

AddKey @Title AddKey @Tag Key API @Description add key @Param body body object.Key true "The details of the key" @Success 200 {object} controllers.Response The Response object @router /add-key [post]

func (*ApiController) AddLdap ¶

func (c *ApiController) AddLdap()

AddLdap @Title AddLdap @Tag Account API @Description add ldap @Param body body object.Ldap true "The details of the ldap" @Success 200 {object} controllers.Response The Response object @router /add-ldap [post]

func (*ApiController) AddModel ¶

func (c *ApiController) AddModel()

AddModel @Title AddModel @Tag Model API @Description add model @Param body body object.Model true "The details of the model" @Success 200 {object} controllers.Response The Response object @router /add-model [post]

func (*ApiController) AddOrganization ¶

func (c *ApiController) AddOrganization()

AddOrganization ... @Title AddOrganization @Tag Organization API @Description add organization @Param body body object.Organization true "The details of the organization" @Success 200 {object} controllers.Response The Response object @router /add-organization [post]

func (*ApiController) AddPermission ¶

func (c *ApiController) AddPermission()

AddPermission @Title AddPermission @Tag Permission API @Description add permission @Param body body object.Permission true "The details of the permission" @Success 200 {object} controllers.Response The Response object @router /add-permission [post]

func (*ApiController) AddPolicy ¶

func (c *ApiController) AddPolicy()

AddPolicy @Title AddPolicy @Tag Enforcer API @Description add policy @Param id query string true "The id ( owner/name ) of enforcer" @Param body body util.AuthzRule true "The policy to add" @Success 200 {object} Response @router /add-policy [post]

func (*ApiController) AddProject ¶

func (c *ApiController) AddProject()

AddProject @Title AddProject @Tag Project API @Description Add a new project @Param body body object.Project true "The project details" @Success 200 {object} controllers.Response @router /add-project [post]

func (*ApiController) AddProvider ¶

func (c *ApiController) AddProvider()

AddProvider @Title AddProvider @Tag Provider API @Description add provider @Param body body object.Provider true "The details of the provider" @Success 200 {object} controllers.Response The Response object @router /add-provider [post]

func (*ApiController) AddRecord ¶

func (c *ApiController) AddRecord()

AddRecord @Title AddRecord @Tag Record API @Description add a record @Param body body object.Record true "The details of the record" @Success 200 {object} controllers.Response The Response object @router /add-record [post]

func (*ApiController) AddResource ¶

func (c *ApiController) AddResource()

AddResource @Tag Resource API @Title AddResource @Param resource body object.Resource true "Resource object" @Success 200 {object} controllers.Response Success or error @router /add-resource [post]

func (*ApiController) AddRole ¶

func (c *ApiController) AddRole()

AddRole @Title AddRole @Tag Role API @Description add role @Param body body object.Role true "The details of the role" @Success 200 {object} controllers.Response The Response object @router /add-role [post]

func (*ApiController) AddRule ¶

func (c *ApiController) AddRule()

AddRule @Title AddRule @Tag Rule API @Description add rule @Param body body object.Rule true "The details of the rule" @Success 200 {object} controllers.Response The Response object @router /add-rule [post]

func (*ApiController) AddServer ¶

func (c *ApiController) AddServer()

AddServer @Title AddServer @Tag Server API @Description add server @Param body body object.Server true "The details of the server" @Success 200 {object} controllers.Response The Response object @router /add-server [post]

func (*ApiController) AddSession ¶

func (c *ApiController) AddSession()

AddSession @Title AddSession @Tag Session API @Description Add session for one user in one application. If there are other existing sessions, join the session into the list. @Param body body object.Session true "The session object to add" @Success 200 {object} controllers.Response The Response object @router /add-session [post]

func (*ApiController) AddSite ¶

func (c *ApiController) AddSite()

AddSite @Title AddSite @Tag Site API @Description add site @Param body body object.Site true "The details of the site" @Success 200 {object} controllers.Response The Response object @router /add-site [post]

func (*ApiController) AddSyncer ¶

func (c *ApiController) AddSyncer()

AddSyncer @Title AddSyncer @Tag Syncer API @Description add syncer @Param body body object.Syncer true "The details of the syncer" @Success 200 {object} controllers.Response The Response object @router /add-syncer [post]

func (*ApiController) AddTicket ¶

func (c *ApiController) AddTicket()

AddTicket @Title AddTicket @Tag Ticket API @Description add ticket @Param body body object.Ticket true "The details of the ticket" @Success 200 {object} controllers.Response The Response object @router /add-ticket [post]

func (*ApiController) AddTicketMessage ¶

func (c *ApiController) AddTicketMessage()

AddTicketMessage @Title AddTicketMessage @Tag Ticket API @Description add a message to a ticket @Param id query string true "The id ( owner/name ) of the ticket" @Param body body object.TicketMessage true "The message to add" @Success 200 {object} controllers.Response The Response object @router /add-ticket-message [post]

func (*ApiController) AddToken ¶

func (c *ApiController) AddToken()

AddToken @Title AddToken @Tag Token API @Description add token @Param body body object.Token true "Details of the token" @Success 200 {object} controllers.Response The Response object @router /add-token [post]

func (*ApiController) AddUser ¶

func (c *ApiController) AddUser()

AddUser @Title AddUser @Tag User API @Description add user @Param body body object.User true "The details of the user" @Success 200 {object} controllers.Response The Response object @router /add-user [post]

func (*ApiController) AddWebhook ¶

func (c *ApiController) AddWebhook()

AddWebhook @Title AddWebhook @Tag Webhook API @Description add webhook @Param body body object.Webhook true "The details of the webhook" @Success 200 {object} controllers.Response The Response object @router /add-webhook [post]

func (*ApiController) ApproveUser ¶ added in v1.31.18

func (c *ApiController) ApproveUser()

ApproveUser flips a pending user to approved, unlocking customer access.

Endpoint: POST /v1/iam/approve-user body: {"id":"<owner>/<name>"} Auth: global admin (any org) or org admin (own org only). Idempotent.

func (*ApiController) BatchEnforce ¶

func (c *ApiController) BatchEnforce()

BatchEnforce @Title BatchEnforce @Tag Enforcer API @Description Call BatchEnforce API @Param body body []string true "array of enforce requests" @Param permissionId query string false "permission id" @Param modelId query string false "model id" @Param owner query string false "owner" @Success 200 {object} controllers.Response The Response object @router /batch-enforce [post]

func (*ApiController) BootstrapApplicationUpsert ¶ added in v1.2.4

func (c *ApiController) BootstrapApplicationUpsert()

BootstrapApplicationUpsert

Endpoint: POST /v1/iam/admin/applications/upsert Auth: service-token via Authorization: Bearer <token>

where token is one of $HANZO_API_KEY / $KMS_SERVICE_TOKEN / $IAM_SERVICE_TOKEN.
Validated by routers/auto_signin_filter.go before this handler runs.

Idempotent operator-driven application provisioning. Used by a deployment operator to wire service accounts (KMS, signers, etc.) into IAM with the right grant types — no human in the loop.

If the app exists by (owner, name) → update grants + rotate clientSecret. If not → create.

On 401: missing or invalid service token (handled upstream). On 400: malformed body or missing required fields.

Body:

{
  "organization": "hanzo",          // required
  "name":         "hanzo-kms",      // required
  "clientId":     "kms-app",        // required
  "clientSecret": "...",            // optional; generated if omitted (preferred)
  "grantTypes":   ["client_credentials", "refresh_token"],
  "redirectUris": ["..."]           // optional, for non-CC flows
  "displayName":  "Hanzo KMS"       // optional
}

Response on success:

{ "status": "ok", "action": "created"|"updated",
  "data": { "name": "...", "clientId": "...", "clientSecret": "..." } }

The clientSecret in the response is the source-of-truth value the caller must persist (e.g. into a k8s Secret).

func (*ApiController) BootstrapUserUpsert ¶ added in v1.14.2

func (c *ApiController) BootstrapUserUpsert()

BootstrapUserUpsert

Endpoint: POST /v1/iam/admin/users/upsert Auth: service-token via Authorization: Bearer <token>

where token is one of $HANZO_API_KEY / $KMS_SERVICE_TOKEN / $IAM_SERVICE_TOKEN.
Validated by routers/auto_signin_filter.go before this handler runs.

Idempotent operator-driven user provisioning. Used by the K8s operator to reconcile IAM.spec.users[] against IAM — no human admin in the loop.

If the user exists by (owner, name) → update; else insert. Passwords are always hashed at rest (argon2id by default; bcrypt rejected; "plain" passes through only when explicitly requested for sandbox fixtures).

Body:

{
  "owner":             "<tenant>",         // required
  "name":              "admin",            // required
  "displayName":       "Admin",
  "email":             "admin@example.com",
  "phone":             "5555550100",
  "countryCode":       "US",
  "password":          "...",
  "passwordType":      "argon2id"|"plain", // default argon2id; bcrypt rejected
  "type":              "normal-user",      // default normal-user
  "isAdmin":           false,
  "signupApplication": "<tenant>-app",
  "emailVerified":     true,
  "properties":        { "...": "..." }    // future-proof free-form
}

Response on success:

{ "status": "ok", "data": { "created": bool, "name": "...", "email": "..." } }

func (*ApiController) Callback ¶

func (c *ApiController) Callback()

Callback @Title Callback @Tag Callback API @Description Get Login Error Counts @router /Callback [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) CheckUserPassword ¶

func (c *ApiController) CheckUserPassword()

CheckUserPassword @Title CheckUserPassword @router /check-user-password [post] @Tag User API @Success 200 {object} object.Userinfo The Response object

func (*ApiController) ClearTokenSession ¶

func (c *ApiController) ClearTokenSession()

func (*ApiController) ClearUserSession ¶

func (c *ApiController) ClearUserSession()

func (*ApiController) CreateServiceAccount ¶ added in v1.31.1

func (c *ApiController) CreateServiceAccount()

CreateServiceAccount @Title CreateServiceAccount @Tag ServiceAccount API @Description Create an agent/bot service-account identity in an org and mint

its first API key. Returns the raw access key + secret EXACTLY ONCE; only the
argon2id hash of the secret is stored. The account authenticates ONLY by this
key (no password) and its actions are attributed to <org>/<org-agent>.

