The auth0 event stream ID of the stream the event was delivered on.
Present when the event is delivered via an event stream; omitted when
events are retrieved via the Events API (GET /api/v2/events).
Pattern: est_[a-zA-Z0-9]{22}
Example:
"est_vjFVP5pVdfvsfRKatshkVV"
{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Auth0 Docs","description":"Auth0 documentation","colors":{"primary":"#9921FE","light":"#BC6DFF","dark":"#343434"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/dark.svg","href":"https://auth0.com/docs/"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/favicon.svg","api":{"params":{"post":["x-release-lifecycle"]},"playground":{"proxy":false},"url":"full"},"background":{"decoration":"gradient"},"seo":{"metatags":{"canonical":"https://auth0.com","og:image":"docs/images/share-image.png"}},"fonts":{"body":{"family":"Inter","source":"https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026display=swap","format":"woff2"}},"styling":{"eyebrows":"breadcrumbs","latex":true},"integrations":{"adobe":{"launchUrl":"https://assets.adobedtm.com/6bb3f7663515/7006851c9849/launch-af624fe9e34f.min.js"},"gtm":{"tagId":"GTM-W7FRLJ"},"heap":{"appId":"1279799279"},"onetrust":{"domainScript":"96e22fd8-d619-4cdd-a3c6-d51529d21faf","categoryId":"C0002","scriptSource":"https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"}},"contextual":{"options":["copy","view","chatgpt","claude"],"display":"header"},"navigation":{"languages":[{"language":"en","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"Developers","items":[{"label":"Developer Hub","href":"https://developer.auth0.com"},{"label":"Code Samples \u0026 Guides","href":"https://developer.auth0.com/resources"},{"label":"Zero Index Newsletter","href":"https://auth0.com/blog/newsletter"},{"label":"Blog","href":"https://auth0.com/blog"},{"label":"Changelog","href":"https://auth0.com/changelog"}]},{"header":"Docs","items":[{"label":"Documentation","href":"https://auth0.com/docs"},{"label":"Quickstarts","href":"https://auth0.com/docs/quickstarts"},{"label":"APIs","href":"https://auth0.com/docs/api"},{"label":"SDK Libraries","href":"https://auth0.com/docs/libraries"},{"label":"Learn","href":"https://auth0.com/learn"},{"label":"Intro to IAM (CIAM)","href":"https://auth0.com/intro-to-iam"},{"label":"Reports","href":"https://auth0.com/resources/whitepapers"},{"label":"Webinars","href":"https://auth0.com/resources/webinars"}]},{"header":"Support Center","items":[{"label":"Community","href":"https://community.auth0.com"},{"label":"Help","href":"https://support.auth0.com"},{"label":"FAQs","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"Company","items":[{"label":"Our Customers","href":"https://auth0.com/customers"},{"label":"Compliance","href":"https://auth0.com/security"},{"label":"Partners","href":"https://auth0.com/partners"},{"label":"Careers","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"About us","href":"https://auth0.com/about"}]}]},"href":"docs/get-started"},{"language":"fr-ca","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"Développeurs","items":[{"label":"Espace développeurs","href":"https://developer.auth0.com"},{"label":"Exemples de code et guides","href":"https://developer.auth0.com/resources"},{"label":"Infolettre Zero Index","href":"https://auth0.com/blog/newsletter"},{"label":"Blogue","href":"https://auth0.com/blog"},{"label":"Journal des modifications","href":"https://auth0.com/changelog"}]},{"header":"Documentation","items":[{"label":"Documentation","href":"https://auth0.com/docs"},{"label":"Guides de démarrage rapide","href":"https://auth0.com/docs/quickstarts"},{"label":"API","href":"https://auth0.com/docs/api"},{"label":"Bibliothèques SDK","href":"https://auth0.com/docs/libraries"},{"label":"Apprendre","href":"https://auth0.com/learn"},{"label":"Introduction à l’IAM (CIAM)","href":"https://auth0.com/intro-to-iam"},{"label":"Rapports","href":"https://auth0.com/resources/whitepapers"},{"label":"Webinaires","href":"https://auth0.com/resources/webinars"}]},{"header":"Centre d’assistance","items":[{"label":"Communauté","href":"https://community.auth0.com"},{"label":"Aide","href":"https://support.auth0.com"},{"label":"Foire aux questions","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"Entreprise","items":[{"label":"Nos clients","href":"https://auth0.com/customers"},{"label":"Conformité","href":"https://auth0.com/security"},{"label":"Partenaires","href":"https://auth0.com/partners"},{"label":"Carrières","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"À propos de nous","href":"https://auth0.com/about"}]}]},"href":"docs/fr-ca/get-started"},{"language":"ja-jp","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"開発者向け","items":[{"label":"開発者ハブ","href":"https://developer.auth0.com"},{"label":"コードサンプルとガイド","href":"https://developer.auth0.com/resources"},{"label":"Zero Index Newsletter","href":"https://auth0.com/blog/newsletter"},{"label":"ブログ","href":"https://auth0.com/blog"},{"label":"変更履歴","href":"https://auth0.com/changelog"}]},{"header":"ドキュメント","items":[{"label":"ドキュメント","href":"https://auth0.com/docs"},{"label":"クイックスタート","href":"https://auth0.com/docs/quickstarts"},{"label":"API","href":"https://auth0.com/docs/api"},{"label":"SDKライブラリ","href":"https://auth0.com/docs/libraries"},{"label":"教育","href":"https://auth0.com/learn"},{"label":"IAM(CIAM)入門","href":"https://auth0.com/intro-to-iam"},{"label":"レポート","href":"https://auth0.com/resources/whitepapers"},{"label":"ウェビナー","href":"https://auth0.com/resources/webinars"}]},{"header":"サポートセンター","items":[{"label":"コミュニティ","href":"https://community.auth0.com"},{"label":"ヘルプ","href":"https://support.auth0.com"},{"label":"よくある質問","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"会社情報","items":[{"label":"導入企業","href":"https://auth0.com/customers"},{"label":"コンプライアンス","href":"https://auth0.com/security"},{"label":"パートナー","href":"https://auth0.com/partners"},{"label":"採用情報","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"私たちについて","href":"https://auth0.com/about"}]}]},"href":"docs/ja-jp/get-started"}]}},"deployment":{"deploymentMetadataValue":{"subdomain":"auth0","hasAudioNarration":false,"actualSubdomain":"auth0","customDomains":["auth0.com","auth0.auth0-mintlify.app"],"gitSource":{"type":"github","owner":"atko-cic","repo":"docs","deployBranch":"main","contentDirectory":"main","isPrivate":true,"mountPath":"","label":""},"feedback":{"thumbs":true,"contextualFeedback":{"textInputOnly":true,"allowEmail":false},"agentFeedback":false},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"REMOVE_BRANDING":{"status":"ENABLED"},"CONTEXTUAL_FEEDBACK":{"status":"ENABLED"},"CODE_SNIPPET_FEEDBACK":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6af626113e877a418253f0cc","clientVersion":"0.0.4124","searchFilterCounts":[{"language":"en","tag":"Dev Tools","count":846},{"language":"fr-ca","tag":"Outils de développement","count":846},{"language":"ja-jp","tag":"開発者ツール","count":846},{"language":"en","tag":"APIs","count":622},{"language":"fr-ca","tag":"API","count":622},{"language":"ja-jp","tag":"API","count":622},{"language":"en","tag":"Management API","count":490},{"language":"fr-ca","tag":"API Management","count":490},{"language":"ja-jp","tag":"Management API","count":490},{"language":"en","tag":"Get Started","count":289},{"language":"ja-jp","tag":"はじめに","count":289},{"language":"fr-ca","tag":"Pour commencer","count":279},{"language":"ja-jp","tag":"リファレンス","count":253},{"language":"en","tag":"Reference","count":252},{"language":"fr-ca","tag":"Référence","count":252},{"language":"en","tag":"Extend","count":216},{"language":"fr-ca","tag":"Étendre","count":216},{"language":"ja-jp","tag":"拡張","count":216},{"language":"en","tag":"SDKs","count":209},{"language":"fr-ca","tag":"SDK","count":209},{"language":"ja-jp","tag":"SDK","count":209},{"language":"en","tag":"Monitor","count":194},{"language":"fr-ca","tag":"Surveiller","count":194},{"language":"ja-jp","tag":"監視","count":194},{"language":"en","tag":"Authenticate","count":186},{"language":"fr-ca","tag":"Authentifier","count":186},{"language":"ja-jp","tag":"認証","count":186},{"language":"en","tag":"Tenant Log Event Types","count":171},{"language":"fr-ca","tag":"Types d’événements du journal du locataire","count":171},{"language":"ja-jp","tag":"テナントのログイベントの種類","count":171}],"searchSettings":{"showContentSnippets":true}},"assistantConfig":{"enableAskAiButton":true,"enableStarterQuestions":false,"enableAskAiSearchBar":false,"deflection":{"enabled":false,"type":"link"}},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"ui/css/recipe.css","content":"#content-area:has(.recipe-container){overflow:visible!important}.recipe-content .recipe-section:first-of-type{margin-top:1rem}.active-section{opacity:1!important}"},{"filePath":"ui/css/styles.css","content":"@font-face{font-family:\"Inter Fallback\";src:local(\"Arial\");size-adjust:107%;ascent-override:90%;descent-override:22%;line-gap-override:0%}body{font-feature-settings:\"kern\", \"liga\", \"clig\", \"calt\", \"rvrn\";font-family:\"Inter\",\n \"Inter Fallback\",\n system-ui,\n -apple-system,\n sans-serif}.mdx-content{line-height:1.625}#page-title{font-size:var(--text-3xl);line-height:1.15}.mdx-content .link{font-weight:inherit;border:none;text-decoration:underline;text-underline-offset:2px;transition:opacity 0.15s ease-out;color:rgb(var(--primary));\u0026.quickstart_button{text-decoration:none}}.mdx-content .link:hover{color:rgb(var(--tw-prose-links))}.dark .mdx-content .link:hover{color:rgb(var(--primary))}.mdx-content table{border-radius:12px;border:0px;box-shadow:0 0 0 1px rgb(from var(--border-muted) r g b / 50%);overflow:hidden;thead {\n background-color: rgb(from var(--border-muted) r g b / 30%);\n }\n\n th, td {\n padding: 0.5rem;\n }\n\n /* Don't break mid-word in code formatting. */\n code {\n white-space: pre;\n }}img.icon.inline{margin:0}#navbar{padding-bottom:0.5rem;box-shadow:0 0 0 1px oklch(from var(--border) l c h / 0.1),\n 0 1px 1px -1px oklch(from var(--shadow) l c h / 0.06),\n 0 2px 2px -2px oklch(from var(--shadow) l c h / 0.06),\n 0 2px 4px -2px oklch(from var(--shadow) l c h / 0.06);> div:nth-child(2) {\n -webkit-backdrop-filter: blur(20px);\n backdrop-filter: blur(20px);\n transition:\n background-color 0.2s ease,\n backdrop-filter 0.2s ease;\n }\n\n /* This data attribute is set by the navbar controller */\n \u0026[data-is-opaque=\"true\"] > div:nth-child(2) {\n background-color: oklch(from var(--bg) l c h / 1);\n }}body:has([data-uc-component] [data-slot=\"dialog-content\"]) #navbar>div:first-child{border-bottom-color:transparent}body[data-scroll-locked]:has([data-uc-component] [data-slot=\"dialog-content\"]){margin-right:0!important}#adu-root{transition:opacity 0.2s ease,\n visibility 0s linear 0s}body:has([data-uc-component] [data-slot=\"dialog-content\"]) #adu-root{opacity:0;visibility:hidden;transition:opacity 0.2s ease,\n visibility 0s linear 0.2s}.nav-tabs{column-gap:0}.nav-tabs-item{padding:0.25rem 0.75rem;text-shadow:none;div.bottom-0 {\n display: none;\n }}.nav-tabs-item[data-active]{color:rgb(var(--primary))}.dark .nav-tabs-item[data-active]{color:rgb(var(--primary-light))}.nav-tabs-item:hover{color:rgb(var(--primary));background-color:rgb(var(--primary) / .1);transition:all 0.15s ease-out;border-radius:0.75rem}#sidebar-content{border-color:transparent}#sidebar-content{a,\n button {\n text-shadow: none;\n }}.card{transition:all 0.15s ease}.libraries_card{border:1px solid var(--border-muted);\u0026:hover{border-color:var(--border)}img {\n margin: 0;\n }\n\n .libraries_card_divider {\n border-top: 1px solid var(--border-muted);\n margin: 0 1rem;\n }}.api_card_wrapper .card{background-color:transparent;color:var(--foreground-card);[data-component-part=\"card-title\"],\n #card-link-arrow-icon {\n transition: all .15s ease-out;\n color: currentColor;\n }\n\n /* Accent on hover */\n \u0026:hover {\n color: var(--foreground-selected);\n }\n\n /* Use only bottom border */\n border: 0;border-radius:0;border-bottom:3px solid currentColor!important;margin-bottom:1rem;[data-component-part=\"card-content-container\"] {\n padding: 1.25rem 0 0.5rem;\n }\n\n /* Right-align the absolute positioning for the icon */\n #card-link-arrow-icon {\n right: 0;\n }}[data-component-part=\"field-meta-post\"]{background-color:lab(91.896% .077188 -6.94053);color:lab(36.091% 25.9241 -68.0384)}.dark [data-component-part=\"field-meta-post\"]{background-color:lab(16.0426% 6.71726 -27.2409);color:lab(72.6029% 4.08953 -41.9669)}body:has([data-uc-component] [data-slot=\"dialog-overlay\"]) [data-assistant-bar]{visibility:hidden}"},{"filePath":"ui/css/apiExplorer.css","content":"#header{.prose {\n p {\n font-size: 0.875rem;\n }\n }\n\n /* Code block styling — light mode */\n \u0026 pre {\n background-color: #f6f8fa !important;\n border: 1px solid #d0d7de;\n border-radius: 1rem;\n }\n\n \u0026 pre code {\n font-size: 0.75rem;\n background-color: transparent !important;\n }\n\n \u0026 code:not(pre > code) {\n font-size: 0.75rem;\n background-color: #f0f2f4;\n border: 1px solid #d0d7de;\n border-radius: 0.375rem;\n }\n\n /* docs/api/management/v2/clients/update-a-client\n docs/api/management/v2/clients/create-a-client\n docs/api/management/v2/logs/search-log-events */\n \u0026 li {\n font-size: 0.75rem;\n }\n\n \u0026 li::before {\n top: 0.75rem;\n }\n\n /* Code block styling — dark mode */\n /* :is(html.dark) \u0026 pre compiles to: html.dark #header pre */\n :is(html.dark, html[data-appearance=\"dark\"], html[data-theme=\"dark\"]) \u0026 pre {\n background-color: #13141a !important;\n border-color: #2d2f3e !important;\n }\n\n :is(html.dark, html[data-appearance=\"dark\"], html[data-theme=\"dark\"])\n \u0026\n pre\n code {\n background-color: transparent !important;\n }\n\n :is(html.dark, html[data-appearance=\"dark\"], html[data-theme=\"dark\"])\n \u0026\n code:not(pre > code) {\n background-color: #1e1f2b !important;\n border-color: #2d2f3e !important;\n }}.primitive-param-field{font-size:0.875rem;.prose,\n .prose :where(*) {\n font-size: 0.875rem;\n }}.array-param-field{font-size:0.875rem;.prose,\n .prose :where(*) {\n font-size: 0.875rem;\n }}.object-param-field{font-size:0.875rem;.prose,\n .prose :where(*) {\n font-size: 0.875rem;\n }}.api-section-heading-subtitle{font-size:0.875rem;.prose,\n .prose :where(*) {\n font-size: 0.875rem;\n }}svg[style*=\"/zsh.svg\"]{-webkit-mask-image:url(\"/docs/images/auth0-cli.svg\")!important;mask-image:url(\"/docs/images/auth0-cli.svg\")!important}"},{"filePath":"ui/auth0-docs-ui-1.10.0.css","content":"@layer properties{@supports (((-webkit-hyphens:none)) and (not (margin-trim:inline))) or ((-moz-orient:inline) and (not (color:rgb(from red r g b)))){*,:before,:after,::backdrop{--tw-border-style:solid;--tw-leading:initial;--tw-font-weight:initial;--tw-tracking:initial;--tw-shadow:0 0 #0000;--tw-shadow-color:initial;--tw-shadow-alpha:100%;--tw-inset-shadow:0 0 #0000;--tw-inset-shadow-color:initial;--tw-inset-shadow-alpha:100%;--tw-ring-color:initial;--tw-ring-shadow:0 0 #0000;--tw-inset-ring-color:initial;--tw-inset-ring-shadow:0 0 #0000;--tw-ring-inset:initial;--tw-ring-offset-width:0px;--tw-ring-offset-color:#fff;--tw-ring-offset-shadow:0 