diragentapi

type DirAgentAccount struct {
	// ImmutableID A unique identifier for the account that will not change over time. In many directory services this is an UUID or similar opaque identifier.
	ImmutableID string `json:"immutable_id"`

	// IDs A list of account identifiers, such as email addresses or usernames. These identifiers are used to select accounts for various operations. Many  directory services have multiple identifiers for an account, such as  alternate email addresses and aliases. Each identifier that might be  reasonably used to identify an account should be placed here.
	IDs []string `json:"ids"`

	// Name The name of the person that holds the account. This is the value that  Nametag uses to match against the person's verified government ID. This is the name that will be displayed to administrators and end-users  in the user interface.
	Name string `json:"name"`

	// Groups A list of groups that this account belongs to.
	Groups *[]DirAgentGroup `json:"groups,omitempty"`

	// BirthDate If the directory service has a birth date for the account, it should be included here. This is used to match against the person's verified government ID. The birth date can take various forms, including a RFC 3339 date string (YYYY-MM-DD), or a specially constructed hash.
	BirthDate *string `json:"birth_date,omitempty"`

	// UpdatedAt The time when this account, or its group membership, was last modified. Timestamp-based incremental agents return this value so the server can advance *updated_after*. Agents that use only *provider_state* may omit it even when *can_update_accounts_list* is `true`.
	UpdatedAt *time.Time `json:"updated_at,omitempty"`
}

type DirAgentAccountRef struct {
	// ImmutableID The immutable identifier of the account to fetch information about.
	ImmutableID *string `json:"immutable_id,omitempty"`

	// ID One of the identifiers of the account to fetch information about. This is typically an email address or username.
	ID *string `json:"id,omitempty"`
}

type DirAgentAccountState struct {
	// ImmutableID The immutable identifier this result is about.
	ImmutableID string `json:"immutable_id"`

	// State What the agent found.
	State DirAgentAccountStateValue `json:"state"`
}

type DirAgentAccountStateValue string

type DirAgentConfigureRequest = map[string]interface{}

type DirAgentConfigureResponse struct {
	// ImmutableID Identifies agents that are compatible for the same directory. Agents with different values cannot serve that directory interchangeably.
	ImmutableID string `json:"immutable_id"`

	// Traits Describes the capabilities of the directory agent.
	Traits DirAgentTraits `json:"traits"`
}

type DirAgentErrorCode string

type DirAgentErrorResponse struct {
	// Code An error code that describes the general reason for the error.
	Code DirAgentErrorCode `json:"code"`

	// Message A human-readable message that describes the error in more detail.
	Message string `json:"message"`
}

type DirAgentGetAccountRequest struct {
	// Ref Specifies which account to fetch information about.
	Ref DirAgentAccountRef `json:"ref"`
}

type DirAgentGetAccountResponse struct {
	// Accounts Information about the accounts that match the specified reference. If you specified an *immutable_id* in the request, the response will contain at most one account. If you specified an *id* in the request, because the same *id* can be present on multiple accounts, the response may contain multiple accounts. Unlike the *list_accounts* method, the accounts in this list should contain *groups* information, even if it requires the agent to perform additional work to determine group membership. If no accounts match, this list should be empty.
	Accounts []DirAgentAccount `json:"accounts"`
}

type DirAgentGroup struct {
	// ImmutableID An identifier for the group that will not change over time. In many directory services this is an UUID or similar opaque identifier. If the directory service doesn't distinguish between group identifiers and names, use the same value here as for name.
	ImmutableID string `json:"immutable_id"`

	// Name The group's display name.
	Name string `json:"name"`

	// Kind Some directory services have different kinds ways of grouping users,  each of which can be considered a group for Nametag's purposes. For example, you might have "security groups", "roles", "administrative  units", etc. This field should be set to the kind of group that this is. The semantics of this field are up to the agent. Nametag treats it as opaque.
	Kind string `json:"kind"`
}

type DirAgentListAccountsRequest struct {
	// UpdatedAfter Request accounts updated after this time. Agents whose incremental cursor is carried entirely in *provider_state* may ignore this field.
	UpdatedAfter *time.Time `json:"updated_after,omitempty"`

	// Cursor If present, the server is requesting a continuation of a previous list of accounts. The value will be the one most recently returned in the *next_cursor* field. The format of this value is determined by the agent. The server treats this value as opaque and passes it back to the agent in the next request. To start at the beginning of the list, the server will omit this field.
	Cursor *string `json:"cursor,omitempty"`

	// ProviderState The durable state the agent returned at the end of its last successful enumeration, in *next_provider_state*. Unlike *cursor*, which is discarded when an enumeration finishes, this persists between synchronizations so the agent can report only what changed since. The format is determined by the agent and the server treats it as opaque.
	// Its **absence is meaningful**: it tells the agent that this is a full reconciliation rather than an incremental synchronization, and therefore that the server may remove accounts the enumeration does not return. The server omits it on a directory's first synchronization and whenever an operator explicitly requests a full synchronization.
	ProviderState *string `json:"provider_state,omitempty"`
}

type DirAgentListAccountsResponse struct {
	// Accounts The accounts that the agent has discovered.
	Accounts []DirAgentAccount `json:"accounts"`