@Param body body serviceAccountRequest true "organization, name, agentRef" @Success 200 {object} controllers.Response The Response object @router /service-accounts [post]

func (*ApiController) DeleteAdapter ¶

func (c *ApiController) DeleteAdapter()

DeleteAdapter @Title DeleteAdapter @Tag Adapter API @Description delete adapter @Param body body object.Adapter true "The details of the adapter" @Success 200 {object} controllers.Response The Response object @router /delete-adapter [post]

func (*ApiController) DeleteApplication ¶

func (c *ApiController) DeleteApplication()

DeleteApplication @Title DeleteApplication @Tag Application API @Description delete an application @Param body body object.Application true "The details of the application" @Success 200 {object} controllers.Response The Response object @router /delete-application [post]

func (*ApiController) DeleteCert ¶

func (c *ApiController) DeleteCert()

DeleteCert @Title DeleteCert @Tag Cert API @Description delete cert @Param body body object.Cert true "The details of the cert" @Success 200 {object} controllers.Response The Response object @router /delete-cert [post]

func (*ApiController) DeleteEnforcer ¶

func (c *ApiController) DeleteEnforcer()

DeleteEnforcer @Title DeleteEnforcer @Tag Enforcer API @Description delete enforcer @Param body body object.Enforcer true "The enforcer object" @Success 200 {object} object.Enforcer @router /delete-enforcer [post]

func (*ApiController) DeleteForm ¶

func (c *ApiController) DeleteForm()

DeleteForm @Title DeleteForm @Tag Form API @Description delete form @Param body body object.Form true "The details of the form" @Success 200 {object} controllers.Response The Response object @router /delete-form [post]

func (*ApiController) DeleteGroup ¶

func (c *ApiController) DeleteGroup()

DeleteGroup @Title DeleteGroup @Tag Group API @Description delete group @Param body body object.Group true "The details of the group" @Success 200 {object} controllers.Response The Response object @router /delete-group [post]

func (*ApiController) DeleteInvitation ¶

func (c *ApiController) DeleteInvitation()

DeleteInvitation @Title DeleteInvitation @Tag Invitation API @Description delete invitation @Param body body object.Invitation true "The details of the invitation" @Success 200 {object} controllers.Response The Response object @router /delete-invitation [post]

func (*ApiController) DeleteKey ¶

func (c *ApiController) DeleteKey()

DeleteKey @Title DeleteKey @Tag Key API @Description delete key @Param body body object.Key true "The details of the key" @Success 200 {object} controllers.Response The Response object @router /delete-key [post]

func (*ApiController) DeleteLdap ¶

func (c *ApiController) DeleteLdap()

DeleteLdap @Title DeleteLdap @Tag Account API @Description delete ldap @Param body body object.Ldap true "The details of the ldap" @Success 200 {object} controllers.Response The Response object @router /delete-ldap [post]

func (*ApiController) DeleteMfa ¶

func (c *ApiController) DeleteMfa()

DeleteMfa @Title DeleteMfa @Tag MFA API @Description: Delete MFA @param owner form string true "owner of user" @param name form string true "name of user" @Success 200 {object} controllers.Response The Response object @router /delete-mfa/ [post]

func (*ApiController) DeleteModel ¶

func (c *ApiController) DeleteModel()

DeleteModel @Title DeleteModel @Tag Model API @Description delete model @Param body body object.Model true "The details of the model" @Success 200 {object} controllers.Response The Response object @router /delete-model [post]

func (*ApiController) DeleteOrganization ¶

func (c *ApiController) DeleteOrganization()

DeleteOrganization ... @Title DeleteOrganization @Tag Organization API @Description delete organization @Param body body object.Organization true "The details of the organization" @Success 200 {object} controllers.Response The Response object @router /delete-organization [post]

func (*ApiController) DeletePermission ¶

func (c *ApiController) DeletePermission()

DeletePermission @Title DeletePermission @Tag Permission API @Description delete permission @Param body body object.Permission true "The details of the permission" @Success 200 {object} controllers.Response The Response object @router /delete-permission [post]

func (*ApiController) DeleteProject ¶

func (c *ApiController) DeleteProject()

DeleteProject @Title DeleteProject @Tag Project API @Description Delete a project @Param body body object.Project true "The project details" @Success 200 {object} controllers.Response @router /delete-project [post]

func (*ApiController) DeleteProvider ¶

func (c *ApiController) DeleteProvider()

DeleteProvider @Title DeleteProvider @Tag Provider API @Description delete provider @Param body body object.Provider true "The details of the provider" @Success 200 {object} controllers.Response The Response object @router /delete-provider [post]

func (*ApiController) DeleteResource ¶

func (c *ApiController) DeleteResource()

DeleteResource @Tag Resource API @Title DeleteResource @Param resource body object.Resource true "Resource object" @Success 200 {object} controllers.Response Success or error @router /delete-resource [post]

func (*ApiController) DeleteRole ¶

func (c *ApiController) DeleteRole()

DeleteRole @Title DeleteRole @Tag Role API @Description delete role @Param body body object.Role true "The details of the role" @Success 200 {object} controllers.Response The Response object @router /delete-role [post]

func (*ApiController) DeleteRule ¶

func (c *ApiController) DeleteRule()

DeleteRule @Title DeleteRule @Tag Rule API @Description delete rule @Param body body object.Rule true "The details of the rule" @Success 200 {object} controllers.Response The Response object @router /delete-rule [post]

func (*ApiController) DeleteServer ¶

func (c *ApiController) DeleteServer()

DeleteServer @Title DeleteServer @Tag Server API @Description delete server @Param body body object.Server true "The details of the server" @Success 200 {object} controllers.Response The Response object @router /delete-server [post]

func (*ApiController) DeleteServiceAccount ¶ added in v1.31.1

func (c *ApiController) DeleteServiceAccount()

DeleteServiceAccount @Title DeleteServiceAccount @Tag ServiceAccount API @Description Delete (revoke) a service account. @Param name path string true "The service account name (<org>-<agent>)" @Param organization query string true "The owning organization" @Success 200 {object} controllers.Response The Response object @router /service-accounts/:name [delete]

func (*ApiController) DeleteSession ¶

func (c *ApiController) DeleteSession()

DeleteSession @Title DeleteSession @Tag Session API @Description Delete session for one user in one application. @Param body body object.Session true "The session object to delete" @Success 200 {object} controllers.Response The Response object @router /delete-session [post]

func (*ApiController) DeleteSite ¶

func (c *ApiController) DeleteSite()

DeleteSite @Title DeleteSite @Tag Site API @Description delete site @Param body body object.Site true "The details of the site" @Success 200 {object} controllers.Response The Response object @router /delete-site [post]

func (*ApiController) DeleteSyncer ¶

func (c *ApiController) DeleteSyncer()

DeleteSyncer @Title DeleteSyncer @Tag Syncer API @Description delete syncer @Param body body object.Syncer true "The details of the syncer" @Success 200 {object} controllers.Response The Response object @router /delete-syncer [post]

func (*ApiController) DeleteTicket ¶

func (c *ApiController) DeleteTicket()

DeleteTicket @Title DeleteTicket @Tag Ticket API @Description delete ticket @Param body body object.Ticket true "The details of the ticket" @Success 200 {object} controllers.Response The Response object @router /delete-ticket [post]

func (*ApiController) DeleteToken ¶

func (c *ApiController) DeleteToken()

DeleteToken @Tag Token API @Title DeleteToken @Description delete token @Param body body object.Token true "Details of the token" @Success 200 {object} controllers.Response The Response object @router /delete-token [post]

func (*ApiController) DeleteUser ¶

func (c *ApiController) DeleteUser()

DeleteUser @Title DeleteUser @Tag User API @Description delete user @Param body body object.User true "The details of the user" @Success 200 {object} controllers.Response The Response object @router /delete-user [post]

func (*ApiController) DeleteWebhook ¶

func (c *ApiController) DeleteWebhook()

DeleteWebhook @Title DeleteWebhook @Tag Webhook API @Description delete webhook @Param body body object.Webhook true "The details of the webhook" @Success 200 {object} controllers.Response The Response object @router /delete-webhook [post]

func (*ApiController) DeviceAuth ¶

func (c *ApiController) DeviceAuth()

DeviceAuth @Title DeviceAuth @Tag Device Authorization Endpoint @Description Endpoint for the device authorization flow @router /device-auth [post] @Success 200 {object} object.DeviceAuthResponse The Response object

func (*ApiController) DynamicClientRegister ¶

func (c *ApiController) DynamicClientRegister()

DynamicClientRegister @Title DynamicClientRegister @Tag OAuth API @Description Register a new OAuth 2.0 client dynamically (RFC 7591) @Param organization query string false "The organization name (defaults to admin)" @Param body body object.DynamicClientRegistrationRequest true "Client registration request" @Success 201 {object} object.DynamicClientRegistrationResponse @Failure 400 {object} object.DcrError @router /oauth/register [post]

func (*ApiController) Enforce ¶

func (c *ApiController) Enforce()

Enforce @Title Enforce @Tag Enforcer API @Description Call Enforce API @Param body body []string true "Enforce request" @Param permissionId query string false "permission id" @Param modelId query string false "model id" @Param resourceId query string false "resource id" @Param owner query string false "owner" @Success 200 {object} controllers.Response The Response object @router /enforce [post]

func (*ApiController) ExitImpersonateUser ¶

func (c *ApiController) ExitImpersonateUser()

ExitImpersonateUser @Title ExitImpersonateUser @Tag User API @Description clear impersonation info for current session @Success 200 {object} controllers.Response The Response object @router /exit-impersonation-user [post]

func (*ApiController) FaceIDSigninBegin ¶

func (c *ApiController) FaceIDSigninBegin()

FaceIDSigninBegin @Title FaceIDSigninBegin @Tag Login API @Description FaceId Login Flow 1st stage @Param owner query string true "owner" @Param name query string true "name" @Success 200 {object} controllers.Response The Response object @router /faceid-signin-begin [get]

func (*ApiController) Finish ¶

func (c *ApiController) Finish()

func (*ApiController) GetAcceptLanguage ¶

func (c *ApiController) GetAcceptLanguage() string

GetAcceptLanguage ...

func (*ApiController) GetAccount ¶

func (c *ApiController) GetAccount()

GetAccount @Title GetAccount @Tag Account API @Description get the details of the current account @Success 200 {object} controllers.Response The Response object @router /get-account [get]

func (*ApiController) GetAdapter ¶

func (c *ApiController) GetAdapter()

GetAdapter @Title GetAdapter @Tag Adapter API @Description get adapter @Param id query string true "The id ( owner/name ) of the adapter" @Success 200 {object} object.Adapter The Response object @router /get-adapter [get]

func (*ApiController) GetAdapters ¶

func (c *ApiController) GetAdapters()

GetAdapters @Title GetAdapters @Tag Adapter API @Description get adapters @Param owner query string true "The owner of adapters" @Success 200 {array} object.Adapter The Response object @router /get-adapters [get]

func (*ApiController) GetAllActions ¶

func (c *ApiController) GetAllActions()

GetAllActions @Title GetAllActions @Tag Enforcer API @Description Get all actions for a user @Param userId query string false "user id like superuser/admin" @Success 200 {object} controllers.Response The Response object @router /get-all-actions [get]

func (*ApiController) GetAllObjects ¶

func (c *ApiController) GetAllObjects()

GetAllObjects @Title GetAllObjects @Tag Enforcer API @Description Get all objects for a user @Param userId query string false "user id like superuser/admin" @Success 200 {object} controllers.Response The Response object @router /get-all-objects [get]

func (*ApiController) GetAllRoles ¶

func (c *ApiController) GetAllRoles()

GetAllRoles @Title GetAllRoles @Tag Enforcer API @Description Get all roles for a user @Param userId query string false "user id like superuser/admin" @Success 200 {object} controllers.Response The Response object @router /get-all-roles [get]

func (*ApiController) GetApplication ¶

func (c *ApiController) GetApplication()

GetApplication @Title GetApplication @Tag Application API @Description get the detail of an application @Param id query string true "The id ( owner/name ) of the application." @Success 200 {object} object.Application The Response object @router /get-application [get]

func (*ApiController) GetApplicationLogin ¶

func (c *ApiController) GetApplicationLogin()

GetApplicationLogin ... @Title GetApplicationLogin @Tag Login API @Description get application login @Param clientId query string true "client id" @Param responseType query string true "response type" @Param redirectUri query string true "redirect uri" @Param scope query string true "scope" @Param state query string true "state" @Success 200 {object} controllers.Response The Response object @router /get-app-login [get]

func (*ApiController) GetApplications ¶

func (c *ApiController) GetApplications()

GetApplications @Title GetApplications @Tag Application API @Description get all applications @Param owner query string true "The owner of applications." @Success 200 {array} object.Application The Response object @router /get-applications [get]

func (*ApiController) GetApprovalStatus ¶ added in v1.31.18

func (c *ApiController) GetApprovalStatus()

GetApprovalStatus returns the caller's own approval status — the gate/SPA calls this to decide "show the app" vs "show the waitlist".