0 #0000;--tw-ease:initial;--tw-animation-delay:0s;--tw-animation-direction:normal;--tw-animation-duration:initial;--tw-animation-fill-mode:none;--tw-animation-iteration-count:1;--tw-enter-blur:0;--tw-enter-opacity:1;--tw-enter-rotate:0;--tw-enter-scale:1;--tw-enter-translate-x:0;--tw-enter-translate-y:0;--tw-exit-blur:0;--tw-exit-opacity:1;--tw-exit-rotate:0;--tw-exit-scale:1;--tw-exit-translate-x:0;--tw-exit-translate-y:0}}}@layer theme{:root,:host{--adu-font-sans:ui-sans-serif,system-ui,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\";--adu-font-mono:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,\"Liberation Mono\",\"Courier New\",monospace;--adu-color-blue-500:oklch(62.3% .214 259.815);--adu-color-white:#fff;--adu-spacing:.25rem;--adu-text-xs--line-height:calc(1/.75);--adu-text-sm--line-height:calc(1.25/.875);--adu-text-base--line-height: 1.5 ;--adu-text-lg--line-height:calc(1.75/1.125);--adu-text-xl--line-height:calc(1.75/1.25);--adu-text-2xl--line-height:calc(2/1.5);--adu-text-3xl--line-height: 1.2 ;--adu-tracking-widest:.1em;--adu-ease-in-out:cubic-bezier(.4,0,.2,1);--adu-animate-pulse:pulse 2s cubic-bezier(.4,0,.6,1) infinite;--adu-default-transition-duration:.15s;--adu-default-transition-timing-function:cubic-bezier(.4,0,.2,1);--adu-default-font-family:var(--adu-font-sans);--adu-default-mono-font-family:var(--adu-font-mono)}}@layer base{*,:after,:before,::backdrop{box-sizing:border-box;border:0 solid;margin:0;padding:0}::file-selector-button{box-sizing:border-box;border:0 solid;margin:0;padding:0}html,:host{-webkit-text-size-adjust:100%;tab-size:4;line-height:1.5;font-family:var(--adu-default-font-family,ui-sans-serif,system-ui,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\");font-feature-settings:var(--adu-default-font-feature-settings,normal);font-variation-settings:var(--adu-default-font-variation-settings,normal);-webkit-tap-highlight-color:transparent}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;-webkit-text-decoration:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:var(--adu-default-mono-font-family,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,\"Liberation Mono\",\"Courier New\",monospace);font-feature-settings:var(--adu-default-mono-font-feature-settings,normal);font-variation-settings:var(--adu-default-mono-font-variation-settings,normal);font-size:1em}small{font-size:80%}sub,sup{vertical-align:baseline;font-size:75%;line-height:0;position:relative}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}:-moz-focusring{outline:auto}progress{vertical-align:baseline}summary{display:list-item}ol,ul,menu{list-style:none}img,svg,video,canvas,audio,iframe,embed,object{vertical-align:middle;display:block}img,video{max-width:100%;height:auto}button,input,select,optgroup,textarea{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}::file-selector-button{font:inherit;font-feature-settings:inherit;font-variation-settings:inherit;letter-spacing:inherit;color:inherit;opacity:1;background-color:#0000;border-radius:0}:where(select:is([multiple],[size])) optgroup{font-weight:bolder}:where(select:is([multiple],[size])) optgroup option{padding-inline-start:20px}::file-selector-button{margin-inline-end:4px}::placeholder{opacity:1}@supports (not ((-webkit-appearance:-apple-pay-button))) or (contain-intrinsic-size:1px){::placeholder{color:currentColor}@supports (color:color-mix(in lab,red,red)){::placeholder{color:color-mix(in oklab,currentcolor 50%,transparent)}}}textarea{resize:vertical}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-date-and-time-value{min-height:1lh;text-align:inherit}::-webkit-datetime-edit{display:inline-flex}::-webkit-datetime-edit-fields-wrapper{padding:0}::-webkit-datetime-edit{padding-block:0}::-webkit-datetime-edit-year-field{padding-block:0}::-webkit-datetime-edit-month-field{padding-block:0}::-webkit-datetime-edit-day-field{padding-block:0}::-webkit-datetime-edit-hour-field{padding-block:0}::-webkit-datetime-edit-minute-field{padding-block:0}::-webkit-datetime-edit-second-field{padding-block:0}::-webkit-datetime-edit-millisecond-field{padding-block:0}::-webkit-datetime-edit-meridiem-field{padding-block:0}::-webkit-calendar-picker-indicator{line-height:1}:-moz-ui-invalid{box-shadow:none}button,input:where([type=button],[type=reset],[type=submit]){appearance:button}::file-selector-button{appearance:button}::-webkit-inner-spin-button{height:auto}::-webkit-outer-spin-button{height:auto}[hidden]:where(:not([hidden=until-found])){display:none!important}*{border-color:var(--color-border);outline-color:var(--color-ring)}@supports (color:color-mix(in lab,red,red)){*{outline-color:color-mix(in srgb,var(--color-ring) 50%,transparent)}}body{background-color:var(--color-background);color:var(--color-foreground);text-rendering:optimizeLegibility;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-synthesis:style;font-feature-settings:\"kern\",\"liga\",\"clig\",\"calt\",\"rvrn\"}}@layer components;@layer utilities{.adu\\:\\@container\\/card-header{container:card-header/inline-size}.adu\\:pointer-events-none{pointer-events:none}.adu\\:sr-only{clip-path:inset(50%);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.adu\\:absolute{position:absolute}.adu\\:fixed{position:fixed}.adu\\:relative{position:relative}.adu\\:static{position:static}.adu\\:top-0{top:calc(var(--adu-spacing)*0)}.adu\\:right-0{right:calc(var(--adu-spacing)*0)}.adu\\:left-0{left:calc(var(--adu-spacing)*0)}.adu\\:left-2{left:calc(var(--adu-spacing)*2)}.adu\\:left-73{left:calc(var(--adu-spacing)*73)}.adu\\:z-0{z-index:0}.adu\\:z-30{z-index:30}.adu\\:z-50{z-index:50}.adu\\:z-\\[39\\]{z-index:39}.adu\\:col-start-2{grid-column-start:2}.adu\\:row-span-2{grid-row:span 2/span 2}.adu\\:row-start-1{grid-row-start:1}.adu\\:-mx-1{margin-inline:calc(var(--adu-spacing)*-1)}.adu\\:my-1{margin-block:calc(var(--adu-spacing)*1)}.adu\\:mr-2{margin-right:calc(var(--adu-spacing)*2)}.adu\\:-ml-8{margin-left:calc(var(--adu-spacing)*-8)}.adu\\:ml-2{margin-left:calc(var(--adu-spacing)*2)}.adu\\:ml-auto{margin-left:auto}.adu\\:flex{display:flex}.adu\\:grid{display:grid}.adu\\:hidden{display:none}.adu\\:inline-block{display:inline-block}.adu\\:inline-flex{display:inline-flex}.adu\\:aspect-square{aspect-ratio:1}.adu\\:size-2{width:calc(var(--adu-spacing)*2);height:calc(var(--adu-spacing)*2)}.adu\\:size-3\\.5{width:calc(var(--adu-spacing)*3.5);height:calc(var(--adu-spacing)*3.5)}.adu\\:size-4{width:calc(var(--adu-spacing)*4);height:calc(var(--adu-spacing)*4)}.adu\\:size-8{width:calc(var(--adu-spacing)*8);height:calc(var(--adu-spacing)*8)}.adu\\:size-9{width:calc(var(--adu-spacing)*9);height:calc(var(--adu-spacing)*9)}.adu\\:size-full{width:100%;height:100%}.adu\\:h-4{height:calc(var(--adu-spacing)*4)}.adu\\:h-8{height:calc(var(--adu-spacing)*8)}.adu\\:h-9{height:calc(var(--adu-spacing)*9)}.adu\\:h-10{height:calc(var(--adu-spacing)*10)}.adu\\:h-14{height:calc(var(--adu-spacing)*14)}.adu\\:h-\\[18px\\]{height:18px}.adu\\:h-px{height:1px}.adu\\:max-h-\\(--radix-dropdown-menu-content-available-height\\){max-height:var(--radix-dropdown-menu-content-available-height)}.adu\\:max-h-72\\.5{max-height:calc(var(--adu-spacing)*72.5)}.adu\\:max-h-\\[calc\\(100\\%\\+2px\\)\\]{max-height:calc(100% + 2px)}.adu\\:w-4{width:calc(var(--adu-spacing)*4)}.adu\\:w-8{width:calc(var(--adu-spacing)*8)}.adu\\:w-9{width:calc(var(--adu-spacing)*9)}.adu\\:w-48{width:calc(var(--adu-spacing)*48)}.adu\\:w-73{width:calc(var(--adu-spacing)*73)}.adu\\:w-\\[24px\\]{width:24px}.adu\\:w-full{width:100%}.adu\\:min-w-\\[8rem\\]{min-width:8rem}.adu\\:flex-1{flex:1}.adu\\:shrink-0{flex-shrink:0}.adu\\:origin-\\(--radix-dropdown-menu-content-transform-origin\\){transform-origin:var(--radix-dropdown-menu-content-transform-origin)}.adu\\:animate-in{animation:enter var(--tw-animation-duration,var(--tw-duration,.15s)) var(--tw-ease,ease) var(--tw-animation-delay,0s) var(--tw-animation-iteration-count,1) var(--tw-animation-direction,normal) var(--tw-animation-fill-mode,none)}.adu\\:animate-out{animation:exit var(--tw-animation-duration,var(--tw-duration,.15s)) var(--tw-ease,ease) var(--tw-animation-delay,0s) var(--tw-animation-iteration-count,1) var(--tw-animation-direction,normal) var(--tw-animation-fill-mode,none)}.adu\\:animate-pulse{animation:var(--adu-animate-pulse)}.adu\\:cursor-default{cursor:default}.adu\\:auto-rows-min{grid-auto-rows:min-content}.adu\\:grid-rows-\\[auto_auto\\]{grid-template-rows:auto auto}.adu\\:flex-col{flex-direction:column}.adu\\:flex-wrap{flex-wrap:wrap}.adu\\:items-center{align-items:center}.adu\\:items-start{align-items:flex-start}.adu\\:justify-center{justify-content:center}.adu\\:gap-0{gap:calc(var(--adu-spacing)*0)}.adu\\:gap-1{gap:calc(var(--adu-spacing)*1)}.adu\\:gap-1\\.5{gap:calc(var(--adu-spacing)*1.5)}.adu\\:gap-2{gap:calc(var(--adu-spacing)*2)}.adu\\:gap-3{gap:calc(var(--adu-spacing)*3)}.adu\\:gap-4{gap:calc(var(--adu-spacing)*4)}.adu\\:gap-6{gap:calc(var(--adu-spacing)*6)}.adu\\:gap-8{gap:calc(var(--adu-spacing)*8)}.adu\\:self-start{align-self:flex-start}.adu\\:self-stretch{align-self:stretch}.adu\\:justify-self-end{justify-self:flex-end}.adu\\:overflow-auto{overflow:auto}.adu\\:overflow-hidden{overflow:hidden}.adu\\:overflow-x-hidden{overflow-x:hidden}.adu\\:overflow-y-auto{overflow-y:auto}.adu\\:rounded{border-radius:.25rem}.adu\\:rounded-full{border-radius:9999px}.adu\\:rounded-md{border-radius:.5rem}.adu\\:rounded-none{border-radius:0}.adu\\:rounded-sm{border-radius:.375rem}.adu\\:rounded-xl{border-radius:.875rem}.adu\\:border{border-style:var(--tw-border-style);border-width:1px}.adu\\:border\\!{border-style:var(--tw-border-style)!important;border-width:1px!important}.adu\\:border-border-input{border-color:var(--border-input)}.adu\\:border-border-muted{border-color:var(--border-muted)}.adu\\:bg-\\[\\#232220\\]{background-color:#232220}.adu\\:bg-blue-500{background-color:var(--adu-color-blue-500)}.adu\\:bg-border-input{background-color:var(--border-input)}.adu\\:bg-button-primary{background-color:var(--button-primary)}.adu\\:bg-card{background-color:var(--card)}.adu\\:bg-destructive{background-color:var(--destructive)}.adu\\:bg-input{background-color:var(--input)}.adu\\:bg-page{background-color:var(--page)}.adu\\:bg-popover{background-color:var(--popover)}.adu\\:bg-surface-muted{background-color:var(--surface-muted)}.adu\\:bg-surface-selected{background-color:var(--surface-selected)}.adu\\:fill-current{fill:currentColor}.adu\\:p-0{padding:calc(var(--adu-spacing)*0)}.adu\\:p-1{padding:calc(var(--adu-spacing)*1)}.adu\\:p-2\\.5{padding:calc(var(--adu-spacing)*2.5)}.adu\\:p-4{padding:calc(var(--adu-spacing)*4)}.adu\\:px-1{padding-inline:calc(var(--adu-spacing)*1)}.adu\\:px-2{padding-inline:calc(var(--adu-spacing)*2)}.adu\\:px-3{padding-inline:calc(var(--adu-spacing)*3)}.adu\\:px-4{padding-inline:calc(var(--adu-spacing)*4)}.adu\\:px-6{padding-inline:calc(var(--adu-spacing)*6)}.adu\\:py-1\\.5{padding-block:calc(var(--adu-spacing)*1.5)}.adu\\:py-2{padding-block:calc(var(--adu-spacing)*2)}.adu\\:py-3{padding-block:calc(var(--adu-spacing)*3)}.adu\\:py-6{padding-block:calc(var(--adu-spacing)*6)}.adu\\:pt-3{padding-top:calc(var(--adu-spacing)*3)}.adu\\:pr-2{padding-right:calc(var(--adu-spacing)*2)}.adu\\:pl-8{padding-left:calc(var(--adu-spacing)*8)}.adu\\:text-center{text-align:center}.adu\\:font-aeonik{font-family:Aeonik,sans-serif}.adu\\:font-inter{font-family:Inter,Inter Fallback,system-ui,-apple-system,sans-serif}.adu\\:font-roboto-mono{font-family:Roboto Mono,sans-serif}.adu\\:text-2xl{font-size:2rem;line-height:var(--tw-leading,var(--adu-text-2xl--line-height))}.adu\\:text-3xl{font-size:2.5rem;line-height:var(--tw-leading,var(--adu-text-3xl--line-height))}.adu\\:text-base{font-size:1rem;line-height:var(--tw-leading,var(--adu-text-base--line-height))}.adu\\:text-lg{font-size:1.25rem;line-height:var(--tw-leading,var(--adu-text-lg--line-height))}.adu\\:text-sm{font-size:.875rem;line-height:var(--tw-leading,var(--adu-text-sm--line-height))}.adu\\:text-sm\\!{font-size:.875rem!important;line-height:var(--tw-leading,var(--adu-text-sm--line-height))!important}.adu\\:text-xl{font-size:1.5rem;line-height:var(--tw-leading,var(--adu-text-xl--line-height))}.adu\\:text-xs{font-size:.75rem;line-height:var(--tw-leading,var(--adu-text-xs--line-height))}.adu\\:leading-1\\.5{--tw-leading:calc(var(--adu-spacing)*1.5);line-height:calc(var(--adu-spacing)*1.5)}.adu\\:leading-1\\.15{--tw-leading:1.15;line-height:1.15}.adu\\:leading-1\\.20{--tw-leading:1.2;line-height:1.2}.adu\\:leading-1\\.25{--tw-leading:1.25;line-height:1.25}.adu\\:leading-1\\.30{--tw-leading:1.3;line-height:1.3}.adu\\:leading-1\\.33{--tw-leading:1.33;line-height:1.33}.adu\\:leading-1\\.40{--tw-leading:1.4;line-height:1.4}.adu\\:leading-1\\.45{--tw-leading:1.45;line-height:1.45}.adu\\:leading-1\\.65{--tw-leading:1.65;line-height:1.65}.adu\\:leading-none{--tw-leading:1;line-height:1}.adu\\:font-medium{--tw-font-weight:500;font-weight:500}.adu\\:font-normal{--tw-font-weight:400;font-weight:400}.adu\\:font-semibold{--tw-font-weight:600;font-weight:600}.adu\\:tracking-n-2xl{--tw-tracking:-.02em;letter-spacing:-.02em}.adu\\:tracking-n-3xl{--tw-tracking:-.02125em;letter-spacing:-.02125em}.adu\\:tracking-n-5xl{--tw-tracking:-.044em;letter-spacing:-.044em}.adu\\:tracking-n-6xl{--tw-tracking:-.05em;letter-spacing:-.05em}.adu\\:tracking-n-lg{--tw-tracking:-.011em;letter-spacing:-.011em}.adu\\:tracking-n-md{--tw-tracking:-.00625em;letter-spacing:-.00625em}.adu\\:tracking-n-sm{--tw-tracking:-.006em;letter-spacing:-.006em}.adu\\:tracking-n-xl{--tw-tracking:-.01125em;letter-spacing:-.01125em}.adu\\:tracking-n-xs{--tw-tracking:-.00525em;letter-spacing:-.00525em}.adu\\:tracking-p-2xl{--tw-tracking:.0375em;letter-spacing:.0375em}.adu\\:tracking-p-lg{--tw-tracking:.011em;letter-spacing:.011em}.adu\\:tracking-p-md{--tw-tracking:.01em;letter-spacing:.01em}.adu\\:tracking-p-sm{--tw-tracking:.005em;letter-spacing:.005em}.adu\\:tracking-p-xs{--tw-tracking:.0025em;letter-spacing:.0025em}.adu\\:tracking-widest{--tw-tracking:var(--adu-tracking-widest);letter-spacing:var(--adu-tracking-widest)}.adu\\:whitespace-nowrap{white-space:nowrap}.adu\\:text-\\[\\#f4f4f4\\]{color:#f4f4f4}.adu\\:text-\\[\\#f4f4f4\\]\\!{color:#f4f4f4!important}.adu\\:text-foreground{color:var(--foreground)}.adu\\:text-foreground-bold{color:var(--foreground-bold)}.adu\\:text-foreground-icon{color:var(--foreground-icon)}.adu\\:text-foreground-inverse{color:var(--foreground-inverse)}.adu\\:text-foreground-inverse\\!{color:var(--foreground-inverse)!important}.adu\\:text-white{color:var(--adu-color-white)}.adu\\:uppercase{text-transform:uppercase}.adu\\:underline{text-decoration-line:underline}.adu\\:underline-offset-4{text-underline-offset:4px}.adu\\:underline-offset-auto{text-underline-offset:auto}.adu\\:shadow-lg{--tw-shadow:0px 12px 12px -6px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-3))),0px 6px 6px -1.