	// NextCursor If there are more results to return, the agent should set this field to the value that should be passed back to the server in the next request. If there are no more results, the agent should omit this field.
	NextCursor *string `json:"next_cursor,omitempty"`

	// NextProviderState The durable state to send back as *provider_state* on the next synchronization. The agent should set this **only on the final page** of an enumeration, because only then is the enumeration known to have completed. The server persists it only after the whole enumeration succeeds.
	// An agent that supports incremental synchronization must set this on the final page of every successful enumeration, **including one that returned no accounts at all**. Omitting it leaves the server with no state, which it reads as "reconcile again next time".
	NextProviderState *string `json:"next_provider_state,omitempty"`
}

type DirAgentListGroupsRequest struct {
	// NamePrefix The agent should return only groups whose name starts with this prefix.
	NamePrefix *string `json:"name_prefix,omitempty"`

	// MaxCount The maximum number of groups to return. If the agent has more groups than this, it should return the first *max_count* groups in lexicographic order by name. Note: this is not the maximum number of groups per page, this is simply a signal that the server will discard any groups beyond this number.
	MaxCount *int64 `json:"max_count,omitempty"`

	// Cursor If present, the server is requesting a continuation of a previous list of groups. The value will be the one most recently returned in the *next_cursor* field. The format of this value is determined by the agent. The server treats this value as opaque and passes it back to the agent in the next request. To start at the beginning of the list, the server will omit this field.
	Cursor *string `json:"cursor,omitempty"`
}

type DirAgentListGroupsResponse struct {
	// Groups The groups that the agent has discovered.
	Groups []DirAgentGroup `json:"groups"`

	// NextCursor If there are more results to return, the agent should set this field to the value that should be passed back to the server in the next request. If there are no more results, the agent should omit this field.
	NextCursor *string `json:"next_cursor,omitempty"`
}

type DirAgentOperation string

type DirAgentPerformOperationRequest struct {
	// Operation The operation to perform on the account.
	Operation DirAgentOperation `json:"operation"`

	// AccountImmutableID The immutable identifier of the account to perform the operation on.
	AccountImmutableID string `json:"account_immutable_id"`

	// DryRun If set to `true`, the agent must not mutate the directory. It should run whatever non-mutating validation the provider supports and return an appropriate error when that validation rejects the operation. Success does not guarantee that a later write is authorized or will succeed.
	DryRun *bool `json:"dry_run,omitempty"`
}

type DirAgentPerformOperationResponse struct {
	// TemporaryPassword If the operation was *get_temporary_password*, this field contains the recovery password assigned by the provider. Whether the user must change it at the next sign-in is provider-specific.
	TemporaryPassword *string `json:"temporary_password,omitempty"`

	// PasswordLink If the operation was *get_password_link*, this field should contain a pre-authenticated link that the user can use to set a new password.
	PasswordLink *string `json:"password_link,omitempty"`

	// MfaBypassCode If the operation was *get_mfa_bypass_code*, this field should contain the bypass code that the user can use to sign in in place of their MFA device.
	MfaBypassCode *string `json:"mfa_bypass_code,omitempty"`

	// MfaResetLink If the operation was *get_mfa_link*, this field should contain a pre-authenticated link that the user can use to reset MFA.
	MfaResetLink *string `json:"mfa_reset_link,omitempty"`
}

type DirAgentRequest struct {
	// Configure This field is set when the request is to obtain configuration information  about the directory agent. The server sends this request to determine  the capabilities of the directory agent.
	Configure *DirAgentConfigureRequest `json:"configure,omitempty"`

	// ListAccounts This field is set when the server needs to obtain a list of accounts. The request contains parameters to filter and limit the accounts returned.
	ListAccounts *DirAgentListAccountsRequest `json:"list_accounts,omitempty"`

	// GetAccount This field is set when the server needs to get information about a specific account.
	GetAccount *DirAgentGetAccountRequest `json:"get_account,omitempty"`

	// ListGroups This field is set when the server needs to get a list of all possible groups. The request contains parameters to filter and limit the groups returned.
	ListGroups *DirAgentListGroupsRequest `json:"list_groups,omitempty"`

	// PerformOperation This field is set when the server needs to perform a recovery operation  on an account, or with `DryRun` set when the server wants to test the  ability to perform the operation without actually performing it.
	PerformOperation *DirAgentPerformOperationRequest `json:"perform_operation,omitempty"`

	// VerifyAccounts This field is set when the server needs to know whether accounts it already holds still exist and are still eligible. The server sends this immediately before removing accounts a full enumeration did not return, so that an account the enumeration merely missed is not deleted.
	VerifyAccounts *DirAgentVerifyAccountsRequest `json:"verify_accounts,omitempty"`