Endpoint: GET /v1/iam/approval-status

func (*ApiController) GetCaptcha ¶

func (c *ApiController) GetCaptcha()

GetCaptcha ... @Tag Login API @Title GetCaptcha @router /get-captcha [get] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) GetCaptchaStatus ¶

func (c *ApiController) GetCaptchaStatus()

GetCaptchaStatus @Title GetCaptchaStatus @Tag Token API @Description Get Login Error Counts @Param id query string true "The id ( owner/name ) of user" @Success 200 {object} controllers.Response The Response object @router /get-captcha-status [get]

func (*ApiController) GetCert ¶

func (c *ApiController) GetCert()

GetCert @Title GetCert @Tag Cert API @Description get cert @Param id query string true "The id ( owner/name ) of the cert" @Success 200 {object} object.Cert The Response object @router /get-cert [get]

func (*ApiController) GetCerts ¶

func (c *ApiController) GetCerts()

GetCerts @Title GetCerts @Tag Cert API @Description get certs @Param owner query string true "The owner of certs" @Success 200 {array} object.Cert The Response object @router /get-certs [get]

func (*ApiController) GetDashboard ¶

func (c *ApiController) GetDashboard()

GetDashboard @Title GetDashboard @Tag System API @Description get information of dashboard @Success 200 {object} controllers.Response The Response object @router /get-dashboard [get]

func (*ApiController) GetDefaultApplication ¶

func (c *ApiController) GetDefaultApplication()

GetDefaultApplication ... @Title GetDefaultApplication @Tag Organization API @Description get default application @Param id query string true "organization id" @Success 200 {object} controllers.Response The Response object @router /get-default-application [get]

func (*ApiController) GetEmailAndPhone ¶

func (c *ApiController) GetEmailAndPhone()

GetEmailAndPhone @Title GetEmailAndPhone @Tag User API @Description get email and phone by username @Param username formData string true "The username of the user" @Param organization formData string true "The organization of the user" @Success 200 {object} controllers.Response The Response object @router /get-email-and-phone [get]

func (*ApiController) GetEnforcer ¶

func (c *ApiController) GetEnforcer()

GetEnforcer @Title GetEnforcer @Tag Enforcer API @Description get enforcer @Param id query string true "The id ( owner/name ) of enforcer" @Success 200 {object} object.Enforcer @router /get-enforcer [get]

func (*ApiController) GetEnforcers ¶

func (c *ApiController) GetEnforcers()

GetEnforcers @Title GetEnforcers @Tag Enforcer API @Description get enforcers @Param owner query string true "The owner of enforcers" @Success 200 {array} object.Enforcer @router /get-enforcers [get]

func (*ApiController) GetFilteredPolicies ¶

func (c *ApiController) GetFilteredPolicies()

GetFilteredPolicies @Title GetFilteredPolicies @Tag Enforcer API @Description get filtered policies with support for multiple filters via POST body @Param id query string true "The id ( owner/name ) of enforcer" @Param body body []object.Filter true "Array of filter objects for multiple filters" @Success 200 {array} util.AuthzRule @router /get-filtered-policies [post]

func (*ApiController) GetForm ¶

func (c *ApiController) GetForm()

GetForm @Title GetForm @Tag Form API @Description get form @Param id query string true "The id (owner/name) of form" @Success 200 {object} object.Form The Response object @router /get-form [get]

func (*ApiController) GetForms ¶

func (c *ApiController) GetForms()

GetForms @Title GetForms @Tag Form API @Description get forms @Param owner query string true "The owner of form" @Success 200 {array} object.Form The Response object @router /get-forms [get]

func (*ApiController) GetGlobalCerts ¶

func (c *ApiController) GetGlobalCerts()

GetGlobalCerts @Title GetGlobalCerts @Tag Cert API @Description get global certs @Success 200 {array} object.Cert The Response object @router /get-global-certs [get]

func (*ApiController) GetGlobalForms ¶

func (c *ApiController) GetGlobalForms()

GetGlobalForms @Title GetGlobalForms @Tag Form API @Description get global forms @Success 200 {array} object.Form The Response object @router /get-global-forms [get]

func (*ApiController) GetGlobalKeys ¶

func (c *ApiController) GetGlobalKeys()

GetGlobalKeys @Title GetGlobalKeys @Tag Key API @Description get global keys @Success 200 {array} object.Key The Response object @router /get-global-keys [get]

func (*ApiController) GetGlobalProviders ¶

func (c *ApiController) GetGlobalProviders()

GetGlobalProviders @Title GetGlobalProviders @Tag Provider API @Description get Global providers @Success 200 {array} object.Provider The Response object @router /get-global-providers [get]

func (*ApiController) GetGlobalSites ¶

func (c *ApiController) GetGlobalSites()

GetGlobalSites @Title GetGlobalSites @Tag Site API @Description get global sites @Success 200 {array} object.Site The Response object @router /get-global-sites [get]

func (*ApiController) GetGlobalUsers ¶

func (c *ApiController) GetGlobalUsers()

GetGlobalUsers @Title GetGlobalUsers @Tag User API @Description get global users @Success 200 {array} object.User The Response object @router /get-global-users [get]

func (*ApiController) GetGroup ¶

func (c *ApiController) GetGroup()

GetGroup @Title GetGroup @Tag Group API @Description get group @Param id query string true "The id ( owner/name ) of the group" @Success 200 {object} object.Group The Response object @router /get-group [get]

func (*ApiController) GetGroups ¶

func (c *ApiController) GetGroups()

GetGroups @Title GetGroups @Tag Group API @Description get groups @Param owner query string true "The owner of groups" @Success 200 {array} object.Group The Response object @router /get-groups [get]

func (*ApiController) GetInvitation ¶

func (c *ApiController) GetInvitation()

GetInvitation @Title GetInvitation @Tag Invitation API @Description get invitation @Param id query string true "The id ( owner/name ) of the invitation" @Success 200 {object} object.Invitation The Response object @router /get-invitation [get]

func (*ApiController) GetInvitationCodeInfo ¶

func (c *ApiController) GetInvitationCodeInfo()

GetInvitationCodeInfo @Title GetInvitationCodeInfo @Tag Invitation API @Description get invitation code information @Param code query string true "Invitation code" @Success 200 {object} object.Invitation The Response object @router /get-invitation-info [get]

func (*ApiController) GetInvitations ¶

func (c *ApiController) GetInvitations()

GetInvitations @Title GetInvitations @Tag Invitation API @Description get invitations @Param owner query string true "The owner of invitations" @Success 200 {array} object.Invitation The Response object @router /get-invitations [get]

func (*ApiController) GetKey ¶

func (c *ApiController) GetKey()

GetKey @Title GetKey @Tag Key API @Description get key @Param id query string true "The id ( owner/name ) of the key" @Success 200 {object} object.Key The Response object @router /get-key [get]

func (*ApiController) GetKeys ¶

func (c *ApiController) GetKeys()

GetKeys @Title GetKeys @Tag Key API @Description get keys @Param owner query string true "The owner of keys" @Success 200 {array} object.Key The Response object @router /get-keys [get]

func (*ApiController) GetLdap ¶

func (c *ApiController) GetLdap()

GetLdap @Title GetLdap @Tag Account API @Description get ldap @Param id query string true "id" @Success 200 {object} object.Ldap The Response object @router /get-ldap [get]

func (*ApiController) GetLdapUsers ¶

func (c *ApiController) GetLdapUsers()

GetLdapUsers @Title GetLdapser @Tag Account API @Description get ldap users Param id string true "id" @Success 200 {object} controllers.LdapResp The Response object @router /get-ldap-users [get]

func (*ApiController) GetLdaps ¶

func (c *ApiController) GetLdaps()

GetLdaps @Title GetLdaps @Tag Account API @Description get ldaps @Param owner query string false "owner" @Success 200 {array} object.Ldap The Response object @router /get-ldaps [get]

func (*ApiController) GetMeProfile ¶ added in v1.19.3

func (c *ApiController) GetMeProfile()

GetMeProfile @Title GetMeProfile @Tag Account API @Description return the signed-in user's profile (settings page shape) @Success 200 {object} MeProfile The profile @router /me/profile [get]

func (*ApiController) GetMetrics ¶

func (c *ApiController) GetMetrics()

GetMetrics @Title GetMetrics @Tag System API @Description get Prometheus metrics @Success 200 {string} Prometheus metrics in text format @router /metrics [get]

func (*ApiController) GetModel ¶

func (c *ApiController) GetModel()

GetModel @Title GetModel @Tag Model API @Description get model @Param id query string true "The id ( owner/name ) of the model" @Success 200 {object} object.Model The Response object @router /get-model [get]

func (*ApiController) GetModels ¶

func (c *ApiController) GetModels()

GetModels @Title GetModels @Tag Model API @Description get models @Param owner query string true "The owner of models" @Success 200 {array} object.Model The Response object @router /get-models [get]

func (*ApiController) GetOAuthToken ¶

func (c *ApiController) GetOAuthToken()

GetOAuthToken @Title GetOAuthToken @Tag Token API @Description get OAuth access token @Param grant_type query string true "OAuth grant type" @Param client_id query string true "OAuth client id" @Param client_secret query string true "OAuth client secret" @Param code query string true "OAuth code" @Success 200 {object} object.TokenWrapper The Response object @Success 400 {object} object.TokenError The Response object @Success 401 {object} object.TokenError The Response object @router /v1/iam/oauth/access_token [post]

func (*ApiController) GetOrganization ¶

func (c *ApiController) GetOrganization()

GetOrganization ... @Title GetOrganization @Tag Organization API @Description get organization @Param id query string true "organization id" @Success 200 {object} object.Organization The Response object @router /get-organization [get]

func (*ApiController) GetOrganizationApplications ¶

func (c *ApiController) GetOrganizationApplications()

GetOrganizationApplications @Title GetOrganizationApplications @Tag Application API @Description get the detail of the organization's application @Param organization query string true "The organization name" @Success 200 {array} object.Application The Response object @router /get-organization-applications [get]

func (*ApiController) GetOrganizationNames ¶

func (c *ApiController) GetOrganizationNames()

GetOrganizationNames ... @Title GetOrganizationNames @Tag Organization API @Param owner query string true "owner" @Description get all organization name and displayName @Success 200 {array} object.Organization The Response object @router /get-organization-names [get]

func (*ApiController) GetOrganizationProjects ¶

func (c *ApiController) GetOrganizationProjects()

GetOrganizationProjects @Title GetOrganizationProjects @Tag Project API @Description Get all projects for an organization @Param organization query string true "The organization name" @Success 200 {array} object.Project @router /get-organization-projects [get]

func (*ApiController) GetOrganizations ¶

func (c *ApiController) GetOrganizations()

GetOrganizations ... @Title GetOrganizations @Tag Organization API @Description get organizations @Param owner query string true "owner" @Success 200 {array} object.Organization The Response object @router /get-organizations [get]

func (*ApiController) GetPaidUsername ¶

func (c *ApiController) GetPaidUsername() string

GetPaidUsername ...

func (*ApiController) GetPendingUsers ¶ added in v1.31.18

func (c *ApiController) GetPendingUsers()

GetPendingUsers lists users awaiting approval (the ranked waitlist's IAM view).

Endpoint: GET /v1/iam/get-pending-users?owner=<org>

• global admin: omit owner to list pending across ALL orgs, or pass one to scope.
• org admin: owner is forced to the caller's own org.