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-2))),0px 4px 4px 0px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)));box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:shadow-md{--tw-shadow:0px 6px 6px -3px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-2))),0px 4px 4px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)));box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:shadow-sm{--tw-shadow:0px 4px 4px -2px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)));box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:outline-hidden{--tw-outline-style:none;outline-style:none}@media (forced-colors:active){.adu\\:outline-hidden{outline-offset:2px;outline:2px solid #0000}}.adu\\:transition-\\[height\\]{transition-property:height;transition-timing-function:var(--tw-ease,var(--adu-default-transition-timing-function));transition-duration:var(--tw-duration,var(--adu-default-transition-duration))}.adu\\:transition-all{transition-property:all;transition-timing-function:var(--tw-ease,var(--adu-default-transition-timing-function));transition-duration:var(--tw-duration,var(--adu-default-transition-duration))}.adu\\:ease-in-out{--tw-ease:var(--adu-ease-in-out);transition-timing-function:var(--adu-ease-in-out)}.adu\\:fill-mode-both{--tw-animation-fill-mode:both;animation-fill-mode:both}.adu\\:outline-none{--tw-outline-style:none;outline-style:none}.adu\\:select-none{-webkit-user-select:none;user-select:none}.adu\\:fade-in{--tw-enter-opacity:0}.adu\\:fade-out{--tw-exit-opacity:0}.adu\\:slide-in-from-left{--tw-enter-translate-x:-100%}.adu\\:slide-in-from-right{--tw-enter-translate-x:100%}.adu\\:slide-out-to-left{--tw-exit-translate-x:-100%}.adu\\:slide-out-to-right{--tw-exit-translate-x:100%}@media (hover:hover){.adu\\:hover\\:bg-button-primary\\/90:hover{background-color:var(--button-primary)}@supports (color:color-mix(in lab,red,red)){.adu\\:hover\\:bg-button-primary\\/90:hover{background-color:color-mix(in oklab,var(--button-primary) 90%,transparent)}}.adu\\:hover\\:bg-destructive\\/90:hover{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:hover\\:bg-destructive\\/90:hover{background-color:color-mix(in oklab,var(--destructive) 90%,transparent)}}.adu\\:hover\\:underline:hover{text-decoration-line:underline}}.adu\\:focus-visible\\:ring-\\[3px\\]:focus-visible{--tw-ring-shadow:var(--tw-ring-inset,)0 0 0 calc(3px + var(--tw-ring-offset-width)) var(--tw-ring-color,currentcolor);box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}.adu\\:focus-visible\\:ring-destructive\\/20:focus-visible{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:focus-visible\\:ring-destructive\\/20:focus-visible{--tw-ring-color:color-mix(in oklab,var(--destructive) 20%,transparent)}}.adu\\:focus-visible\\:outline-hidden:focus-visible{--tw-outline-style:none;outline-style:none}@media (forced-colors:active){.adu\\:focus-visible\\:outline-hidden:focus-visible{outline-offset:2px;outline:2px solid #0000}}.adu\\:disabled\\:pointer-events-none:disabled{pointer-events:none}.adu\\:disabled\\:opacity-50:disabled{opacity:.5}.adu\\:has-data-\\[slot\\=card-action\\]\\:grid-cols-\\[1fr_auto\\]:has([data-slot=card-action]){grid-template-columns:1fr auto}.adu\\:has-\\[\\>svg\\]\\:px-2\\.5:has(>svg){padding-inline:calc(var(--adu-spacing)*2.5)}.adu\\:has-\\[\\>svg\\]\\:px-3:has(>svg){padding-inline:calc(var(--adu-spacing)*3)}.adu\\:has-\\[\\>svg\\]\\:px-4:has(>svg){padding-inline:calc(var(--adu-spacing)*4)}.adu\\:aria-invalid\\:border-destructive[aria-invalid=true]{border-color:var(--destructive)}.adu\\:aria-invalid\\:ring-destructive\\/20[aria-invalid=true]{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:aria-invalid\\:ring-destructive\\/20[aria-invalid=true]{--tw-ring-color:color-mix(in oklab,var(--destructive) 20%,transparent)}}.adu\\:data-\\[disabled\\]\\:pointer-events-none[data-disabled]{pointer-events:none}.adu\\:data-\\[disabled\\]\\:opacity-50[data-disabled]{opacity:.5}.adu\\:data-\\[inset\\]\\:pl-8[data-inset]{padding-left:calc(var(--adu-spacing)*8)}.adu\\:data-\\[side\\=bottom\\]\\:slide-in-from-top-2[data-side=bottom]{--tw-enter-translate-y:calc(var(--adu-spacing)*2*-1)}.adu\\:data-\\[side\\=left\\]\\:slide-in-from-right-2[data-side=left]{--tw-enter-translate-x:calc(var(--adu-spacing)*2)}.adu\\:data-\\[side\\=right\\]\\:slide-in-from-left-2[data-side=right]{--tw-enter-translate-x:calc(var(--adu-spacing)*2*-1)}.adu\\:data-\\[side\\=top\\]\\:slide-in-from-bottom-2[data-side=top]{--tw-enter-translate-y:calc(var(--adu-spacing)*2)}.adu\\:data-\\[state\\=closed\\]\\:animate-out[data-state=closed]{animation:exit var(--tw-animation-duration,var(--tw-duration,.15s)) var(--tw-ease,ease) var(--tw-animation-delay,0s) var(--tw-animation-iteration-count,1) var(--tw-animation-direction,normal) var(--tw-animation-fill-mode,none)}.adu\\:data-\\[state\\=closed\\]\\:fade-out-0[data-state=closed]{--tw-exit-opacity:0}.adu\\:data-\\[state\\=closed\\]\\:zoom-out-95[data-state=closed]{--tw-exit-scale:.95}.adu\\:data-\\[state\\=open\\]\\:animate-in[data-state=open]{animation:enter var(--tw-animation-duration,var(--tw-duration,.15s)) var(--tw-ease,ease) var(--tw-animation-delay,0s) var(--tw-animation-iteration-count,1) var(--tw-animation-direction,normal) var(--tw-animation-fill-mode,none)}.adu\\:data-\\[state\\=open\\]\\:fade-in-0[data-state=open]{--tw-enter-opacity:0}.adu\\:data-\\[state\\=open\\]\\:zoom-in-95[data-state=open]{--tw-enter-scale:.95}.adu\\:data-\\[variant\\=destructive\\]\\:text-destructive[data-variant=destructive]{color:var(--destructive)}.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/10[data-variant=destructive]:focus{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/10[data-variant=destructive]:focus{background-color:color-mix(in oklab,var(--destructive) 10%,transparent)}}.adu\\:data-\\[variant\\=destructive\\]\\:focus\\:text-destructive[data-variant=destructive]:focus{color:var(--destructive)}@media (min-width:64rem){.adu\\:lg\\:block{display:block}.adu\\:lg\\:w-auto{width:auto}}.adu\\:dark\\:bg-destructive\\/60:is(.dark *){background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:bg-destructive\\/60:is(.dark *){background-color:color-mix(in oklab,var(--destructive) 60%,transparent)}}.adu\\:dark\\:bg-input\\/30:is(.dark *){background-color:var(--input)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:bg-input\\/30:is(.dark *){background-color:color-mix(in oklab,var(--input) 30%,transparent)}}.adu\\:dark\\:shadow-xs:is(.dark *){--tw-shadow:0px 2px 2px -1px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1))),0px 1px 1px -.5px var(--tw-shadow-color,hsla(var(--color-shadow),var(--transparency-level-1)));box-shadow:var(--tw-inset-shadow),var(--tw-inset-ring-shadow),var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow)}@media (hover:hover){.adu\\:dark\\:hover\\:bg-input\\/50:is(.dark *):hover{background-color:var(--input)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:hover\\:bg-input\\/50:is(.dark *):hover{background-color:color-mix(in oklab,var(--input) 50%,transparent)}}}.adu\\:dark\\:focus-visible\\:ring-destructive\\/40:is(.dark *):focus-visible{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:focus-visible\\:ring-destructive\\/40:is(.dark *):focus-visible{--tw-ring-color:color-mix(in oklab,var(--destructive) 40%,transparent)}}.adu\\:dark\\:aria-invalid\\:ring-destructive\\/40:is(.dark *)[aria-invalid=true]{--tw-ring-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:aria-invalid\\:ring-destructive\\/40:is(.dark *)[aria-invalid=true]{--tw-ring-color:color-mix(in oklab,var(--destructive) 40%,transparent)}}.adu\\:dark\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/20:is(.dark *)[data-variant=destructive]:focus{background-color:var(--destructive)}@supports (color:color-mix(in lab,red,red)){.adu\\:dark\\:data-\\[variant\\=destructive\\]\\:focus\\:bg-destructive\\/20:is(.dark *)[data-variant=destructive]:focus{background-color:color-mix(in oklab,var(--destructive) 20%,transparent)}}.adu\\:\\[\\\u0026_svg\\]\\:pointer-events-none svg{pointer-events:none}.adu\\:\\[\\\u0026_svg\\]\\:shrink-0 svg{flex-shrink:0}.adu\\:\\[\\\u0026_svg\\:not\\(\\[class\\*\\=\\'size-\\'\\]\\)\\]\\:size-4 svg:not([class*=size-]){width:calc(var(--adu-spacing)*4);height:calc(var(--adu-spacing)*4)}.adu\\:\\[\\.border-b\\]\\:pb-6.border-b{padding-bottom:calc(var(--adu-spacing)*6)}.adu\\:\\[\\.border-t\\]\\:pt-6.border-t{padding-top:calc(var(--adu-spacing)*6)}:is(.adu\\:data-\\[variant\\=destructive\\]\\:\\*\\:\\[svg\\]\\:\\!text-destructive[data-variant=destructive]>*):is(svg){color:var(--destructive)!important}}@property --tw-animation-delay{syntax:\"*\";inherits:false;initial-value:0s}@property --tw-animation-direction{syntax:\"*\";inherits:false;initial-value:normal}@property --tw-animation-duration{syntax:\"*\";inherits:false}@property --tw-animation-fill-mode{syntax:\"*\";inherits:false;initial-value:none}@property --tw-animation-iteration-count{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-blur{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-opacity{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-rotate{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-scale{syntax:\"*\";inherits:false;initial-value:1}@property --tw-enter-translate-x{syntax:\"*\";inherits:false;initial-value:0}@property --tw-enter-translate-y{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-blur{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-opacity{syntax:\"*\";inherits:false;initial-value:1}@property --tw-exit-rotate{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-scale{syntax:\"*\";inherits:false;initial-value:1}@property --tw-exit-translate-x{syntax:\"*\";inherits:false;initial-value:0}@property --tw-exit-translate-y{syntax:\"*\";inherits:false;initial-value:0}@font-face{font-family:Inter Fallback;src:local(Arial);size-adjust:107%;ascent-override:90%;descent-override:22%;line-gap-override:0%}:root{--page:#fff;--card:#fff;--input:#fff;--destructive:#f3e2de;--popover:#fff;--layer:#fffc;--success:#abdfb9;--info:#b2c5fb;--caution:#ffe573;--warning:#ffbf9f;--button-subtle:#00000008;--surface-muted:#c2c2c2;--surface-selected:#efefef;--button-primary:#191919;--foreground:#767676;--foreground-inverse:#f4f4f4;--foreground-bold:#232220;--foreground-card:#232220;--foreground-destructive:#ba351d;--foreground-popover:#232220;--foreground-selected:#6742d5;--foreground-success:#008140;--foreground-info:#344ac5;--foreground-caution:#907600;--foreground-warning:#c45915;--foreground-icon:#1f1f1f;--border-boldest:#1f1f1f;--border-input:#e6e6e6;--border:#afadaa;--border-muted:#cecdca;--border-success:#008140;--border-info:#344ac5;--border-caution:#907600;--border-warning:#c45915;--code-layer:#f4f4f4;--code-content:#fffc;--code-string-key:#595959;--code-string-value:#149750;--code-boolean:#e27133;--code-delimiter:#afafaf;--code-number:#374ec9;--code-object:#6742d5;--color-shadow:0,0%,0%;--color-shadow-destructive:5,85%,37%;--transparency-level-1:.04;--transparency-level-2:.06;--transparency-level-3:.08;--transparency-level-4:.1;--transparency-level-5:.12;--transparency-level-6:.16;--transparency-level-7:.2;--transparency-level-8:.24;--transparency-level-9:.4}.dark{--page:#191919;--card:#21201f;--input:#0000000d;--destructive:#43140b;--popover:#21201f;--layer:#29272580;--success:#225835;--info:#2f428b;--caution:#433600;--warning:#63361f;--button-subtle:#ffffffe6;--surface-muted:#4a4a4a;--surface-selected:#282828;--button-primary:#fff;--foreground:#7b7b7b;--foreground-inverse:#191919;--foreground-bold:#efede9;--foreground-card:#efede9;--foreground-destructive:#ff9179;--foreground-popover:#efede9;--foreground-selected:#b3a7ff;--foreground-success:#61d287;--foreground-info:#94b2ff;--foreground-caution:#f8d523;--foreground-warning:#ff9f6e;--foreground-icon:#eee;--border-boldest:#eee;--border-input:#282828;--border:#63615e;--border-muted:#3f3d3a;--border-success:#61d287;--border-info:#94b2ff;--border-caution:#f8d523;--border-warning:#ff9f6e;--code-layer:#21201f;--code-content:#1a1918;--code-string-key:#b4b4b4;--code-string-value:#61d287;--code-boolean:#ff9f6e;--code-delimiter:#7b7b7b;--code-number:#94b2ff;--code-object:#b3a7ff;--color-shadow:0,0%,100%;--color-shadow-destructive:5,85%,37%;--transparency-level-1:.04;--transparency-level-2:.06;--transparency-level-3:.08;--transparency-level-4:.1;--transparency-level-5:.12;--transparency-level-6:.16;--transparency-level-7:.2;--transparency-level-8:.24;--transparency-level-9:.4}.adu-dropdown-menu-content,.adu-dropdown-menu-content:before,.adu-dropdown-menu-content:after{border-width:1px;border-color:var(--border-input)}@property --tw-border-style{syntax:\"*\";inherits:false;initial-value:solid}@property --tw-leading{syntax:\"*\";inherits:false}@property --tw-font-weight{syntax:\"*\";inherits:false}@property --tw-tracking{syntax:\"*\";inherits:false}@property --tw-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-shadow-color{syntax:\"*\";inherits:false}@property --tw-shadow-alpha{syntax:\"\u003cpercentage>\";inherits:false;initial-value:100%}@property --tw-inset-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-inset-shadow-color{syntax:\"*\";inherits:false}@property --tw-inset-shadow-alpha{syntax:\"\u003cpercentage>\";inherits:false;initial-value:100%}@property --tw-ring-color{syntax:\"*\";inherits:false}@property --tw-ring-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-inset-ring-color{syntax:\"*\";inherits:false}@property --tw-inset-ring-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-ring-inset{syntax:\"*\";inherits:false}@property --tw-ring-offset-width{syntax:\"\u003clength>\";inherits:false;initial-value:0}@property --tw-ring-offset-color{syntax:\"*\";inherits:false;initial-value:#fff}@property --tw-ring-offset-shadow{syntax:\"*\";inherits:false;initial-value:0 0 #0000}@property --tw-ease{syntax:\"*\";inherits:false}@keyframes pulse{50%{opacity:.5}}@keyframes enter{0%{opacity:var(--tw-enter-opacity,1);transform:translate3d(var(--tw-enter-translate-x,0),var(--tw-enter-translate-y,0),0) scale3d(var(--tw-enter-scale,1),var(--tw-enter-scale,1),var(--tw-enter-scale,1)) rotate(var(--tw-enter-rotate,0));filter:blur(var(--tw-enter-blur,0))}}@keyframes exit{to{opacity:var(--tw-exit-opacity,1);transform:translate3d(var(--tw-exit-translate-x,0),var(--tw-exit-translate-y,0),0) scale3d(var(--tw-exit-scale,1),var(--tw-exit-scale,1),var(--tw-exit-scale,1)) rotate(var(--tw-exit-rotate,0));filter:blur(var(--tw-exit-blur,0))}}"},{"filePath":"ui/css/ai.css","content":".connection-card-search,.connection-card-filters button{background:var(--card);border-color:var(--foreground);transition:all 0.2s ease}.connection-card-filters button.active{text-decoration:underline dotted;color:rgb(var(--primary));border-color:rgb(var(--primary))}.connection-card-search{\u0026:focus,\u0026:focus-visible,\u0026:focus-within{border-color:rgb(var(--primary))}input {\n \u0026:focus, \u0026:focus-visible, \u0026:focus-within {\n border: none;\n outline: none;\n }\n }}.connection-card-no-results{text-decoration:none!important;cursor:default!important}.download-button-container{display:inline-block;margin-bottom:1rem}.download-button{display:inline-flex;align-items:center;gap:0.5rem;padding:0.5rem 1.125rem 0.5rem 1rem;border-radius:0.75rem;font-size:0.95rem;font-weight:600;cursor:pointer;transition:all 0.2s ease;text-decoration:none;color:var(--foreground-inverse);background-color:var(--button-primary);box-shadow:0 0 0 1px oklch(from var(--button-primary) l