	// Ping The server will periodically send a request with this field set to `true` in order to test the connection to the directory agent. The agent  should respond with an empty `DirAgentResponse`.
	Ping *bool `json:"ping,omitempty"`
}

type DirAgentResponse struct {
	// Configure This field should be set by the agent when the request has  *configure* set to return the results of the request. If an  error occurs, the agent should **not** set this field but should set *error* instead.
	Configure *DirAgentConfigureResponse `json:"configure,omitempty"`

	// ListAccounts This field should be set by the agent when the request has  *list_accounts* set to return the results of the request. If an  error occurs, the agent should **not** set this field but should set *error* instead.
	ListAccounts *DirAgentListAccountsResponse `json:"list_accounts,omitempty"`

	// GetAccount This field should be set by the agent when the request has  *get_account* set to return the results of the request. If an  error occurs, the agent should **not** set this field but should set *error* instead.
	GetAccount *DirAgentGetAccountResponse `json:"get_account,omitempty"`

	// ListGroups This field should be set by the agent when the request has  *list_groups* set to return the results of the request. If an  error occurs, the agent should **not** set this field but should set *error* instead.
	ListGroups *DirAgentListGroupsResponse `json:"list_groups,omitempty"`

	// PerformOperation This field should be set by the agent when the request has  *perform_operation* set to return the results of the request. If an  error occurs, the agent should **not** set this field but should set *error* instead.
	PerformOperation *DirAgentPerformOperationResponse `json:"perform_operation,omitempty"`

	// VerifyAccounts This field should be set by the agent when the request has *verify_accounts* set to return the results of the request. If an error occurs, the agent should **not** set this field but should set *error* instead.
	VerifyAccounts *DirAgentVerifyAccountsResponse `json:"verify_accounts,omitempty"`

	// Error This field should be set by the agent when the request has  failed. The *code* fields tells the server the general reason for the error.
	Error *DirAgentErrorResponse `json:"error,omitempty"`
}

type DirAgentTraits struct {
	// Name The display name of the directory agent. This is the name that will be displayed to administrators and end-users in the user interface, for example "Okta" or "ExampleCorp".
	Name string `json:"name"`

	// CanGetTemporaryPassword Indicates whether the agent can assign a recovery password to an account. Password expiration and change-at-next-login behavior are provider-specific.
	CanGetTemporaryPassword *bool `json:"can_get_temporary_password,omitempty"`

	// CanGetPasswordLink Indicates whether the agent can generate a pre-authenticated link that  leads the user to a site (typically provided by the directory service)  that the user can use enter a new password.
	CanGetPasswordLink *bool `json:"can_get_password_link,omitempty"`

	// CanRemoveAllMFA Indicates whether the agent can remove all MFA factors from an account so the user can re-enroll their MFA device.
	CanRemoveAllMFA *bool `json:"can_remove_all_mfa,omitempty"`

	// CanGetMFABypassCode Indicates whether the agent can generate a bypass code that the user can use to sign in in place of their MFA device. Typically after using a bypass code the user will be able to enroll a replacement MFA device.
	CanGetMFABypassCode *bool `json:"can_get_mfa_bypass_code,omitempty"`

	// CanGetMFALink Indicates whether the agent can generate a pre-authenticated link that leads the user to a site where they can reset MFA.
	CanGetMFALink *bool `json:"can_get_mfa_link,omitempty"`

	// CanUnlock Indicates whether the agent can unlock an account that has been locked due to too many failed login attempts.
	CanUnlock *bool `json:"can_unlock,omitempty"`

	// CanGetTemporaryAccessPass Indicates whether the agent can generate a temporary code that the user will use to log in temporarily without revoking their existing password or resetting any MFA devices.
	CanGetTemporaryAccessPass *bool `json:"can_get_temporary_access_pass,omitempty"`

	// CanUpdateAccountsList Indicates whether the agent can incrementally update the account list, using *updated_after*, *provider_state*, or both as supported by the provider.
	CanUpdateAccountsList *bool `json:"can_update_accounts_list,omitempty"`

	// Authenticate Indicates whether the agent supports authenticating an account.
	Authenticate *bool `json:"can_authenticate,omitempty"`

	// CanVerifyAccounts Indicates whether the agent supports *verify_accounts*. The server sends that request only when this capability is advertised, so agents built against an older protocol continue to use unverified pruning.
	CanVerifyAccounts *bool `json:"can_verify_accounts,omitempty"`
}

type DirAgentVerifyAccountsRequest struct {
	// ImmutableIDs The immutable identifiers of the accounts to check. The server batches these, so an agent should expect more than one and should answer them in as few queries to the directory service as it can.
	ImmutableIDs []string `json:"immutable_ids"`

	// ProviderState The state from the enumeration these accounts are being checked against, so the agent can answer from the same view of the directory the enumeration used. For a directory served by several replicas, answering from a different one can report an account as absent when it is merely not yet replicated.
	ProviderState *string `json:"provider_state,omitempty"`
}

type DirAgentVerifyAccountsResponse struct {
	// Results One result per requested identifier. An agent that cannot answer for an identifier must say so with the *unknown* state rather than omit it. The server defensively treats a missing result as *unknown* and keeps that account.
	Results []DirAgentAccountState `json:"results"`
}