Response: masked users whose approvalStatus == "pending".

func (*ApiController) GetPermission ¶

func (c *ApiController) GetPermission()

GetPermission @Title GetPermission @Tag Permission API @Description get permission @Param id query string true "The id ( owner/name ) of the permission" @Success 200 {object} object.Permission The Response object @router /get-permission [get]

func (*ApiController) GetPermissions ¶

func (c *ApiController) GetPermissions()

GetPermissions @Title GetPermissions @Tag Permission API @Description get permissions @Param owner query string true "The owner of permissions" @Success 200 {array} object.Permission The Response object @router /get-permissions [get]

func (*ApiController) GetPermissionsByRole ¶

func (c *ApiController) GetPermissionsByRole()

GetPermissionsByRole @Title GetPermissionsByRole @Tag Permission API @Description get permissions by role @Param id query string true "The id ( owner/name ) of the role" @Success 200 {array} object.Permission The Response object @router /get-permissions-by-role [get]

func (*ApiController) GetPermissionsBySubmitter ¶

func (c *ApiController) GetPermissionsBySubmitter()

GetPermissionsBySubmitter @Title GetPermissionsBySubmitter @Tag Permission API @Description get permissions by submitter @Success 200 {array} object.Permission The Response object @router /get-permissions-by-submitter [get]

func (*ApiController) GetPhoneUser ¶ added in v1.2.4

func (c *ApiController) GetPhoneUser()

GetPhoneUser @Tag Account API @Title GetPhoneUser @Description check whether a phone number is already registered with a user,

gated by a valid (but not-yet-consumed) verification code.
Returns { exists: bool } so the SPA can skip the Terms screen
during signup and go straight to sign-IN for existing users.

@router /get-phone-user [post]

func (*ApiController) GetPolicies ¶

func (c *ApiController) GetPolicies()

GetPolicies @Title GetPolicies @Tag Enforcer API @Description get policies @Param id query string true "The id ( owner/name ) of enforcer" @Param adapterId query string false "The adapter id" @Success 200 {array} util.AuthzRule @router /get-policies [get]

func (*ApiController) GetProject ¶

func (c *ApiController) GetProject()

GetProject @Title GetProject @Tag Project API @Description Get a project by ID @Param id query string true "The project ID (owner/name)" @Success 200 {object} object.Project @router /get-project [get]

func (*ApiController) GetProjects ¶

func (c *ApiController) GetProjects()

GetProjects @Title GetProjects @Tag Project API @Description Get projects for an owner @Param owner query string true "The owner of projects" @Success 200 {array} object.Project @router /get-projects [get]

func (*ApiController) GetPrometheusInfo ¶

func (c *ApiController) GetPrometheusInfo()

GetPrometheusInfo @Title GetPrometheusInfo @Tag System API @Description get Prometheus Info @Success 200 {object} object.PrometheusInfo The Response object @router /get-prometheus-info [get]

func (*ApiController) GetProvider ¶

func (c *ApiController) GetProvider()

GetProvider @Title GetProvider @Tag Provider API @Description get provider @Param id query string true "The id ( owner/name ) of the provider" @Success 200 {object} object.Provider The Response object @router /get-provider [get]

func (*ApiController) GetProviderFromContext ¶

func (c *ApiController) GetProviderFromContext(category string) (*object.Provider, error)

func (*ApiController) GetProviders ¶

func (c *ApiController) GetProviders()

GetProviders @Title GetProviders @Tag Provider API @Description get providers @Param owner query string true "The owner of providers" @Success 200 {array} object.Provider The Response object @router /get-providers [get]

func (*ApiController) GetQRCode ¶

func (c *ApiController) GetQRCode()

GetQRCode @Tag System API @Title GetWechatQRCode @router /get-qrcode [GET] @Param id query string true "The id ( owner/name ) of provider" @Success 200 {object} controllers.Response The Response object

func (*ApiController) GetRecords ¶

func (c *ApiController) GetRecords()

GetRecords @Title GetRecords @Tag Record API @Description get all records @Param pageSize query string true "The size of each page" @Param p query string true "The number of the page" @Success 200 {object} object.Record The Response object @router /get-records [get]

func (*ApiController) GetRecordsByFilter ¶

func (c *ApiController) GetRecordsByFilter()

GetRecordsByFilter @Tag Record API @Title GetRecordsByFilter @Description get records by filter @Param filter body string true "filter Record message" @Success 200 {object} object.Record The Response object @router /get-records-filter [post]

func (*ApiController) GetRegistryPublicKey ¶

func (c *ApiController) GetRegistryPublicKey()

GetRegistryPublicKey serves the JWKS for registry token verification.

@Title GetRegistryPublicKey @Tag Registry API @Description Get the public key used to verify registry tokens (JWKS format) @Success 200 {object} map[string]interface{} @router /v1/iam/registry/jwks [get]

func (*ApiController) GetRegistryToken ¶

func (c *ApiController) GetRegistryToken()

GetRegistryToken handles Docker registry v2 token authentication.

The Docker registry sends unauthenticated clients here with:

GET /v1/iam/registry/token?service=registry.hanzo.ai&scope=repository:myimage:pull,push

The client provides Basic auth credentials. This endpoint validates them against IAM users and returns a short-lived JWT granting the requested access.

@Title GetRegistryToken @Tag Registry API @Description Get a Docker registry authentication token @Param service query string true "The registry service name" @Param scope query string false "The requested scope (type:name:actions)" @Success 200 {object} RegistryTokenResponse @Failure 401 Unauthorized @router /v1/iam/registry/token [get]

func (*ApiController) GetResource ¶

func (c *ApiController) GetResource()

GetResource @Tag Resource API @Title GetResource @Description get resource @Param id query string true "The id ( owner/name ) of resource" @Success 200 {object} object.Resource The Response object @router /get-resource [get]

func (*ApiController) GetResources ¶

func (c *ApiController) GetResources()

GetResources @Tag Resource API @Title GetResources @Description get resources @Param owner query string true "Owner" @Param user query string true "User" @Param pageSize query integer false "Page Size" @Param p query integer false "Page Number" @Param field query string false "Field" @Param value query string false "Value" @Param sortField query string false "Sort Field" @Param sortOrder query string false "Sort Order" @Success 200 {array} object.Resource The Response object @router /get-resources [get]

func (*ApiController) GetRole ¶

func (c *ApiController) GetRole()

GetRole @Title GetRole @Tag Role API @Description get role @Param id query string true "The id ( owner/name ) of the role" @Success 200 {object} object.Role The Response object @router /get-role [get]

func (*ApiController) GetRoles ¶

func (c *ApiController) GetRoles()

GetRoles @Title GetRoles @Tag Role API @Description get roles @Param owner query string true "The owner of roles" @Success 200 {array} object.Role The Response object @router /get-roles [get]

func (*ApiController) GetRule ¶

func (c *ApiController) GetRule()

GetRule @Title GetRule @Tag Rule API @Description get rule @Param id query string true "The id ( owner/name ) of the rule" @Success 200 {object} object.Rule The Response object @router /get-rule [get]

func (*ApiController) GetRules ¶

func (c *ApiController) GetRules()

GetRules @Title GetRules @Tag Rule API @Description get rules @Param owner query string true "The owner of rules" @Success 200 {array} object.Rule The Response object @router /get-rules [get]

func (*ApiController) GetSamlLogin ¶

func (c *ApiController) GetSamlLogin()

func (*ApiController) GetSamlMeta ¶

func (c *ApiController) GetSamlMeta()

func (*ApiController) GetServer ¶

func (c *ApiController) GetServer()

GetServer @Title GetServer @Tag Server API @Description get server @Param id query string true "The id ( owner/name ) of the server" @Success 200 {object} object.Server The Response object @router /get-server [get]

func (*ApiController) GetServers ¶

func (c *ApiController) GetServers()

GetServers @Title GetServers @Tag Server API @Description get servers @Param owner query string true "The owner of servers" @Success 200 {array} object.Server The Response object @router /get-servers [get]

func (*ApiController) GetServiceAccounts ¶ added in v1.31.1

func (c *ApiController) GetServiceAccounts()

GetServiceAccounts @Title GetServiceAccounts @Tag ServiceAccount API @Description List the service accounts in an org. Returns names + metadata

only — NEVER secrets (access key/secret are masked; the hash never
serializes).

@Param organization query string true "The owning organization" @Success 200 {array} object.User The Response object @router /service-accounts [get]

func (*ApiController) GetSessionApplication ¶

func (c *ApiController) GetSessionApplication() *object.Application

func (*ApiController) GetSessionData ¶

func (c *ApiController) GetSessionData() *SessionData

GetSessionData ...

func (*ApiController) GetSessionOidc ¶

func (c *ApiController) GetSessionOidc() (string, string)

func (*ApiController) GetSessionToken ¶

func (c *ApiController) GetSessionToken() string

func (*ApiController) GetSessionUsername ¶

func (c *ApiController) GetSessionUsername() string

GetSessionUsername ...

func (*ApiController) GetSessions ¶

func (c *ApiController) GetSessions()

GetSessions @Title GetSessions @Tag Session API @Description Get organization user sessions. @Param owner query string true "The organization name" @Success 200 {array} string The Response object @router /get-sessions [get]

func (*ApiController) GetSingleSession ¶

func (c *ApiController) GetSingleSession()

GetSingleSession @Title GetSingleSession @Tag Session API @Description Get session for one user in one application. @Param sessionPkId query string true "The session ID in format: organization/user/application (e.g., superuser/admin/app-hanzo)" @Success 200 {array} string The Response object @router /get-session [get]

func (*ApiController) GetSite ¶

func (c *ApiController) GetSite()

GetSite @Title GetSite @Tag Site API @Description get site @Param id query string true "The id ( owner/name ) of the site" @Success 200 {object} object.Site The Response object @router /get-site [get]

func (*ApiController) GetSites ¶

func (c *ApiController) GetSites()

GetSites @Title GetSites @Tag Site API @Description get sites @Param owner query string true "The owner of sites" @Success 200 {array} object.Site The Response object @router /get-sites [get]

func (*ApiController) GetSortedUsers ¶

func (c *ApiController) GetSortedUsers()

GetSortedUsers @Title GetSortedUsers @Tag User API @Description @Param owner query string true "The owner of users" @Param sorter query string true "The DB column name to sort by, e.g., created_time" @Param limit query string true "The count of users to return, e.g., 25" @Success 200 {array} object.User The Response object @router /get-sorted-users [get]

func (*ApiController) GetSyncer ¶

func (c *ApiController) GetSyncer()

GetSyncer @Title GetSyncer @Tag Syncer API @Description get syncer @Param id query string true "The id ( owner/name ) of the syncer" @Success 200 {object} object.Syncer The Response object @router /get-syncer [get]

func (*ApiController) GetSyncers ¶

func (c *ApiController) GetSyncers()

GetSyncers @Title GetSyncers @Tag Syncer API @Description get syncers @Param owner query string true "The owner of syncers" @Success 200 {array} object.Syncer The Response object @router /get-syncers [get]

func (*ApiController) GetSystemInfo ¶

func (c *ApiController) GetSystemInfo()

GetSystemInfo @Title GetSystemInfo @Tag System API @Description get system info like CPU and memory usage @Success 200 {object} util.SystemInfo The Response object @router /get-system-info [get]

func (*ApiController) GetTicket ¶

func (c *ApiController) GetTicket()

GetTicket @Title GetTicket @Tag Ticket API @Description get ticket @Param id query string true "The id ( owner/name ) of the ticket" @Success 200 {object} object.Ticket The Response object @router /get-ticket [get]

func (*ApiController) GetTickets ¶

func (c *ApiController) GetTickets()

GetTickets @Title GetTickets @Tag Ticket API @Description get tickets @Param owner query string true "The owner of tickets" @Success 200 {array} object.Ticket The Response object @router /get-tickets [get]

func (*ApiController) GetToken ¶

func (c *ApiController) GetToken()

GetToken @Title GetToken @Tag Token API @Description get token @Param id query string true "The token ID in format: organization/token-name (e.g., admin/token-123456)" @Success 200 {object} object.Token The Response object @router /get-token [get]

func (*ApiController) GetTokens ¶

func (c *ApiController) GetTokens()

GetTokens @Title GetTokens @Tag Token API @Description get tokens @Param owner query string true "The organization name (e.g., admin)" @Param pageSize query string true "The size of each page" @Param p query string true "The number of the page" @Success 200 {array} object.Token The Response object @router /get-tokens [get]

func (*ApiController) GetUser ¶

func (c *ApiController) GetUser()