c h / 0.12),\n 0 1px 1px -1px oklch(from var(--button-primary) l c h / 0.06),\n 0 2px 2px -2px oklch(from var(--button-primary) l c h / 0.06),\n 0 2px 4px -2px oklch(from var(--button-primary) l c h / 0.06),\n 0 4px 6px -4px oklch(from var(--button-primary) l c h / 0.06),\n 0 6px 8px -6px oklch(from var(--button-primary) l c h / 0.06),\n 0 -1px 2px 0 oklch(from var(--button-primary) l c h / 0.2) inset}.download-button:hover:not(:disabled){background-color:oklch(from var(--button-primary) l c h / 0.8);box-shadow:0 0 0 4px oklch(from var(--button-primary) l c h / 0.06),\n 0 1px 1px -1px oklch(from var(--button-primary) l c h / 0.06),\n 0 2px 2px -2px oklch(from var(--button-primary) l c h / 0.06),\n 0 2px 4px -2px oklch(from var(--button-primary) l c h / 0.06),\n 0 4px 6px -4px oklch(from var(--button-primary) l c h / 0.06),\n 0 6px 8px -6px oklch(from var(--button-primary) l c h / 0.06),\n 0 -1px 2px 0 oklch(from var(--button-primary) l c h / 0.2) inset}.download-button:disabled{opacity:0.6;cursor:not-allowed}.download-button.downloading{pointer-events:none}.download-spinner{animation:spin 1s linear infinite}@keyframes spin{from{transform:rotate(0deg)}to{transform:rotate(360deg)}}"},{"filePath":"ui/universal-components/universal-components-1.0.27.css","href":"/_mintlify/custom/auth0/73de81e2acf73139/ui/universal-components/universal-components-1.0.27.css"}],"page":{"pagePath":"docs/events/connection/connection.deleted","slug":"/docs/events/connection/connection.deleted","pageMetadata":{"title":"connection.deleted","openapi-schema":"docs/oas/events/events-schema.json connection.deleted","description":null,"href":"/docs/events/connection/connection.deleted"},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];const ApiSectionTitle=({title=`Section`})=>{return _jsx(`div`,{children:_jsx(`div`,{className:`api-section-heading mint-flex mint-flex-col mint-gap-y-4 mint-w-full`,children:_jsx(`div`,{className:`mint-flex mint-items-baseline mint-border-b mint-pb-2.5 mint-border-gray-100 dark:mint-border-gray-800 mint-w-full`,children:_jsx(`h4`,{className:`api-section-heading-title mint-flex-1 mint-mb-0`,children:title})})})})};const ApiReleaseLifecycle=({releaseLifecycle=`GA`})=>{const lifecycleMap={ea:`Early Access`,ga:`Generally Available`,deprecated:`Deprecated`,planned:`Planned`,beta:`Beta`};const LIFECYCLE_THEMES={info:{light:{bg:`lab(91.896% .077188 -6.94053)`,text:`lab(36.091% 25.9241 -68.0384)`},dark:{bg:`lab(16.0426% 6.71726 -27.2409)`,text:`lab(72.6029% 4.08953 -41.9669)`}},secondary:{light:{bg:`lab(90.8548% 11.3355 8.01476)`,text:`lab(47.5286% 56.4238 43.4706)`},dark:{bg:`lab(16.3609% 37.191 25.6346)`,text:`lab(71.881% 41.5 29.4839)`}},danger:{light:{bg:`lab(94.7916% -.0000298023 0)`,text:`lab(54.3656% 0 -.0000119209)`},dark:{bg:`lab(13.232% 0 0)`,text:`lab(51.6164% 0 0)`}}};const LIFECYCLE_THEME_MAP={ea:`info`,ga:`info`,beta:`info`,deprecated:`secondary`,planned:`danger`};const lifecycle=releaseLifecycle.toLocaleLowerCase();const lifecycleText=lifecycleMap[lifecycle];if(!lifecycleText){return null}const theme=LIFECYCLE_THEMES[LIFECYCLE_THEME_MAP[lifecycle]];return _jsxs(`div`,{children:[_jsx(`div`,{className:`api-section-heading mint-flex mint-flex-col mint-gap-y-4 mint-w-full`,children:_jsx(`div`,{className:`mint-flex mint-items-baseline mint-border-b mint-pb-2.5 mint-border-gray-100 dark:mint-border-gray-800 mint-w-full`,children:_jsx(`h4`,{className:`api-section-heading-title mint-flex-1 mint-mb-0`,children:`Release Lifecycle`})})}),_jsx(`div`,{className:`mint-flex mint-font-mono mint-text-sm mint-group/param-head param-head mint-break-all mint-relative mint-mt-2.5`,id:`releaselifecycle-lifecycle`,children:_jsx(`div`,{className:`mint-flex-1 mint-flex mint-flex-col mint-content-start mint-py-0.5 mint-mr-5`,children:_jsxs(`div`,{className:`mint-flex mint-items-center mint-flex-wrap mint-gap-2`,children:[_jsx(`div`,{className:`mint-absolute mint--top-1.5`,children:_jsx(`a`,{href:`#releaselifecycle-lifecycle`,className:`mint--ml-10 mint-flex mint-items-center mint-opacity-0 mint-border-0 group-hover/param-head:mint-opacity-100 focus:mint-opacity-100 focus:mint-outline-0 mint-py-2 [.expandable-content_\u0026]:mint--ml-[2.1rem] mint-group/link`,\"aria-label\":`Navigate to header`,children:_jsx(`div`,{className:`mint-w-6 mint-h-6 mint-rounded-md mint-flex mint-items-center mint-justify-center mint-shadow-sm mint-text-gray-400 dark:mint-text-white/50 dark:bg-background-dark dark:mint-brightness-[1.35] dark:mint-ring-1 dark:hover:mint-brightness-150 mint-bg-white mint-ring-1 mint-ring-gray-400/30 dark:mint-ring-gray-700/25 hover:mint-ring-gray-400/60 dark:hover:mint-ring-white/20 group-focus/link:mint-border-2 group-focus/link:border-primary dark:group-focus/link:border-primary-light`,children:_jsx(`svg`,{xmlns:`http://www.w3.org/2000/svg`,fill:`gray`,height:`12px`,viewBox:`0 0 576 512`,children:_jsx(`path`,{d:`M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z`})})})})}),_jsx(`span`,{className:`mint-inline-flex mint-items-center mint-w-fit mint-font-medium mint-gap-1 mint-py-0.5 mint-px-2 mint-rounded-md`,style:{lineHeight:`1rem`,fontSize:`0.75rem`,fontFamily:`var(--font-jetbrains-mono), ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace`,backgroundColor:`light-dark(${theme.light.bg}, ${theme.dark.bg})`,color:`light-dark(${theme.light.text}, ${theme.dark.text})`,borderColor:`light-dark(color-mix(in oklab, ${theme.light.text} 25%, transparent), color-mix(in oklab, ${theme.dark.text} 25%, transparent))`},children:lifecycleText})]})})})]})};function _createMdxContent(props){const{_MdxComponentBoundary}={..._provideComponents(),...props.components};if(!_MdxComponentBoundary)_missingMdxReference(`_MdxComponentBoundary`,true);return _jsxs(_Fragment,{children:[_jsx(_MdxComponentBoundary,{name:`ApiReleaseLifecycle`,children:_jsx(ApiReleaseLifecycle,{releaseLifecycle:`EA`})}),`\n`,_jsx(_MdxComponentBoundary,{name:`ApiSectionTitle`,children:_jsx(ApiSectionTitle,{title:`Schema`})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{ApiSectionTitle,ApiReleaseLifecycle,default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"connection.deleted","openapi-schema":"docs/oas/events/events-schema.json connection.deleted","description":null,"href":"/docs/events/connection/connection.deleted"}}},"mdxSourceWithNoJs":null,"noJsSplices":[[151,4390,")=>null;const ApiReleaseLifecycle=()=>null;function _createM"]]},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/auth0/68ac07e0f912aad4/docs/scripts/navbar-controller.js","/_mintlify/custom/auth0/98c52e2a822716a4/docs/scripts/overscroll-disable.js","/_mintlify/custom/auth0/15b21268d7cc82a0/ui/auth0-docs-ui-1.10.0.umd.js","/_mintlify/custom/auth0/edda60bac2809e28/ui/js/auth0-cli-language.js","/_mintlify/custom/auth0/af65702d2f0210f7/ui/universal-components/universal-components-1.0.27.umd.js"],"dynamicCss":".mint-absolute {\n position: absolute\n}\n.mint-relative {\n position: relative\n}\n.mint--top-1\\.5 {\n top: -0.375rem\n}\n.mint--ml-10 {\n margin-left: -2.5rem\n}\n.mint-mb-0 {\n margin-bottom: 0px\n}\n.mint-mr-5 {\n margin-right: 1.25rem\n}\n.mint-mt-2\\.5 {\n margin-top: 0.625rem\n}\n.mint-flex {\n display: flex\n}\n.mint-inline-flex {\n display: inline-flex\n}\n.mint-h-6 {\n height: 1.5rem\n}\n.mint-w-6 {\n width: 1.5rem\n}\n.mint-w-fit {\n width: fit-content\n}\n.mint-w-full {\n width: 100%\n}\n.mint-flex-1 {\n flex: 1 1 0%\n}\n.mint-flex-col {\n flex-direction: column\n}\n.mint-flex-wrap {\n flex-wrap: wrap\n}\n.mint-content-start {\n align-content: flex-start\n}\n.mint-items-center {\n align-items: center\n}\n.mint-items-baseline {\n align-items: baseline\n}\n.mint-justify-center {\n justify-content: center\n}\n.mint-gap-1 {\n gap: 0.25rem\n}\n.mint-gap-2 {\n gap: 0.5rem\n}\n.mint-gap-y-4 {\n row-gap: 1rem\n}\n.mint-break-all {\n word-break: break-all\n}\n.mint-rounded-md {\n border-radius: 0.375rem\n}\n.mint-border-0 {\n border-width: 0px\n}\n.mint-border-b {\n border-bottom-width: 1px\n}\n.mint-border-gray-100 {\n --tw-border-opacity: 1;\n border-color: rgb(243 244 246 / var(--tw-border-opacity, 1))\n}\n.mint-bg-white {\n --tw-bg-opacity: 1;\n background-color: rgb(255 255 255 / var(--tw-bg-opacity, 1))\n}\n.mint-px-2 {\n padding-left: 0.5rem;\n padding-right: 0.5rem\n}\n.mint-py-0\\.5 {\n padding-top: 0.125rem;\n padding-bottom: 0.125rem\n}\n.mint-py-2 {\n padding-top: 0.5rem;\n padding-bottom: 0.5rem\n}\n.mint-pb-2\\.5 {\n padding-bottom: 0.625rem\n}\n.mint-font-mono {\n font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace\n}\n.mint-text-sm {\n font-size: 0.875rem;\n line-height: 1.25rem\n}\n.mint-font-medium {\n font-weight: 500\n}\n.mint-text-gray-400 {\n --tw-text-opacity: 1;\n color: rgb(156 163 175 / var(--tw-text-opacity, 1))\n}\n.mint-opacity-0 {\n opacity: 0\n}\n.mint-shadow-sm {\n --tw-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.05);\n --tw-shadow-colored: 0 1px 2px 0 var(--tw-shadow-color);\n box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow)\n}\n.mint-ring-1 {\n --tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);\n --tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);\n box-shadow: var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow, 0 0 #0000)\n}\n.mint-ring-gray-400\\/30 {\n --tw-ring-color: rgb(156 163 175 / 0.3)\n}\n.hover\\:mint-ring-gray-400\\/60:hover {\n --tw-ring-color: rgb(156 163 175 / 0.6)\n}\n.focus\\:mint-opacity-100:focus {\n opacity: 1\n}\n.focus\\:mint-outline-0:focus {\n outline-width: 0px\n}\n.mint-group\\/param-head:hover .group-hover\\/param-head\\:mint-opacity-100 {\n opacity: 1\n}\n.mint-group\\/link:focus .group-focus\\/link\\:mint-border-2 {\n border-width: 2px\n}\n.dark\\:mint-border-gray-800:is(.dark *) {\n --tw-border-opacity: 1;\n border-color: rgb(31 41 55 / var(--tw-border-opacity, 1))\n}\n.dark\\:mint-text-white\\/50:is(.dark *) {\n color: rgb(255 255 255 / 0.5)\n}\n.dark\\:mint-ring-1:is(.dark *) {\n --tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);\n --tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);\n box-shadow: var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow, 0 0 #0000)\n}\n.dark\\:mint-ring-gray-700\\/25:is(.dark *) {\n --tw-ring-color: rgb(55 65 81 / 0.25)\n}\n.dark\\:mint-brightness-\\[1\\.35\\]:is(.dark *) {\n --tw-brightness: brightness(1.35);\n filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)\n}\n.dark\\:hover\\:mint-ring-white\\/20:hover:is(.dark *) {\n --tw-ring-color: rgb(255 255 255 / 0.2)\n}\n.dark\\:hover\\:mint-brightness-150:hover:is(.dark *) {\n --tw-brightness: brightness(1.5);\n filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)\n}\n.expandable-content .\\[\\.expandable-content_\\\u0026\\]\\:mint--ml-\\[2\\.1rem\\] {\n margin-left: -2.1rem\n}","openApiReferenceData":{"schemaData":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"connection.deleted","type":"object","properties":{"specversion":{"description":"The version of the CloudEvents specification which the event uses.","type":"string","enum":["1.0"],"x-auth0-owner":"platform-streaming-foundations","isRequired":true,"uniqueKey":"specversion","typeLabel":"enum\u003cstring>"},"type":{"type":"string","const":"connection.deleted","description":"The type of the event which has happened.","isRequired":true,"uniqueKey":"type","typeLabel":"string"},"source":{"type":"string","examples":["urn:auth0:example.auth0app.com"],"description":"The source of the event. This will take the form 'urn:auth0:\u003ctenant>.\u003cdomain>'.","isRequired":true,"uniqueKey":"source","typeLabel":"string"},"id":{"description":"A unique identifier for the event.","type":"string","examples":["evt_vjFVP5pVdfvsfRKatshkVV"],"pattern":"evt_[a-zA-Z0-9]{22}","isRequired":true,"uniqueKey":"id","typeLabel":"string"},"time":{"type":"string","format":"date-time","examples":["2025-02-01T12:34:56Z"],"description":"An ISO-8601 timestamp indicating when the event physically occurred.","isRequired":true,"uniqueKey":"time","typeLabel":"string\u003cdate-time>"},"data":{"description":"The event payload.","type":"object","properties":{"object":{"oneOf":[{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.0.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","const":"oidc","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.0.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.0.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"data.object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"description":"Options for the 'oidc' connection","type":"object","properties":{"client_id":{"type":"string","examples":["abc123def456ghi789"],"minLength":0,"maxLength":255,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"data.object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","type":"object","properties":{"pkce":{"description":"PKCE configuration.","type":"string","enum":["auto","S256","plain","disabled"],"uniqueKey":"data.object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"data.object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"data.object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","items":{"type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"description":"Algorithm allowed to verify the ID tokens.","uniqueKey":"data.object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","uniqueKey":"data.object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"description":"The internal schema version of the connection options.","type":"string","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"data.object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","examples":["openid profile email"],"minLength":6,"maxLength":255,"description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","uniqueKey":"data.object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"data.object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","type":"string","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"data.object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"data.object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","type":"string","enum":["issuer","token_endpoint"],"uniqueKey":"data.object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"data.object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","type":"object","properties":{"attributes":{"description":"Object containing mapping details for incoming claims","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","examples":["openid profile email"],"minLength":0,"maxLength":255,"description":"Scopes to send to the IdP's Userinfo endpoint","uniqueKey":"data.object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"description":"Method used to map incoming claims when strategy=oidc.","type":"string","enum":["bind_all","use_map"],"uniqueKey":"data.object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","examples":["https://provider.example.com/.well-known/openid-configuration"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","uniqueKey":"data.object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","type":"string","enum":["back_channel","front_channel"],"uniqueKey":"data.object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.0.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.1.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","const":"okta","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.1.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.1.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.1.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'okta' connection","type":"object","properties":{"client_id":{"type":"string","examples":["abc123def456ghi789"],"minLength":0,"maxLength":255,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"data.object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","type":"object","properties":{"pkce":{"description":"PKCE configuration.","type":"string","enum":["auto","S256","plain","disabled"],"uniqueKey":"data.object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"data.object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"data.object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","items":{"type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"description":"Algorithm allowed to verify the ID tokens.","uniqueKey":"data.object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","uniqueKey":"data.object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"description":"The internal schema version of the connection options.","type":"string","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"data.object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","examples":["openid profile email"],"minLength":6,"maxLength":255,"description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","uniqueKey":"data.object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"data.object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","type":"string","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"data.object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"data.object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","type":"string","enum":["issuer","token_endpoint"],"uniqueKey":"data.object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"data.object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"description":"Mapping of claims received from the identity provider (IdP)","type":"object","properties":{"attributes":{"description":"Object containing mapping details for incoming claims","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","examples":["openid profile email"],"minLength":0,"maxLength":255,"description":"Scopes to send to the IdP's Userinfo endpoint","uniqueKey":"data.object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"description":"Method used to map incoming claims when strategy=okta.","type":"string","enum":["basic_profile","use_map"],"uniqueKey":"data.object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","examples":["dev-123456.okta.com"],"minLength":4,"maxLength":255,"description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","uniqueKey":"data.object.oneOf.1.options.domain","typeLabel":"string"},"type":{"description":"Connection type","type":"string","enum":["back_channel"],"uniqueKey":"data.object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.1.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.2.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","const":"samlp","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.2.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.2.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.2.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'samlp' connection","type":"object","properties":{"assertion_decryption_settings":{"description":"Settings for SAML assertion decryption.","type":"object","properties":{"algorithm_profile":{"description":"The algorithm profile to use for decrypting SAML assertions.","type":"string","enum":["v2026-1"],"isRequired":true,"uniqueKey":"data.object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"maxItems":10,"description":"A list of insecure algorithms to allow for SAML assertion decryption.","uniqueKey":"data.object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"required":["algorithm_profile"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","minLength":1,"maxLength":10240,"description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","deprecated":true,"uniqueKey":"data.object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","type":"string","enum":["sha1","sha256"],"uniqueKey":"data.object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":50001,"description":"Domain aliases for the connection","uniqueKey":"data.object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","format":"date-time","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","uniqueKey":"data.object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","type":"object","properties":{"client_authorizequery":{"type":"string","minLength":1,"maxLength":2048,"description":"The query string sent to the default application","uniqueKey":"data.object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"type":"string","minLength":1,"maxLength":256,"description":"The client ID to use for IdP-initiated login requests.","uniqueKey":"data.object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"description":"The response protocol used to communicate with the default application.","type":"string","enum":["oidc","samlp","wsfed"],"uniqueKey":"data.object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"type":"boolean","description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","uniqueKey":"data.object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","type":"string","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"data.object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","type":"string","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"data.object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV"],"minLength":1,"maxLength":10240,"uniqueKey":"data.object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"type":"boolean","description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","uniqueKey":"data.object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["ef34ab56cd78901234567890123456789012efab"],"minLength":40,"maxLength":40,"uniqueKey":"data.object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1,"description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","uniqueKey":"data.object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"type":"boolean","description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","uniqueKey":"data.object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"type":"boolean","description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","uniqueKey":"data.object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":255,"format":"uri","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","uniqueKey":"data.object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"data.object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"type":"boolean","description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","uniqueKey":"data.object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","examples":["https://provider.example.com/.well-known/openid-configuration"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","x-release-lifecycle":"EA","uniqueKey":"data.object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","minLength":0,"maxLength":8192,"description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","uniqueKey":"data.object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"type":"string","minLength":1,"maxLength":1024,"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","uniqueKey":"data.object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"type":"string","minLength":1,"maxLength":1024,"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","uniqueKey":"data.object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","examples":["https://idp.example.com/saml/metadata"],"minLength":8,"maxLength":2048,"format":"uri","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","uniqueKey":"data.object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","x-release-lifecycle":"EA","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","examples":["https://idp.example.com/saml/acs"],"minLength":8,"maxLength":255,"format":"uri","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","uniqueKey":"data.object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"type":"string","minLength":1,"maxLength":10240,"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","uniqueKey":"data.object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","examples":["https://idp.example.com/saml/slo"],"minLength":8,"maxLength":2048,"format":"uri","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","uniqueKey":"data.object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"type":"string","minLength":1,"maxLength":2396,"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","uniqueKey":"data.object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.2.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.3.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","const":"pingfederate","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.3.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.3.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.3.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'pingfederate' connection","type":"object","properties":{"pingFederateBaseUrl":{"type":"string","examples":["https://pingfederate.example.com"],"minLength":8,"maxLength":256,"format":"uri","description":"URL provided by PingFederate which returns information used for creating the connection","isRequired":true,"uniqueKey":"data.object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"description":"Settings for SAML assertion decryption.","type":"object","properties":{"algorithm_profile":{"description":"The algorithm profile to use for decrypting SAML assertions.","type":"string","enum":["v2026-1"],"isRequired":true,"uniqueKey":"data.object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"maxItems":10,"description":"A list of insecure algorithms to allow for SAML assertion decryption.","uniqueKey":"data.object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"required":["algorithm_profile"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","minLength":1,"maxLength":10240,"description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","deprecated":true,"uniqueKey":"data.object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","type":"string","enum":["sha1","sha256"],"uniqueKey":"data.object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":50001,"description":"Domain aliases for the connection","uniqueKey":"data.object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","format":"date-time","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","uniqueKey":"data.object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","type":"object","properties":{"client_authorizequery":{"type":"string","minLength":1,"maxLength":2048,"description":"The query string sent to the default application","uniqueKey":"data.object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"type":"string","minLength":1,"maxLength":256,"description":"The client ID to use for IdP-initiated login requests.","uniqueKey":"data.object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"description":"The response protocol used to communicate with the default application.","type":"string","enum":["oidc","samlp","wsfed"],"uniqueKey":"data.object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"type":"boolean","description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","uniqueKey":"data.object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","type":"string","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"data.object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","type":"string","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"data.object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV"],"minLength":1,"maxLength":10240,"uniqueKey":"data.object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"type":"boolean","description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","uniqueKey":"data.object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["ef34ab56cd78901234567890123456789012efab"],"minLength":40,"maxLength":40,"uniqueKey":"data.object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1,"description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","uniqueKey":"data.object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.3.options.upstream_params","typeLabel":"object"}},"required":["pingFederateBaseUrl"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.3.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.4.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","const":"adfs","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.4.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.4.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.4.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'adfs' connection","type":"object","properties":{"adfs_server":{"type":"string","examples":["adfs.example.com"],"minLength":0,"maxLength":2048,"description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","uniqueKey":"data.object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","minLength":1,"maxLength":102400,"description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","uniqueKey":"data.object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"description":"Choose how Auth0 sets the email_verified field in the user profile.","type":"string","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"data.object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"type":"string","minLength":1,"maxLength":128,"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","uniqueKey":"data.object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.4.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.5.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","const":"ad","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.5.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.5.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.5.