GetUser @Title GetUser @Tag User API @Description get user @Param id query string false "The id ( owner/name ) of the user" @Param owner query string false "The owner of the user" @Param email query string false "The email of the user" @Param phone query string false "The phone of the user" @Param userId query string false "The userId of the user" @Success 200 {object} object.User The Response object @router /get-user [get]

func (*ApiController) GetUserApplication ¶

func (c *ApiController) GetUserApplication()

GetUserApplication @Title GetUserApplication @Tag Application API @Description get the detail of the user's application @Param id query string true "The id ( owner/name ) of the user" @Success 200 {object} object.Application The Response object @router /get-user-application [get]

func (*ApiController) GetUserCount ¶

func (c *ApiController) GetUserCount()

GetUserCount @Title GetUserCount @Tag User API @Description @Param owner query string true "The owner of users" @Param isOnline query string true "The filter for query, 1 for online, 0 for offline, empty string for all users" @Success 200 {int} int The count of filtered users for an organization @router /get-user-count [get]

func (*ApiController) GetUserVerifications ¶

func (c *ApiController) GetUserVerifications()

GetUserVerifications @Title GetUserVerifications @Tag Verification API @Description get payments for a user @Param owner query string true "The owner of payments" @Param organization query string true "The organization of the user" @Param user query string true "The username of the user" @Success 200 {array} object.Verification The Response object @router /get-user-payments [get]

func (*ApiController) GetUserinfo ¶

func (c *ApiController) GetUserinfo()

GetUserinfo UserInfo @Title UserInfo @Tag Account API @Description return user information according to OIDC standards @Success 200 {object} object.Userinfo The Response object @router /userinfo [get]

func (*ApiController) GetUserinfo2 ¶

func (c *ApiController) GetUserinfo2()

GetUserinfo2 LaravelResponse @Title UserInfo2 @Tag Account API @Description return Laravel compatible user information according to OAuth 2.0 @Success 200 {object} controllers.LaravelResponse The Response object @router /user [get]

func (*ApiController) GetUsers ¶

func (c *ApiController) GetUsers()

GetUsers @Title GetUsers @Tag User API @Description @Param owner query string true "The owner of users" @Success 200 {array} object.User The Response object @router /get-users [get]

func (*ApiController) GetUsersByAttribute ¶ added in v1.18.7

func (c *ApiController) GetUsersByAttribute()

GetUsersByAttribute @Title GetUsersByAttribute @Tag User API @Description Server-to-server soft-signal lookup: does a user row with this phone/email exist in MY org? Auth: client_credentials JWT only. User JWTs (authorization_code/password) are rejected with 403. @Param phone query string false "phone in any common form" @Param email query string false "email" @Success 200 {object} controllers.Response 200 with possibly-empty array @router /users/by-attribute [get]

func (*ApiController) GetVerification ¶

func (c *ApiController) GetVerification()

GetVerification @Title GetVerification @Tag Verification API @Description get payment @Param id query string true "The id ( owner/name ) of the payment" @Success 200 {object} object.Verification The Response object @router /get-payment [get]

func (*ApiController) GetVerifications ¶

func (c *ApiController) GetVerifications()

GetVerifications @Title GetVerifications @Tag Verification API @Description get payments @Param owner query string true "The owner of payments" @Success 200 {array} object.Verification The Response object @router /get-payments [get]

func (*ApiController) GetVerifyIdentityStatus ¶

func (c *ApiController) GetVerifyIdentityStatus()

GetVerifyIdentityStatus retrieves the current status of a verification. @Title GetVerifyIdentityStatus @Tag IDV API @Description Get identity verification status @Param id query string true "Verification ID" @Param provider query string false "Provider name (default: jumio)" @Success 200 {object} cidv.VerificationStatusResult @router /verify-identity/status [get]

func (*ApiController) GetVersionInfo ¶

func (c *ApiController) GetVersionInfo()

GetVersionInfo @Title GetVersionInfo @Tag System API @Description get version info like IAM release version and commit ID @Success 200 {object} util.VersionInfo The Response object @router /get-version-info [get]

func (*ApiController) GetWeb3Nonce ¶ added in v1.22.1

func (c *ApiController) GetWeb3Nonce()

GetWeb3Nonce mints a single-use login nonce and returns the CAIP-122 challenge.

Route: GET /v1/iam/web3/nonce?chain=<evm|solana|bitcoin|ton|xrp>&address=<addr>

The (chain,address) are advisory here (they let us scope/rate-limit the nonce); the authoritative binding happens in VerifyProof against the SIGNED message.

func (*ApiController) GetWebhook ¶

func (c *ApiController) GetWebhook()

GetWebhook @Title GetWebhook @Tag Webhook API @Description get webhook @Param id query string superuser/admin true "The id ( owner/name ) of the webhook" @Success 200 {object} object.Webhook The Response object @router /get-webhook [get]

func (*ApiController) GetWebhookEventType ¶

func (c *ApiController) GetWebhookEventType()

GetWebhookEventType ... @Tag System API @Title GetWebhookEventType @router /get-webhook-event [GET] @Param ticket query string true "The eventId of QRCode" @Success 200 {object} controllers.Response The Response object

func (*ApiController) GetWebhooks ¶

func (c *ApiController) GetWebhooks()

GetWebhooks @Title GetWebhooks @Tag Webhook API @Description get webhooks @Param owner query string superuser/admin true "The owner of webhooks" @Success 200 {array} object.Webhook The Response object @router /get-webhooks [get] @Security test_apiKey

func (*ApiController) GrantConsent ¶

func (c *ApiController) GrantConsent()

GrantConsent grants consent for an OAuth application and returns authorization code @Title GrantConsent @Tag Consent API @Description grant consent for an OAuth application and get authorization code @Param body body object.ConsentRecord true "The consent object with OAuth parameters" @Success 200 {object} controllers.Response The Response object @router /grant-consent [post]

func (*ApiController) HandleLoggedIn ¶

func (c *ApiController) HandleLoggedIn(application *object.Application, user *object.User, form *form.AuthForm) (resp *Response)

HandleLoggedIn ...

func (*ApiController) HandleOfficialAccountEvent ¶

func (c *ApiController) HandleOfficialAccountEvent()

HandleOfficialAccountEvent ... @Tag System API @Title HandleOfficialAccountEvent @router /webhook [POST] @Success 200 {object} controllers.Response The Response object

func (*ApiController) HandleSamlLogin ¶

func (c *ApiController) HandleSamlLogin()

func (*ApiController) HandleSamlRedirect ¶

func (c *ApiController) HandleSamlRedirect()

func (*ApiController) Health ¶

func (c *ApiController) Health()

Health @Title Health @Tag System API @Description check if the system is live @Success 200 {object} controllers.Response The Response object @router /health [get]

func (*ApiController) ImpersonateUser ¶

func (c *ApiController) ImpersonateUser()

ImpersonateUser @Title ImpersonateUser @Tag User API @Description set impersonation user for current admin session @Param username formData string true "The username to impersonate (owner/name)" @Success 200 {object} controllers.Response The Response object @router /impersonation-user [post]

func (*ApiController) IntrospectToken ¶

func (c *ApiController) IntrospectToken()

IntrospectToken @Title IntrospectToken @Tag Login API @Description The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON document representing the meta information surrounding the token, including whether this token is currently active. This endpoint support Basic Authorization and authorization defined in RFC 7523.

@Param token formData string true "access_token's value or refresh_token's value" @Param token_type_hint formData string true "the token type access_token or refresh_token" @Success 200 {object} object.IntrospectionResponse The Response object @Success 400 {object} object.TokenError The Response object @Success 401 {object} object.TokenError The Response object @router /v1/iam/oauth/introspect [post]

func (*ApiController) IsAdmin ¶

func (c *ApiController) IsAdmin() bool

func (*ApiController) IsAdminOrSelf ¶

func (c *ApiController) IsAdminOrSelf(user2 *object.User) bool

func (*ApiController) IsMaskedEnabled ¶

func (c *ApiController) IsMaskedEnabled() (bool, bool)

IsMaskedEnabled ...

func (*ApiController) IsOrgAdmin ¶

func (c *ApiController) IsOrgAdmin() (bool, bool)

func (*ApiController) IsServiceTokenAuthenticated ¶

func (c *ApiController) IsServiceTokenAuthenticated() bool

func (*ApiController) IsSessionDuplicated ¶

func (c *ApiController) IsSessionDuplicated()

IsSessionDuplicated @Title IsSessionDuplicated @Tag Session API @Description Check if there are other different sessions for one user in one application. @Param sessionPkId query string true "The session ID in format: organization/user/application (e.g., superuser/admin/app-hanzo)" @Param sessionId query string true "The specific session ID to check" @Success 200 {array} string The Response object @router /is-session-duplicated [get]

func (*ApiController) IsSuperAdmin ¶ added in v1.31.21

func (c *ApiController) IsSuperAdmin() bool

IsSuperAdmin reports whether the request's session principal is a Hanzo super admin (a member of conf.AdminOrg). This is the CANONICAL name for the gate.

func (*ApiController) IssueCap ¶ added in v1.19.3

func (c *ApiController) IssueCap()

IssueCap serves POST /v1/iam/cap/issue. Caller is authenticated by the existing JWT/session machinery (RequireSignedIn); the cap is bound to the signed-in principal unless an explicit HolderHex is supplied.

@Title IssueCap @Tag Cap API @Description mint a fresh ZAP capability for the signed-in principal @Success 200 {object} controllers.capIssueResponse @router /cap/issue [post]

func (*ApiController) IssueUserToken ¶ added in v1.28.2

func (c *ApiController) IssueUserToken()

IssueUserToken @Title IssueUserToken @Tag User API @Description Issue a short-lived, user-bound IAM JWT for a target user, to a

confidential trusted client (e.g. hanzo-console) that forwards it to a
resource server (e.g. commerce) which derives the user's org from the
verified `owner` claim. This is the SSR analogue of a browser presenting
its own IAM token: a server-side app that holds only an identity REFERENCE
(the session sub) — not a forwardable token — gets a per-user token to act
on the user's behalf, so the resource server enforces tenant isolation
server-side instead of trusting a shared, all-org service token.

Authorization is IDENTICAL to MintUserKeys (resolveTargetUserForKeys): a global admin, the target user themselves, or an app in IAM_KEY_MINT_ALLOWED_APPS (CapKeyMint). Both primitives produce a credential that bills the user's org, so they share ONE trust boundary — issuing a token is no more privileged than minting that user's hk- key, which the same callers already do.

@Param id query string true "The user ID (<org>/<name>)" @Param aud query string false "Explicit token audience (RFC 8707). Set to a value the resource server accepts; defaults to the minting app's clientId." @Param scope query string false "OAuth scope (default: profile)" @Success 200 {object} controllers.Response The Response object @router /issue-user-token [post]

func (*ApiController) IssuerKeys ¶ added in v1.19.3

func (c *ApiController) IssuerKeys()

IssuerKeys serves GET /v1/iam/cap/issuer-keys. Public — no auth required; resource servers and SDKs both hit this on a polling cadence.