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'ad' connection","type":"object","properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","examples":["192.168.1.10"],"minLength":2,"maxLength":39,"uniqueKey":"data.object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"type":"boolean","description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","uniqueKey":"data.object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"type":"string","examples":["1.4.2"],"minLength":5,"maxLength":12,"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","uniqueKey":"data.object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"data.object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"data.object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","items":{"type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG"],"minLength":256,"maxLength":3072,"uniqueKey":"data.object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":2,"description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","uniqueKey":"data.object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"data.object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"data.object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","uniqueKey":"data.object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","items":{"type":"string","examples":["192.168.1.10"],"minLength":2,"maxLength":39,"uniqueKey":"data.object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":256,"description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","uniqueKey":"data.object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"data.object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"data.object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","examples":["https://ad-connector.example.com"],"minLength":8,"maxLength":255,"format":"uri","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","uniqueKey":"data.object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"type":"string","examples":["corp.example.com"],"minLength":1,"maxLength":512,"format":"hostname","description":"Primary AD domain hint used for HRD and discovery.","uniqueKey":"data.object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","items":{"type":"string","examples":["8233ec9c12a44625d4a64ee413651fd928b5168f"],"minLength":40,"maxLength":40,"uniqueKey":"data.object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":2,"description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","uniqueKey":"data.object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.5.options.upstream_params","typeLabel":"object"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.5.options","typeLabel":"object"}},"isRequired":true,"uniqueKey":"data.object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.6.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","const":"google-apps","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.6.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.6.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.6.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'google-apps' connection","type":"object","properties":{"client_id":{"type":"string","examples":["123456789-abc123def456.apps.googleusercontent.com"],"minLength":1,"maxLength":128,"description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","isRequired":true,"uniqueKey":"data.object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"type":"string","format":"date-time","description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","uniqueKey":"data.object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"data.object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"data.object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"data.object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":1024,"description":"Primary Google Workspace domain name that users must belong to.","uniqueKey":"data.object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"data.object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"data.object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"data.object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"data.object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"data.object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"data.object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"data.object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"data.object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"data.object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":64,"description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","uniqueKey":"data.object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"The Google Workspace primary domain used to identify the organization during authentication.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.6.options.upstream_params","typeLabel":"object"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.6.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.object.oneOf.7.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","const":"waad","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.object.oneOf.7.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.7.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.object.oneOf.7.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'waad' connection","type":"object","properties":{"client_id":{"type":"string","examples":["12345678-1234-1234-1234-123456789012"],"minLength":0,"maxLength":100,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"data.object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"type":"string","examples":["contoso.onmicrosoft.com"],"minLength":0,"maxLength":255,"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","uniqueKey":"data.object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","examples":["api://contoso-azure-app"],"minLength":0,"maxLength":500,"description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","uniqueKey":"data.object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"data.object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","examples":["contoso.onmicrosoft.com"],"minLength":0,"maxLength":512,"description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","uniqueKey":"data.object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"data.object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","uniqueKey":"data.object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"data.object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"data.object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"data.object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"data.object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","type":"string","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"data.object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","examples":["100"],"minLength":0,"maxLength":10,"description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","uniqueKey":"data.object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"data.object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","uniqueKey":"data.object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"description":"Choose how Auth0 sets the email_verified field in the user profile.","type":"string","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"data.object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"example":"contoso.onmicrosoft.com","uniqueKey":"data.object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"data.object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"data.object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"type":"string","examples":["12345678-1234-1234-1234-123456789012"],"minLength":36,"maxLength":36,"format":"uuid","description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","uniqueKey":"data.object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"data.object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"data.object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","type":"string","enum":["oid","sub"],"uniqueKey":"data.object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","type":"string","enum":["ws-federation","openid-connect"],"uniqueKey":"data.object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.object.oneOf.7.show_as_button","typeLabel":"boolean"}},"isRequired":true,"uniqueKey":"data.object.oneOf.7","typeLabel":"object"}],"isRequired":true,"uniqueKey":"data.object","typeLabel":"object"},"previous_object":{"oneOf":[{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.name","typeLabel":"string"},"strategy":{"type":"string","const":"oidc","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.authentication","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.0.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.0.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.0.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.0.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.0.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.0.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.0.realms","typeLabel":"string[]"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.connected_accounts.active","typeLabel":"boolean"},"cross_app_access":{"type":"boolean","uniqueKey":"data.previous_object.oneOf.0.connected_accounts.cross_app_access","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.connected_accounts","typeLabel":"object"},"options":{"description":"Options for the 'oidc' connection","type":"object","properties":{"client_id":{"type":"string","examples":["abc123def456ghi789"],"minLength":0,"maxLength":255,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.client_id","typeLabel":"string"},"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","type":"object","properties":{"pkce":{"description":"PKCE configuration.","type":"string","enum":["auto","S256","plain","disabled"],"uniqueKey":"data.previous_object.oneOf.0.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.0.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.previous_object.oneOf.0.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"data.previous_object.oneOf.0.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"data.previous_object.oneOf.0.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","items":{"type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"description":"Algorithm allowed to verify the ID tokens.","uniqueKey":"data.previous_object.oneOf.0.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","uniqueKey":"data.previous_object.oneOf.0.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.0.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.0.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.options.oidc_metadata","typeLabel":"object"},"schema_version":{"description":"The internal schema version of the connection options.","type":"string","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"data.previous_object.oneOf.0.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","examples":["openid profile email"],"minLength":6,"maxLength":255,"description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","uniqueKey":"data.previous_object.oneOf.0.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"data.previous_object.oneOf.0.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.0.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.0.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","type":"string","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"data.previous_object.oneOf.0.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"data.previous_object.oneOf.0.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","type":"string","enum":["issuer","token_endpoint"],"uniqueKey":"data.previous_object.oneOf.0.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.0.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"data.previous_object.oneOf.0.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.0.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"description":"Configuration for mapping claims from the identity provider to Auth0 user profile attributes. Allows customizing which IdP claims populate user fields and how they are transformed.","type":"object","properties":{"attributes":{"description":"Object containing mapping details for incoming claims","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.0.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","examples":["openid profile email"],"minLength":0,"maxLength":255,"description":"Scopes to send to the IdP's Userinfo endpoint","uniqueKey":"data.previous_object.oneOf.0.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"description":"Method used to map incoming claims when strategy=oidc.","type":"string","enum":["bind_all","use_map"],"uniqueKey":"data.previous_object.oneOf.0.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.options.attribute_map","typeLabel":"object"},"discovery_url":{"type":"string","examples":["https://provider.example.com/.well-known/openid-configuration"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features.","uniqueKey":"data.previous_object.oneOf.0.options.discovery_url","typeLabel":"string\u003curi>"},"type":{"description":"OIDC communication channel type. 'back_channel' (confidential client) exchanges tokens server-side for stronger security; 'front_channel' handles responses in the browser.","type":"string","enum":["back_channel","front_channel"],"uniqueKey":"data.previous_object.oneOf.0.options.type","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.0.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.0.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.0","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.name","typeLabel":"string"},"strategy":{"type":"string","const":"okta","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.1.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.1.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.1.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.1.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.1.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.1.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.1.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'okta' connection","type":"object","properties":{"client_id":{"type":"string","examples":["abc123def456ghi789"],"minLength":0,"maxLength":255,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.client_id","typeLabel":"string"},"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.authorization_endpoint","typeLabel":"string\u003curi>"},"connection_settings":{"description":"OAuth 2.0 PKCE (Proof Key for Code Exchange) settings. PKCE enhances security for public clients by preventing authorization code interception attacks. 'auto' (recommended) uses the strongest method supported by the IdP.","type":"object","properties":{"pkce":{"description":"PKCE configuration.","type":"string","enum":["auto","S256","plain","disabled"],"uniqueKey":"data.previous_object.oneOf.1.options.connection_settings.pkce","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.options.connection_settings","typeLabel":"object"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.1.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.previous_object.oneOf.1.options.domain_aliases","typeLabel":"string[]"},"dpop_signing_alg":{"description":"Algorithm used for DPoP proof JWT signing. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","ES512","Ed25519"],"uniqueKey":"data.previous_object.oneOf.1.options.dpop_signing_alg","typeLabel":"enum\u003cstring>"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.options.federated_connections_access_tokens","typeLabel":"object"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.icon_url","typeLabel":"string\u003curi>"},"id_token_session_expiry_supported":{"type":"boolean","description":"Indicates whether the identity provider supports session expiry via the id_token. If true, the system will use the session_expiry claim in the id_token to determine session expiry.","uniqueKey":"data.previous_object.oneOf.1.options.id_token_session_expiry_supported","typeLabel":"boolean"},"id_token_signed_response_algs":{"type":"array","items":{"type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"description":"Algorithm allowed to verify the ID tokens.","uniqueKey":"data.previous_object.oneOf.1.options.id_token_signed_response_algs.