@Title IssuerKeys @Tag Cap API @Description list active cap-signing public keys @Success 200 {object} controllers.issuerKeysResponse @router /cap/issuer-keys [get]

func (*ApiController) KerberosLogin ¶

func (c *ApiController) KerberosLogin()

KerberosLogin @Title KerberosLogin @Tag Login API @Description Kerberos/SPNEGO login via Integrated Windows Authentication @Param application query string true "application name" @Success 200 {object} controllers.Response The Response object @router /kerberos-login [get]

func (*ApiController) Login ¶

func (c *ApiController) Login()

Login ... @Title Login @Tag Login API @Description login @Param clientId query string true clientId @Param responseType query string true responseType @Param redirectUri query string true redirectUri @Param scope query string false scope @Param state query string false state @Param nonce query string false nonce @Param code_challenge_method query string false code_challenge_method @Param code_challenge query string false code_challenge @Param form body controllers.AuthForm true "Login information" @Success 200 {object} controllers.Response The Response object @router /login [post]

func (*ApiController) Logout ¶

func (c *ApiController) Logout()

Logout @Title Logout @Tag Login API @Description logout the current user @Param id_token_hint query string false "id_token_hint" @Param post_logout_redirect_uri query string false "post_logout_redirect_uri" @Param state query string false "state" @Success 200 {object} controllers.Response The Response object @router /logout [post]

func (*ApiController) McpResponseError ¶

func (c *ApiController) McpResponseError(id interface{}, code int, message string, data interface{})

func (*ApiController) MfaSetupEnable ¶

func (c *ApiController) MfaSetupEnable()

MfaSetupEnable @Title MfaSetupEnable @Tag MFA API @Description enable totp @param owner form string true "owner of user" @param name form string true "name of user" @param type form string true "MFA auth type" @Success 200 {object} controllers.Response The Response object @router /mfa/setup/enable [post]

func (*ApiController) MfaSetupInitiate ¶

func (c *ApiController) MfaSetupInitiate()

MfaSetupInitiate @Title MfaSetupInitiate @Tag MFA API @Description setup MFA @param owner form string true "owner of user" @param name form string true "name of user" @param type form string true "MFA auth type" @Success 200 {object} controllers.Response The Response object @router /mfa/setup/initiate [post]

func (*ApiController) MfaSetupVerify ¶

func (c *ApiController) MfaSetupVerify()

MfaSetupVerify @Title MfaSetupVerify @Tag MFA API @Description setup verify totp @param secret form string true "MFA secret" @param passcode form string true "MFA passcode" @Success 200 {object} controllers.Response The Response object @router /mfa/setup/verify [post]

func (*ApiController) MintUserKeys ¶ added in v1.25.3

func (c *ApiController) MintUserKeys()

MintUserKeys @Title MintUserKeys @Tag User API @Description (re)generate the per-user hk- Cloud API key (User.AccessKey /

User.AccessSecret) for the target user and return the new accessKey. This is
the self-serve minting primitive: an allowlisted confidential client (e.g.
the console, authenticated by clientId+clientSecret) calls it on behalf of
its authenticated end-user — authorization is enforced in
resolveTargetUserForKeys (admin OR self OR IAM_KEY_MINT_ALLOWED_APPS). It is
deliberately NOT routed under the add-/update- prefixes so the name-character
FieldValidationFilter does not reject email-named users, and the object-layer
mint (object.AddUserKeys) writes ONLY the two access-key columns, never
re-validating the (possibly email-named) `name`.

@Param id query string true "The user ID (<org>/<name>)" @Success 200 {object} controllers.Response The Response object @router /mint-user-keys [post]

func (*ApiController) OAuthAuthorizeRedirect ¶

func (c *ApiController) OAuthAuthorizeRedirect()

OAuthAuthorizeRedirect handles GET /v1/iam/oauth/authorize (the OIDC discovery-advertised authorization endpoint) by 302ing to the SPA login page at /login/oauth/authorize, preserving all query parameters. The React SPA mounts the login form at that frontend route. @Title OAuthAuthorizeRedirect @Tag Login API @Description redirect to SPA login page for OAuth authorization @router /v1/iam/oauth/authorize [get]

func (*ApiController) ProxyServer ¶

func (c *ApiController) ProxyServer()

ProxyServer @Title ProxyServer @Tag Server API @Description proxy request to the upstream MCP server by Server URL @Param owner path string true "The owner name of the server" @Param name path string true "The name of the server" @Success 200 {object} mcp.McpResponse The Response object @router /server/:owner/:name [post]

func (*ApiController) RefreshToken ¶

func (c *ApiController) RefreshToken()

RefreshToken @Title RefreshToken @Tag Token API @Description refresh OAuth access token @Param grant_type query string true "OAuth grant type" @Param refresh_token query string true "OAuth refresh token" @Param scope query string true "OAuth scope" @Param client_id query string true "OAuth client id" @Param client_secret query string false "OAuth client secret" @Success 200 {object} object.TokenWrapper The Response object @Success 400 {object} object.TokenError The Response object @Success 401 {object} object.TokenError The Response object @router /v1/iam/oauth/refresh_token [post]

func (*ApiController) RejectUser ¶ added in v1.31.18

func (c *ApiController) RejectUser()

RejectUser marks a pending user rejected (keeps them off the app; a distinct terminal state from pending so the queue can filter them out).

Endpoint: POST /v1/iam/reject-user body: {"id":"<owner>/<name>"} Auth: same as ApproveUser.

func (*ApiController) RemovePolicy ¶

func (c *ApiController) RemovePolicy()

RemovePolicy @Title RemovePolicy @Tag Enforcer API @Description remove policy @Param id query string true "The id ( owner/name ) of enforcer" @Param body body util.AuthzRule true "The policy to remove" @Success 200 {object} Response @router /remove-policy [post]

func (*ApiController) RemoveUserFromGroup ¶

func (c *ApiController) RemoveUserFromGroup()

func (*ApiController) RequireAdmin ¶

func (c *ApiController) RequireAdmin() (string, bool)

RequireAdmin ...

func (*ApiController) RequireSignedIn ¶

func (c *ApiController) RequireSignedIn() (string, bool)

RequireSignedIn ...

func (*ApiController) RequireSignedInUser ¶

func (c *ApiController) RequireSignedInUser() (*object.User, bool)

RequireSignedInUser ...

func (*ApiController) ResetEmailOrPhone ¶

func (c *ApiController) ResetEmailOrPhone()

ResetEmailOrPhone ... @Tag Account API @Title ResetEmailOrPhone @router /reset-email-or-phone [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) ResponseError ¶

func (c *ApiController) ResponseError(error string, data ...interface{})

ResponseError ...

func (*ApiController) ResponseJsonData ¶

func (c *ApiController) ResponseJsonData(resp *Response, data ...interface{})

ResponseJsonData ...

func (*ApiController) ResponseOk ¶

func (c *ApiController) ResponseOk(data ...interface{})

ResponseOk ...

func (*ApiController) ResponseTokenError ¶

func (c *ApiController) ResponseTokenError(errorMsg string, errorDescription string)

func (*ApiController) RevokeCap ¶ added in v1.19.3

func (c *ApiController) RevokeCap()

RevokeCap serves POST /v1/iam/cap/revoke. IAM-admin-only: the same privilege required to manage other tenants' tokens. Caller MUST have admin privileges in the org named in the JWT — RequireAdmin enforces.

v1 stores the revocation in the in-memory MemoryStore. Production gossip (PubSub topic "iam.cap.revocation") is a follow-up; the controller emits no gossip today, so revocations only take effect at THIS IAM replica until the topic is wired.

@Title RevokeCap @Tag Cap API @Description revoke a previously-issued cap @Success 200 {object} controllers.capRevokeResponse @router /cap/revoke [post]

func (*ApiController) RevokeConsent ¶

func (c *ApiController) RevokeConsent()

RevokeConsent revokes a consent record @Title RevokeConsent @Tag Consent API @Description revoke a consent record @Param body body object.ConsentRecord true "The consent object" @Success 200 {object} controllers.Response The Response object @router /revoke-consent [post]

func (*ApiController) RevokeToken ¶

func (c *ApiController) RevokeToken()

RevokeToken @Title RevokeToken @Tag Token API @Description Revoke an OAuth 2.0 token (access_token or refresh_token). Implements RFC 7009 - OAuth 2.0 Token Revocation. This endpoint supports both Basic Authorization, JWT client assertion (RFC 7523), and form-encoded client credentials.

@Param token formData string true "The token to revoke" @Param token_type_hint formData string false "Hint about the token type: access_token or refresh_token" @Param client_id formData string false "OAuth client ID (if not using Basic Auth)" @Param client_secret formData string false "OAuth client secret (if not using Basic Auth)" @Success 200 {object} object.Response Success (RFC 7009 requires 200 even for invalid tokens) @Success 401 {object} object.TokenError Invalid client credentials @router /v1/iam/oauth/revoke [post]

func (*ApiController) RevokeUserKeys ¶ added in v1.25.3

func (c *ApiController) RevokeUserKeys()

RevokeUserKeys @Title RevokeUserKeys @Tag User API @Description clear the per-user hk- Cloud API key for the target user. @Param id query string true "The user ID (<org>/<name>)" @Success 200 {object} controllers.Response The Response object @router /revoke-user-keys [post]

func (*ApiController) RotateServiceAccountKey ¶ added in v1.31.1

func (c *ApiController) RotateServiceAccountKey()

RotateServiceAccountKey @Title RotateServiceAccountKey @Tag ServiceAccount API @Description Rotate (mint a new) API key for a service account, invalidating

the prior key immediately. Returns the new raw access key + secret EXACTLY
ONCE.

@Param name path string true "The service account name (<org>-<agent>)" @Param organization query string true "The owning organization" @Success 200 {object} controllers.Response The Response object @router /service-accounts/:name/keys [post]

func (*ApiController) RunSyncer ¶

func (c *ApiController) RunSyncer()

RunSyncer @Title RunSyncer @Tag Syncer API @Description run syncer @Param body body object.Syncer true "The details of the syncer" @Success 200 {object} controllers.Response The Response object @router /run-syncer [get]

func (*ApiController) SendInvitation ¶

func (c *ApiController) SendInvitation()

SendInvitation @Title VerifyInvitation @Tag Invitation API @Description verify invitation @Param id query string true "The id ( owner/name ) of the invitation" @Param body body []string true "The details of the invitation" @Success 200 {object} controllers.Response The Response object @router /send-invitation [post]

func (*ApiController) SendNotification ¶

func (c *ApiController) SendNotification()

SendNotification @Title SendNotification @Tag Service API @Description This API is not for IAM frontend to call, it is for IAM SDKs. @Param from body controllers.NotificationForm true "Details of the notification request" @Success 200 {object} controllers.Response The Response object @router /send-notification [post]

func (*ApiController) SendVerificationCode ¶

func (c *ApiController) SendVerificationCode()

SendVerificationCode ... @Title SendVerificationCode @Tag Verification API @router /send-verification-code [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) SetPassword ¶

func (c *ApiController) SetPassword()

SetPassword @Title SetPassword @Tag Account API @Description set password @Param userOwner formData string true "The owner of the user" @Param userName formData string true "The name of the user" @Param oldPassword formData string true "The old password of the user" @Param newPassword formData string true "The new password of the user" @Success 200 {object} controllers.Response The Response object @router /set-password [post]

func (*ApiController) SetPreferredMfa ¶

func (c *ApiController) SetPreferredMfa()

SetPreferredMfa @Title SetPreferredMfa @Tag MFA API @Description: Set specific Mfa Preferred @param owner form string true "owner of user" @param name form string true "name of user" @param id form string true "id of user's MFA props" @Success 200 {object} controllers.Response The Response object @router /set-preferred-mfa [post]

func (*ApiController) SetSessionData ¶

func (c *ApiController) SetSessionData(s *SessionData)

SetSessionData ...

func (*ApiController) SetSessionToken ¶

func (c *ApiController) SetSessionToken(accessToken string)

func (*ApiController) SetSessionUsername ¶

func (c *ApiController) SetSessionUsername(user string)

SetSessionUsername ... SetSessionUsername records the authenticated user on the session. On the authentication transition (a non-empty user) it FIRST regenerates the session id — issuing a fresh sid and destroying the one the browser presented — so a session id planted before login (session fixation) can never survive the sign-in and be replayed by an attacker. This is the single chokepoint every sign-in path funnels through (password, SSO/social, OTP verification, WebAuthn, web3), so the defense cannot be bypassed per-path — the same reason the approval stamp had to live on the common AddUser path, not each caller.