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"List of algorithms allowed to verify the ID tokens. Applicable when strategy=oidc or okta.","uniqueKey":"data.previous_object.oneOf.1.options.id_token_signed_response_algs","typeLabel":"enum\u003cstring>[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.jwks_uri","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.1.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.1.options.non_persistent_attrs","typeLabel":"string[]"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.options.oidc_metadata","typeLabel":"object"},"schema_version":{"description":"The internal schema version of the connection options.","type":"string","enum":["openid-1.0.0","oidc-v4"],"uniqueKey":"data.previous_object.oneOf.1.options.schema_version","typeLabel":"enum\u003cstring>"},"scope":{"type":"string","examples":["openid profile email"],"minLength":6,"maxLength":255,"description":"Space-separated list of OAuth 2.0 scopes requested during authorization. Must include 'openid' (required by OIDC spec). Common values: 'openid profile email'. Additional scopes depend on the identity provider.","uniqueKey":"data.previous_object.oneOf.1.options.scope","typeLabel":"string"},"send_back_channel_nonce":{"type":"boolean","description":"When true and type is 'back_channel', includes a cryptographic nonce in authorization requests to prevent replay attacks. The identity provider must include this nonce in the ID token for validation.","uniqueKey":"data.previous_object.oneOf.1.options.send_back_channel_nonce","typeLabel":"boolean"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.1.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.1.options.tenant_domain","typeLabel":"string"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_method":{"description":"Authentication method used at the identity provider's token endpoint. 'client_secret_post' sends credentials in the request body; 'private_key_jwt' uses a signed JWT assertion for enhanced security. Applicable when strategy=oidc or okta.","type":"string","enum":["client_secret_post","private_key_jwt"],"uniqueKey":"data.previous_object.oneOf.1.options.token_endpoint_auth_method","typeLabel":"enum\u003cstring>"},"token_endpoint_auth_signing_alg":{"description":"Algorithm used to sign client_assertions. Applicable when strategy=oidc or okta.","type":"string","enum":["ES256","ES384","PS256","PS384","RS256","RS384","RS512"],"uniqueKey":"data.previous_object.oneOf.1.options.token_endpoint_auth_signing_alg","typeLabel":"enum\u003cstring>"},"token_endpoint_jwtca_aud_format":{"description":"Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL).","type":"string","enum":["issuer","token_endpoint"],"uniqueKey":"data.previous_object.oneOf.1.options.token_endpoint_jwtca_aud_format","typeLabel":"enum\u003cstring>"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.1.options.upstream_params","typeLabel":"object"},"useOauthSpecScope":{"type":"boolean","description":"When true, uses space-delimited scopes (per OAuth 2.0 spec) instead of comma-delimited when calling the identity provider's authorization endpoint. Only relevant when using the connection_scope parameter. See https://auth0.com/docs/authenticate/identity-providers/adding-scopes-for-an-external-idp#pass-scopes-to-authorize-endpoint","uniqueKey":"data.previous_object.oneOf.1.options.useOauthSpecScope","typeLabel":"boolean"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.1.options.userinfo_endpoint","typeLabel":"string\u003curi>"},"attribute_map":{"description":"Mapping of claims received from the identity provider (IdP)","type":"object","properties":{"attributes":{"description":"Object containing mapping details for incoming claims","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.1.options.attribute_map.attributes","typeLabel":"object"},"userinfo_scope":{"type":"string","examples":["openid profile email"],"minLength":0,"maxLength":255,"description":"Scopes to send to the IdP's Userinfo endpoint","uniqueKey":"data.previous_object.oneOf.1.options.attribute_map.userinfo_scope","typeLabel":"string"},"mapping_mode":{"description":"Method used to map incoming claims when strategy=okta.","type":"string","enum":["basic_profile","use_map"],"uniqueKey":"data.previous_object.oneOf.1.options.attribute_map.mapping_mode","typeLabel":"enum\u003cstring>"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.options.attribute_map","typeLabel":"object"},"domain":{"type":"string","examples":["dev-123456.okta.com"],"minLength":4,"maxLength":255,"description":"Domain of the Okta organization (e.g., dev-123456.okta.com). Should be just the domain of the okta server with no scheme or trailing backslash. Discovery runs only when connection.options.oidc_metadata is empty and a domain is provided","uniqueKey":"data.previous_object.oneOf.1.options.domain","typeLabel":"string"},"type":{"description":"Connection type","type":"string","enum":["back_channel"],"uniqueKey":"data.previous_object.oneOf.1.options.type","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.1.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.1.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.1","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.name","typeLabel":"string"},"strategy":{"type":"string","const":"samlp","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.2.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.2.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.2.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.2.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.2.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.2.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.2.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'samlp' connection","type":"object","properties":{"assertion_decryption_settings":{"description":"Settings for SAML assertion decryption.","type":"object","properties":{"algorithm_profile":{"description":"The algorithm profile to use for decrypting SAML assertions.","type":"string","enum":["v2026-1"],"isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"maxItems":10,"description":"A list of insecure algorithms to allow for SAML assertion decryption.","uniqueKey":"data.previous_object.oneOf.2.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"required":["algorithm_profile"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","minLength":1,"maxLength":10240,"description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","deprecated":true,"uniqueKey":"data.previous_object.oneOf.2.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.previous_object.oneOf.2.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","type":"string","enum":["sha1","sha256"],"uniqueKey":"data.previous_object.oneOf.2.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.2.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":50001,"description":"Domain aliases for the connection","uniqueKey":"data.previous_object.oneOf.2.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.previous_object.oneOf.2.options.entityId","typeLabel":"string"},"expires":{"type":"string","format":"date-time","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","uniqueKey":"data.previous_object.oneOf.2.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.2.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","type":"object","properties":{"client_authorizequery":{"type":"string","minLength":1,"maxLength":2048,"description":"The query string sent to the default application","uniqueKey":"data.previous_object.oneOf.2.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"type":"string","minLength":1,"maxLength":256,"description":"The client ID to use for IdP-initiated login requests.","uniqueKey":"data.previous_object.oneOf.2.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"description":"The response protocol used to communicate with the default application.","type":"string","enum":["oidc","samlp","wsfed"],"uniqueKey":"data.previous_object.oneOf.2.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"type":"boolean","description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","uniqueKey":"data.previous_object.oneOf.2.options.idpinitiated.enabled","typeLabel":"boolean"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.2.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.2.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","type":"string","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"data.previous_object.oneOf.2.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.2.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","type":"string","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"data.previous_object.oneOf.2.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.previous_object.oneOf.2.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV"],"minLength":1,"maxLength":10240,"uniqueKey":"data.previous_object.oneOf.2.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"type":"boolean","description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","uniqueKey":"data.previous_object.oneOf.2.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.2.options.subject","typeLabel":"object"},"tenant_domain":{"description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.2.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["ef34ab56cd78901234567890123456789012efab"],"minLength":40,"maxLength":40,"uniqueKey":"data.previous_object.oneOf.2.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1,"description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","uniqueKey":"data.previous_object.oneOf.2.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.2.options.upstream_params","typeLabel":"object"},"debug":{"type":"boolean","description":"When true, enables detailed SAML debugging by issuing 'w' (warning) events in tenant logs containing SAML request/response details. WARNING: Potentially exposes sensitive user information (PII, credentials) and should only be enabled temporarily for debugging purposes.","uniqueKey":"data.previous_object.oneOf.2.options.debug","typeLabel":"boolean"},"deflate":{"type":"boolean","description":"When true, enables DEFLATE compression for SAML requests sent via HTTP-Redirect binding.","uniqueKey":"data.previous_object.oneOf.2.options.deflate","typeLabel":"boolean"},"destinationUrl":{"type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":255,"format":"uri","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","uniqueKey":"data.previous_object.oneOf.2.options.destinationUrl","typeLabel":"string\u003curi>"},"disableFieldsMapFix":{"type":"boolean","description":"When true, disables the automatic correction of the fieldsMap configuration to ensure proper mapping of SAML attributes to user profile fields. Defaults to false (fieldsMap fix enabled).","uniqueKey":"data.previous_object.oneOf.2.options.disableFieldsMapFix","typeLabel":"boolean"},"disableSignout":{"type":"boolean","description":"When true, disables sending SAML logout requests (SingleLogoutService) to the identity provider during user sign-out. The user will be logged out of Auth0 but will remain logged into the identity provider. Defaults to false (federated logout enabled).","uniqueKey":"data.previous_object.oneOf.2.options.disableSignout","typeLabel":"boolean"},"discovery_url":{"type":"string","examples":["https://provider.example.com/.well-known/openid-configuration"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's OIDC Discovery endpoint (/.well-known/openid-configuration). When provided and oidc_metadata is empty, Auth0 automatically retrieves the provider's configuration including endpoints and supported features. Used with Cross App Access.","x-release-lifecycle":"EA","uniqueKey":"data.previous_object.oneOf.2.options.discovery_url","typeLabel":"string\u003curi>"},"fieldsMap":{"description":"Maps SAML assertion attributes from the identity provider to Auth0 user profile attributes. Format: { 'auth0_field': 'saml_attribute' } or { 'auth0_field': ['saml_attr1', 'saml_attr2'] } for fallback options. Merged with default mappings for email, name, given_name, family_name, and groups.","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.2.options.fieldsMap","typeLabel":"object"},"fieldsMapJsonRaw":{"type":"string","minLength":0,"maxLength":8192,"description":"Raw JSON string representation of the fieldsMap configuration. Used internally for storage and retrieval of the fieldsMap object.","uniqueKey":"data.previous_object.oneOf.2.options.fieldsMapJsonRaw","typeLabel":"string"},"global_token_revocation_jwt_iss":{"type":"string","minLength":1,"maxLength":1024,"description":"Expected 'iss' (Issuer) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT issuer matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_sub.","uniqueKey":"data.previous_object.oneOf.2.options.global_token_revocation_jwt_iss","typeLabel":"string"},"global_token_revocation_jwt_sub":{"type":"string","minLength":1,"maxLength":1024,"description":"Expected 'sub' (Subject) claim value for JWT tokens in Global Token Revocation requests from the identity provider. When configured, Auth0 validates the JWT subject matches this value before processing token revocation. Must be used together with global_token_revocation_jwt_iss.","uniqueKey":"data.previous_object.oneOf.2.options.global_token_revocation_jwt_sub","typeLabel":"string"},"metadataUrl":{"type":"string","examples":["https://idp.example.com/saml/metadata"],"minLength":8,"maxLength":2048,"format":"uri","description":"HTTPS URL to the identity provider's SAML metadata document. When provided, Auth0 automatically fetches and parses the metadata to extract signInEndpoint, signOutEndpoint, signingCert, signSAMLRequest, and protocolBinding. Use metadataUrl OR metadataXml, not both.","uniqueKey":"data.previous_object.oneOf.2.options.metadataUrl","typeLabel":"string\u003curi>"},"oidc_metadata":{"description":"OpenID Connect Provider Metadata as per https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. Used with Cross App Access.","x-release-lifecycle":"EA","type":"object","properties":{"authorization_endpoint":{"description":"URL of the identity provider's OAuth 2.0 authorization endpoint where users are redirected for authentication. Must be a valid HTTPS URL. This endpoint initiates the OAuth 2.0 authorization code flow.","type":"string","examples":["https://provider.example.com/oauth/authorize"],"minLength":8,"maxLength":2083,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.authorization_endpoint","typeLabel":"string\u003curi>"},"id_token_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"description":"JWS signing algorithm supported by the IdP for ID Token signing (from OIDC discovery metadata).","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":26,"description":"A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow). https://datatracker.ietf.org/doc/html/rfc7518","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_signing_alg_values_supported","typeLabel":"string[]"},"issuer":{"description":"The identity provider's unique issuer identifier URL (e.g., https://accounts.google.com). Must match the 'iss' claim in ID tokens from the identity provider.","type":"string","examples":["https://accounts.example.com"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.issuer","typeLabel":"string\u003curi>"},"jwks_uri":{"description":"URL of the identity provider's JSON Web Key Set (JWKS) endpoint containing public keys for signature verification. Auth0 retrieves these keys to validate ID token signatures.","type":"string","examples":["https://provider.example.com/.well-known/jwks.json"],"minLength":8,"maxLength":255,"format":"uri","isRequired":true,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.jwks_uri","typeLabel":"string\u003curi>"},"acr_values_supported":{"type":"array","items":{"type":"string","examples":["urn:mace:incommon:iap:silver"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":30,"description":"A list of the Authentication Context Class References that this OP supports","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.acr_values_supported","typeLabel":"string[]"},"claim_types_supported":{"type":"array","items":{"type":"string","examples":["normal"],"maxLength":25,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of the Claim Types that the OpenID Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect Core 1.0 [OpenID.Core]. If omitted, the implementation supports only normal Claims.