SessionRegenerateID migrates existing session data to the new sid and deletes the old sid (provider.SessionRegenerate), so pre-auth state is preserved while the pre-auth id is invalidated. De-authentication (empty user) already regenerates in ClearUserSession, so we skip the redundant regen here.

func (*ApiController) SetTokenErrorHttpStatus ¶

func (c *ApiController) SetTokenErrorHttpStatus()

SetTokenErrorHttpStatus sets HTTP status and RFC 6749 §5.1 required headers for OAuth token responses. Successful token responses MUST include Cache-Control: no-store and Pragma: no-cache (RFC 6749 §5.1).

func (*ApiController) Signup ¶

func (c *ApiController) Signup()

Signup @Tag Login API @Title Signup @Description sign up a new user @Param username formData string true "The username to sign up" @Param password formData string true "The password" @Success 200 {object} controllers.Response The Response object @router /signup [post]

func (*ApiController) SsoLogout ¶

func (c *ApiController) SsoLogout()

SsoLogout @Title SsoLogout @Tag Login API @Description logout the current user from all applications or current session only @Param logoutAll query string false "Whether to logout from all sessions. Accepted values: 'true', '1', or empty (default: true). Any other value means false." @Success 200 {object} controllers.Response The Response object @router /sso-logout [get,post]

func (*ApiController) SyncInitData ¶

func (c *ApiController) SyncInitData()

SyncInitData @Title SyncInitData @Tag System API @Description re-run init_data.json sync (idempotent with initDataNewOnly=true) @Success 200 {object} controllers.Response The Response object @router /sync-init-data [post]

func (*ApiController) SyncLdapUsers ¶

func (c *ApiController) SyncLdapUsers()

SyncLdapUsers @Title SyncLdapUsers @Tag Account API @Description sync ldap users @Param id query string true "id" @Success 200 {object} controllers.LdapSyncResp The Response object @router /sync-ldap-users [post]

func (*ApiController) T ¶

func (c *ApiController) T(error string) string

func (*ApiController) TestSyncerDb ¶

func (c *ApiController) TestSyncerDb()

func (*ApiController) Unlink ¶

func (c *ApiController) Unlink()

Unlink ... @Tag Login API @Title Unlink @router /unlink [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) UpdateAdapter ¶

func (c *ApiController) UpdateAdapter()

UpdateAdapter @Title UpdateAdapter @Tag Adapter API @Description update adapter @Param id query string true "The id ( owner/name ) of the adapter" @Param body body object.Adapter true "The details of the adapter" @Success 200 {object} controllers.Response The Response object @router /update-adapter [post]

func (*ApiController) UpdateApplication ¶

func (c *ApiController) UpdateApplication()

UpdateApplication @Title UpdateApplication @Tag Application API @Description update an application @Param id query string true "The id ( owner/name ) of the application" @Param body body object.Application true "The details of the application" @Success 200 {object} controllers.Response The Response object @router /update-application [post]

func (*ApiController) UpdateCert ¶

func (c *ApiController) UpdateCert()

UpdateCert @Title UpdateCert @Tag Cert API @Description update cert @Param id query string true "The id ( owner/name ) of the cert" @Param body body object.Cert true "The details of the cert" @Success 200 {object} controllers.Response The Response object @router /update-cert [post]

func (*ApiController) UpdateCertDomainExpire ¶

func (c *ApiController) UpdateCertDomainExpire()

UpdateCertDomainExpire @Title UpdateCertDomainExpire @Tag Cert API @Description update cert domain expire time @Param id query string true "The ID of the cert" @Success 200 {object} controllers.Response The Response object @router /update-cert-domain-expire [post]

func (*ApiController) UpdateEnforcer ¶

func (c *ApiController) UpdateEnforcer()

UpdateEnforcer @Title UpdateEnforcer @Tag Enforcer API @Description update enforcer @Param id query string true "The id ( owner/name ) of enforcer" @Param enforcer body object true "The enforcer object" @Success 200 {object} object.Enforcer @router /update-enforcer [post]

func (*ApiController) UpdateForm ¶

func (c *ApiController) UpdateForm()

UpdateForm @Title UpdateForm @Tag Form API @Description update form @Param id query string true "The id (owner/name) of the form" @Param body body object.Form true "The details of the form" @Success 200 {object} controllers.Response The Response object @router /update-form [post]

func (*ApiController) UpdateGroup ¶

func (c *ApiController) UpdateGroup()

UpdateGroup @Title UpdateGroup @Tag Group API @Description update group @Param id query string true "The id ( owner/name ) of the group" @Param body body object.Group true "The details of the group" @Success 200 {object} controllers.Response The Response object @router /update-group [post]

func (*ApiController) UpdateInvitation ¶

func (c *ApiController) UpdateInvitation()

UpdateInvitation @Title UpdateInvitation @Tag Invitation API @Description update invitation @Param id query string true "The id ( owner/name ) of the invitation" @Param body body object.Invitation true "The details of the invitation" @Success 200 {object} controllers.Response The Response object @router /update-invitation [post]

func (*ApiController) UpdateKey ¶

func (c *ApiController) UpdateKey()

UpdateKey @Title UpdateKey @Tag Key API @Description update key @Param id query string true "The id ( owner/name ) of the key" @Param body body object.Key true "The details of the key" @Success 200 {object} controllers.Response The Response object @router /update-key [post]

func (*ApiController) UpdateLdap ¶

func (c *ApiController) UpdateLdap()

UpdateLdap @Title UpdateLdap @Tag Account API @Description update ldap @Param body body object.Ldap true "The details of the ldap" @Success 200 {object} controllers.Response The Response object @router /update-ldap [post]

func (*ApiController) UpdateMeProfile ¶ added in v1.19.3

func (c *ApiController) UpdateMeProfile()

UpdateMeProfile @Title UpdateMeProfile @Tag Account API @Description update the signed-in user's editable profile fields @Success 200 {object} MeProfile The updated profile @router /me/profile [put]

func (*ApiController) UpdateModel ¶

func (c *ApiController) UpdateModel()

UpdateModel @Title UpdateModel @Tag Model API @Description update model @Param id query string true "The id ( owner/name ) of the model" @Param body body object.Model true "The details of the model" @Success 200 {object} controllers.Response The Response object @router /update-model [post]

func (*ApiController) UpdateOrganization ¶

func (c *ApiController) UpdateOrganization()

UpdateOrganization ... @Title UpdateOrganization @Tag Organization API @Description update organization @Param id query string true "The id ( owner/name ) of the organization" @Param body body object.Organization true "The details of the organization" @Success 200 {object} controllers.Response The Response object @router /update-organization [post]

func (*ApiController) UpdatePermission ¶

func (c *ApiController) UpdatePermission()

UpdatePermission @Title UpdatePermission @Tag Permission API @Description update permission @Param id query string true "The id ( owner/name ) of the permission" @Param body body object.Permission true "The details of the permission" @Success 200 {object} controllers.Response The Response object @router /update-permission [post]

func (*ApiController) UpdatePolicy ¶

func (c *ApiController) UpdatePolicy()

UpdatePolicy @Title UpdatePolicy @Tag Enforcer API @Description update policy @Param id query string true "The id ( owner/name ) of enforcer" @Param body body []util.AuthzRule true "Array containing old and new policy" @Success 200 {object} Response @router /update-policy [post]

func (*ApiController) UpdatePreferences ¶ added in v1.31.22

func (c *ApiController) UpdatePreferences()

UpdatePreferences @Title UpdatePreferences @Tag Account API @Description shallow-merge a partial preferences object onto the signed-in user's account (self-scoped, cross-device). Returns the merged preferences. @Param body body object true "partial preferences object (top-level keys shallow-merged)" @Success 200 {object} controllers.Response The merged preferences in `data` @router /update-preferences [post]

func (*ApiController) UpdateProject ¶

func (c *ApiController) UpdateProject()

UpdateProject @Title UpdateProject @Tag Project API @Description Update an existing project @Param id query string true "The project ID (owner/name)" @Param body body object.Project true "The project details" @Success 200 {object} controllers.Response @router /update-project [post]

func (*ApiController) UpdateProvider ¶

func (c *ApiController) UpdateProvider()

UpdateProvider @Title UpdateProvider @Tag Provider API @Description update provider @Param id query string true "The id ( owner/name ) of the provider" @Param body body object.Provider true "The details of the provider" @Success 200 {object} controllers.Response The Response object @router /update-provider [post]

func (*ApiController) UpdateResource ¶

func (c *ApiController) UpdateResource()

UpdateResource @Tag Resource API @Title UpdateResource @Description get resource @Param id query string true "The id ( owner/name ) of resource" @Param resource body object.Resource true "The resource object" @Success 200 {object} controllers.Response Success or error @router /update-resource [post]

func (*ApiController) UpdateRole ¶

func (c *ApiController) UpdateRole()

UpdateRole @Title UpdateRole @Tag Role API @Description update role @Param id query string true "The id ( owner/name ) of the role" @Param body body object.Role true "The details of the role" @Success 200 {object} controllers.Response The Response object @router /update-role [post]

func (*ApiController) UpdateRule ¶

func (c *ApiController) UpdateRule()

UpdateRule @Title UpdateRule @Tag Rule API @Description update rule @Param id query string true "The id ( owner/name ) of the rule" @Param body body object.Rule true "The details of the rule" @Success 200 {object} controllers.Response The Response object @router /update-rule [post]

func (*ApiController) UpdateServer ¶

func (c *ApiController) UpdateServer()

UpdateServer @Title UpdateServer @Tag Server API @Description update server @Param id query string true "The id ( owner/name ) of the server" @Param body body object.Server true "The details of the server" @Success 200 {object} controllers.Response The Response object @router /update-server [post]

func (*ApiController) UpdateSession ¶

func (c *ApiController) UpdateSession()

UpdateSession @Title UpdateSession @Tag Session API @Description Update session for one user in one application. @Param body body object.Session true "The session object to update" @Success 200 {object} controllers.Response The Response object @router /update-session [post]

func (*ApiController) UpdateSite ¶

func (c *ApiController) UpdateSite()

UpdateSite @Title UpdateSite @Tag Site API @Description update site @Param id query string true "The id ( owner/name ) of the site" @Param body body object.Site true "The details of the site" @Success 200 {object} controllers.Response The Response object @router /update-site [post]

func (*ApiController) UpdateSyncer ¶

func (c *ApiController) UpdateSyncer()

UpdateSyncer @Title UpdateSyncer @Tag Syncer API @Description update syncer @Param id query string true "The id ( owner/name ) of the syncer" @Param body body object.Syncer true "The details of the syncer" @Success 200 {object} controllers.Response The Response object @router /update-syncer [post]

func (*ApiController) UpdateTicket ¶

func (c *ApiController) UpdateTicket()

UpdateTicket @Title UpdateTicket @Tag Ticket API @Description update ticket @Param id query string true "The id ( owner/name ) of the ticket" @Param body body object.Ticket true "The details of the ticket" @Success 200 {object} controllers.Response The Response object @router /update-ticket [post]

func (*ApiController) UpdateToken ¶

func (c *ApiController) UpdateToken()

UpdateToken @Title UpdateToken @Tag Token API @Description update token @Param id query string true "The token ID in format: organization/token-name (e.g., admin/token-123456)" @Param body body object.Token true "Details of the token" @Success 200 {object} controllers.Response The Response object @router /update-token [post]

func (*ApiController) UpdateUser ¶

func (c *ApiController) UpdateUser()

UpdateUser @Title UpdateUser @Tag User API @Description update user @Param id query string false "The id ( owner/name ) of the user" @Param userId query string false "The userId (UUID) of the user" @Param owner query string false "The owner of the user (required when using userId)" @Param body body object.User true "The details of the user" @Success 200 {object} controllers.Response The Response object @router /update-user [post]

func (*ApiController) UpdateWebhook ¶

func (c *ApiController) UpdateWebhook()

UpdateWebhook @Title UpdateWebhook @Tag Webhook API @Description update webhook @Param id query string superuser/admin true "The id ( owner/name ) of the webhook" @Param body body object.Webhook true "The details of the webhook" @Success 200 {object} controllers.Response The Response object @router /update-webhook [post]

func (*ApiController) UploadGroups ¶

func (c *ApiController) UploadGroups()

func (*ApiController) UploadMeAvatar ¶ added in v1.19.3

func (c *ApiController) UploadMeAvatar()

UploadMeAvatar @Title UploadMeAvatar @Tag Account API @Description multipart avatar upload for the signed-in user @Param file formData file true "Avatar file (JPEG, PNG, or WebP, max 2 MB, max 4096x4096)" @Success 200 {object} AvatarResponse The new avatar URL @router /me/avatar [post]

func (*ApiController) UploadPermissions ¶

func (c *ApiController) UploadPermissions()

func (*ApiController) UploadResource ¶

func (c *ApiController) UploadResource()

UploadResource @Tag Resource API @Title UploadResource @Param owner query string true "Owner" @Param user query string true "User" @Param application query string true "Application" @Param tag query string false "Tag" @Param parent query string false "Parent" @Param fullFilePath query string true "Full File Path" @Param createdTime query string false "Created Time" @Param description query string false "Description" @Param file formData file true "Resource file" @Success 200 {object} object.Resource FileUrl, objectKey @router /upload-resource [post]

func (*ApiController) UploadRoles ¶

func (c *ApiController) UploadRoles()

func (*ApiController) UploadUsers ¶

func (c *ApiController) UploadUsers()

func (*ApiController) ValidateOAuth ¶

func (c *ApiController) ValidateOAuth(ignoreValidSecret bool) (ok bool, application *object.Application, clientId, clientSecret string, err error)

func (*ApiController) VerifyAccreditation ¶

func (c *ApiController) VerifyAccreditation()

VerifyAccreditation checks accredited investor status. @Title VerifyAccreditation @Tag IDV API @Description Verify accredited investor status @Param body body idv.AccreditationRequest true "Accreditation request" @Success 200 {object} idv.AccreditationResult @router /verify-accreditation [post]

func (*ApiController) VerifyCaptcha ¶

func (c *ApiController) VerifyCaptcha()

VerifyCaptcha ... @Title VerifyCaptcha @Tag Verification API @router /verify-captcha [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) VerifyCode ¶

func (c *ApiController) VerifyCode()

VerifyCode @Tag Verification API @Title VerifyCode @router /verify-code [post] @Success 200 {object} object.Userinfo The Response object

func (*ApiController) VerifyIdentification ¶

func (c *ApiController) VerifyIdentification()

VerifyIdentification @Title VerifyIdentification @Tag User API @Description verify user's real identity using ID Verification provider @Param owner query string false "The owner of the user (optional, defaults to logged-in user)" @Param name query string false "The name of the user (optional, defaults to logged-in user)" @Param provider query string false "The name of the ID Verification provider (optional, auto-selected if not provided)" @Success 200 {object} controllers.Response The Response object @router /verify-identification [post]

func (*ApiController) VerifyIdentity ¶

func (c *ApiController) VerifyIdentity()

VerifyIdentity initiates an IDV verification flow. @Title VerifyIdentity @Tag IDV API @Description Initiate identity verification (IDV + sanctions + PEP) @Param body body idv.VerifyIdentityRequest true "Verification request" @Success 200 {object} idv.VerifyIdentityResponse @router /verify-identity [post]

func (*ApiController) VerifyIdentityWebhook ¶

func (c *ApiController) VerifyIdentityWebhook()

VerifyIdentityWebhook processes IDV provider callbacks. @Title VerifyIdentityWebhook @Tag IDV API @Description Receive IDV provider webhook callback @Success 200 {object} controllers.Response @router /verify-identity/webhook [post]

func (*ApiController) VerifyInvitation ¶

func (c *ApiController) VerifyInvitation()

VerifyInvitation @Title VerifyInvitation @Tag Invitation API @Description verify invitation @Param id query string true "The id ( owner/name ) of the invitation" @Success 200 {object} controllers.Response The Response object @router /verify-invitation [get]

func (*ApiController) VerifyWeb3 ¶ added in v1.22.1

func (c *ApiController) VerifyWeb3()

VerifyWeb3 verifies a multi-chain wallet login proof and signs the user in.

Route: POST /v1/iam/web3/verify

Thin shell: resolve application/organization/session, hand the proof to object.VerifyWalletLogin (which burns the nonce, runs walletconnect.VerifyProof, and resolves/provisions the user), then HandleLoggedIn -> the SAME success shape as Login().

func (*ApiController) WebAuthnSigninBegin ¶

func (c *ApiController) WebAuthnSigninBegin()

WebAuthnSigninBegin @Title WebAuthnSigninBegin @Tag Login API @Description WebAuthn Login Flow 1st stage @Param owner query string true "owner" @Param name query string true "name" @Success 200 {object} protocol.CredentialAssertion The CredentialAssertion object @router /webauthn/signin/begin [get]

func (*ApiController) WebAuthnSigninFinish ¶

func (c *ApiController) WebAuthnSigninFinish()

WebAuthnSigninFinish @Title WebAuthnSigninFinish @Tag Login API @Description WebAuthn Login Flow 2nd stage @Param body body protocol.CredentialAssertionResponse true "authenticator assertion Response" @Success 200 {object} controllers.Response "The Response object" @router /webauthn/signin/finish [post]

func (*ApiController) WebAuthnSignupBegin ¶

func (c *ApiController) WebAuthnSignupBegin()

WebAuthnSignupBegin @Title WebAuthnSignupBegin @Tag User API @Description WebAuthn Registration Flow 1st stage @Success 200 {object} protocol.CredentialCreation The CredentialCreationOptions object @router /webauthn/signup/begin [get]

func (*ApiController) WebAuthnSignupFinish ¶

func (c *ApiController) WebAuthnSignupFinish()

WebAuthnSignupFinish @Title WebAuthnSignupFinish @Tag User API @Description WebAuthn Registration Flow 2nd stage @Param body body protocol.CredentialCreationResponse true "authenticator attestation Response" @Success 200 {object} controllers.Response "The Response object" @router /webauthn/signup/finish [post]

func (*ApiController) Whoami ¶ added in v1.19.3

func (c *ApiController) Whoami()

Whoami serves /v1/iam/whoami. Dispatches on Authorization scheme: ZAP path goes through the cap verifier; Bearer path keeps the legacy JWT session-lookup behavior; anything else is 401.

@Title Whoami @Tag Account API @Description return the current principal under either ZAP cap or JWT bearer auth @Success 200 {object} controllers.whoamiResponse @router /whoami [get]

func (*ApiController) WhoamiZAP ¶ added in v1.19.3

func (c *ApiController) WhoamiZAP()

WhoamiZAP serves /v1/iam/whoami/zap — ZAP-only, no Bearer fallback. Used for clean A/B testing of the cap path with no chance of an accidental JWT match.

@Title WhoamiZAP @Tag Account API @Description return the current principal under ZAP capability auth only @Success 200 {object} controllers.whoamiResponse @router /whoami/zap [get]

func (*RootController) CasP3ProxyValidate ¶

func (c *RootController) CasP3ProxyValidate()

func (*RootController) CasP3ServiceValidate ¶

func (c *RootController) CasP3ServiceValidate()

func (*RootController) CasProxy ¶

func (c *RootController) CasProxy()

func (*RootController) CasProxyValidate ¶

func (c *RootController) CasProxyValidate()

func (*RootController) CasServiceValidate ¶

func (c *RootController) CasServiceValidate()

func (*RootController) CasValidate ¶

func (c *RootController) CasValidate()

func (*RootController) GetIamDescriptor ¶ added in v1.18.6

func (c *RootController) GetIamDescriptor()

GetIamDescriptor serves the embedded /.well-known/iam.json payload. Bound at both /.well-known/iam.json (legacy/root) and /v1/iam/.well-known/iam.json (canonical per Hanzo policy).

func (*RootController) GetJwks ¶

func (c *RootController) GetJwks()

GetJwks @Title GetJwks @Tag OIDC API @Success 200 {object} jose.JSONWebKey @router /.well-known/jwks [get]

func (*RootController) GetJwksByApplication ¶

func (c *RootController) GetJwksByApplication()

GetJwksByApplication @Title GetJwksByApplication @Tag OIDC API @Param application path string true "application name" @Success 200 {object} jose.JSONWebKey @router /.well-known/:application/jwks [get]

func (*RootController) GetOAuthServerMetadata ¶

func (c *RootController) GetOAuthServerMetadata()

GetOAuthServerMetadata @Title GetOAuthServerMetadata @Tag OAuth API @Description Get OAuth 2.0 Authorization Server Metadata (RFC 8414) @Success 200 {object} object.OidcDiscovery @router /.well-known/oauth-authorization-server [get]

func (*RootController) GetOAuthServerMetadataByApplication ¶

func (c *RootController) GetOAuthServerMetadataByApplication()

GetOAuthServerMetadataByApplication @Title GetOAuthServerMetadataByApplication @Tag OAuth API @Description Get OAuth 2.0 Authorization Server Metadata for specific application (RFC 8414) @Param application path string true "application name" @Success 200 {object} object.OidcDiscovery @router /.well-known/:application/oauth-authorization-server [get]

func (*RootController) GetOauthProtectedResourceMetadata ¶

func (c *RootController) GetOauthProtectedResourceMetadata()

GetOauthProtectedResourceMetadata @Title GetOauthProtectedResourceMetadata @Tag OAuth 2.0 API @Description Get OAuth 2.0 Protected Resource Metadata (RFC 9728) @Success 200 {object} object.OauthProtectedResourceMetadata @router /.well-known/oauth-protected-resource [get]

func (*RootController) GetOauthProtectedResourceMetadataByApplication ¶

func (c *RootController) GetOauthProtectedResourceMetadataByApplication()

GetOauthProtectedResourceMetadataByApplication @Title GetOauthProtectedResourceMetadataByApplication @Tag OAuth 2.0 API @Description Get OAuth 2.0 Protected Resource Metadata for specific application (RFC 9728) @Param application path string true "application name" @Success 200 {object} object.OauthProtectedResourceMetadata @router /.well-known/:application/oauth-protected-resource [get]

func (*RootController) GetOidcDiscovery ¶

func (c *RootController) GetOidcDiscovery()

GetOidcDiscovery @Title GetOidcDiscovery @Tag OIDC API @Description Get Oidc Discovery @Success 200 {object} object.OidcDiscovery @router /.well-known/openid-configuration [get]

func (*RootController) GetOidcDiscoveryByApplication ¶

func (c *RootController) GetOidcDiscoveryByApplication()

GetOidcDiscoveryByApplication @Title GetOidcDiscoveryByApplication @Tag OIDC API @Description Get Oidc Discovery for specific application @Param application path string true "application name" @Success 200 {object} object.OidcDiscovery @router /.well-known/:application/openid-configuration [get]

func (*RootController) GetWebFinger ¶

func (c *RootController) GetWebFinger()

GetWebFinger @Title GetWebFinger @Tag OIDC API @Param resource query string true "resource" @Success 200 {object} object.WebFinger @router /.well-known/webfinger [get]

func (*RootController) GetWebFingerByApplication ¶

func (c *RootController) GetWebFingerByApplication()

GetWebFingerByApplication @Title GetWebFingerByApplication @Tag OIDC API @Param application path string true "application name" @Param resource query string true "resource" @Success 200 {object} object.WebFinger @router /.well-known/:application/webfinger [get]

func (*RootController) HandleScim ¶

func (c *RootController) HandleScim()

func (*RootController) SamlValidate ¶

func (c *RootController) SamlValidate()