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claim_types_supported","typeLabel":"string[]"},"claims_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"Languages and scripts supported for values in Claims being returned, represented as a JSON array of BCP47 [RFC5646] language tag values. Not all languages and scripts are necessarily supported for all Claim values.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claims_locales_supported","typeLabel":"string[]"},"claims_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claims_parameter_supported","typeLabel":"boolean"},"claims_supported":{"type":"array","items":{"type":"string","examples":["sub"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claims_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.claims_supported","typeLabel":"string[]"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string","examples":["S256"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":10,"description":"JSON array containing a list of Proof Key for Code Exchange (PKCE) code challenge methods supported by this OP (e.g., S256, plain), as defined in RFC 7636.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.code_challenge_methods_supported","typeLabel":"string[]"},"display_values_supported":{"type":"array","items":{"type":"string","examples":["page"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":6,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.display_values_supported","typeLabel":"string[]"},"dpop_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["ES256"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported for DPoP proof JWT signing.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.dpop_signing_alg_values_supported","typeLabel":"string[]"},"end_session_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/logout"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the identity provider's logout/end session endpoint. When configured as a static URL, users are redirected here after logging out from Auth0. Must use HTTPS scheme.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.end_session_endpoint","typeLabel":"string\u003curi>"},"grant_types_supported":{"type":"array","items":{"type":"string","examples":["authorization_code"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the OAuth 2.0 Grant Type values that this OP supports. Dynamic OpenID Providers MUST support the authorization_code and implicit Grant Type values and MAY support other Grant Types. If omitted, the default value is [\"authorization_code\", \"implicit\"].","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.grant_types_supported","typeLabel":"string[]"},"id_token_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":14,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_alg_values_supported","typeLabel":"string[]"},"id_token_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.id_token_encryption_enc_values_supported","typeLabel":"string[]"},"op_policy_uri":{"type":"string","examples":["https://provider.example.com/policy"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about the OPs requirements on how the Relying Party can use the data provided by the OP. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.op_policy_uri","typeLabel":"string\u003curi>"},"op_tos_uri":{"type":"string","examples":["https://provider.example.com/terms"],"minLength":8,"maxLength":255,"format":"uri","description":"URL that the OpenID Provider provides to the person registering the Client to read about OpenID Providers terms of service. The registration process SHOULD display this URL to the person registering the Client if it is given.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.op_tos_uri","typeLabel":"string\u003curi>"},"registration_endpoint":{"type":"string","examples":["https://provider.example.com/oauth/register"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of the OPs Dynamic Client Registration Endpoint. RECOMMENDED but not REQUIRED. https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Registration","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.registration_endpoint","typeLabel":"string\u003curi>"},"request_object_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RSA-OAEP"],"maxLength":28,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_alg_values_supported","typeLabel":"string[]"},"request_object_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. These algorithms are used both when the Request Object is passed by value and when it is passed by reference.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_encryption_enc_values_supported","typeLabel":"string[]"},"request_object_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter). Servers SHOULD support none and RS256.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_object_signing_alg_values_supported","typeLabel":"string[]"},"request_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_parameter_supported","typeLabel":"boolean"},"request_uri_parameter_supported":{"type":"boolean","description":"Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.request_uri_parameter_supported","typeLabel":"boolean"},"require_request_uri_registration":{"type":"boolean","description":"Boolean value specifying whether the OP requires use of the request_uri parameter. If omitted, the default value is false.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.require_request_uri_registration","typeLabel":"boolean"},"response_modes_supported":{"type":"array","items":{"type":"string","examples":["query"],"maxLength":20,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":16,"description":"A list of the OAuth 2.0 response_mode values that this OP supports. If omitted, the default for Dynamic OpenID Providers is [\"query\", \"fragment\"]","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.response_modes_supported","typeLabel":"string[]"},"response_types_supported":{"type":"array","items":{"type":"string","examples":["code"],"maxLength":40,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":40,"description":"A list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.response_types_supported","typeLabel":"string[]"},"scopes_supported":{"type":"array","items":{"type":"string","examples":["openid"],"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":7000,"description":"A list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if supported. RECOMMENDED but not REQUIRED","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.scopes_supported","typeLabel":"string[]"},"service_documentation":{"type":"string","examples":["https://provider.example.com/docs"],"minLength":8,"maxLength":255,"format":"uri","description":"URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider. In particular, if the OpenID Provider does not support Dynamic Client Registration, then information on how to register Clients needs to be provided in this documentation.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.service_documentation","typeLabel":"string\u003curi>"},"subject_types_supported":{"type":"array","items":{"type":"string","examples":["public"],"minLength":0,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.subject_types_supported","typeLabel":"string[]"},"token_endpoint":{"description":"URL of the identity provider's OAuth 2.0 token endpoint where authorization codes are exchanged for access tokens. Must be a valid HTTPS URL. Required for authorization code flow but optional for implicit flow.","type":"string","examples":["https://provider.example.com/oauth/token"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint","typeLabel":"string\u003curi>"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","examples":["client_secret_basic"],"maxLength":60,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":14,"description":"JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_methods_supported","typeLabel":"string[]"},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":24,"description":"JSON array containing a list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT [JWT] used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. Servers SHOULD support RS256. The value none MUST NOT be used.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.token_endpoint_auth_signing_alg_values_supported","typeLabel":"string[]"},"ui_locales_supported":{"type":"array","items":{"type":"string","examples":["en-US"],"maxLength":50,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":150,"description":"Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.ui_locales_supported","typeLabel":"string[]"},"userinfo_encryption_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWE [JWE] encryption algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_alg_values_supported","typeLabel":"string[]"},"userinfo_encryption_enc_values_supported":{"type":"array","items":{"type":"string","examples":["A128CBC-HS256"],"maxLength":26,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":12,"description":"JSON array containing a list of the JWE encryption algorithms (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_encryption_enc_values_supported","typeLabel":"string[]"},"userinfo_endpoint":{"description":"Optional URL of the identity provider's UserInfo endpoint. When configured with attribute mapping, Auth0 calls this endpoint to retrieve additional user profile claims using the access token.","type":"string","examples":["https://provider.example.com/oauth/userinfo"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_endpoint","typeLabel":"string\u003curi>"},"userinfo_signing_alg_values_supported":{"type":"array","items":{"type":"string","examples":["RS256"],"maxLength":10,"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":26,"description":"JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT]. The value none MAY be included.","uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata.userinfo_signing_alg_values_supported","typeLabel":"string[]"}},"required":["authorization_endpoint","id_token_signing_alg_values_supported","issuer","jwks_uri"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.options.oidc_metadata","typeLabel":"object"},"recipientUrl":{"type":"string","examples":["https://idp.example.com/saml/acs"],"minLength":8,"maxLength":255,"format":"uri","description":"The URL where Auth0 will send SAML authentication requests (the Identity Provider's SSO URL). Must be a valid HTTPS URL.","uniqueKey":"data.previous_object.oneOf.2.options.recipientUrl","typeLabel":"string\u003curi>"},"requestTemplate":{"type":"string","minLength":1,"maxLength":10240,"description":"Custom XML template for SAML authentication requests. Supports variable substitution using @@variableName@@ syntax. When not provided, uses default SAML AuthnRequest template. See https://auth0.com/docs/authenticate/protocols/saml/saml-sso-integrations/configure-auth0-saml-service-provider#customize-the-request-template","uniqueKey":"data.previous_object.oneOf.2.options.requestTemplate","typeLabel":"string"},"signOutEndpoint":{"type":"string","examples":["https://idp.example.com/saml/slo"],"minLength":8,"maxLength":2048,"format":"uri","description":"Identity provider's SAML SingleLogoutService endpoint URL where Auth0 sends logout requests for federated sign-out. When not provided, defaults to signInEndpoint. Only used if disableSignout is false.","uniqueKey":"data.previous_object.oneOf.2.options.signOutEndpoint","typeLabel":"string\u003curi>"},"user_id_attribute":{"type":"string","minLength":1,"maxLength":2396,"description":"Custom SAML assertion attribute to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single SAML attribute name).","uniqueKey":"data.previous_object.oneOf.2.options.user_id_attribute","typeLabel":"string"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.2.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.2.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.2","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.name","typeLabel":"string"},"strategy":{"type":"string","const":"pingfederate","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.3.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.3.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.3.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.3.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.3.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.3.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.3.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.3.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.3.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'pingfederate' connection","type":"object","properties":{"pingFederateBaseUrl":{"type":"string","examples":["https://pingfederate.example.com"],"minLength":8,"maxLength":256,"format":"uri","description":"URL provided by PingFederate which returns information used for creating the connection","isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.options.pingFederateBaseUrl","typeLabel":"string\u003curi>"},"assertion_decryption_settings":{"description":"Settings for SAML assertion decryption.","type":"object","properties":{"algorithm_profile":{"description":"The algorithm profile to use for decrypting SAML assertions.","type":"string","enum":["v2026-1"],"isRequired":true,"uniqueKey":"data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_profile","typeLabel":"enum\u003cstring>"},"algorithm_exceptions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions.items.[INDEX]","typeLabel":"string"},"maxItems":10,"description":"A list of insecure algorithms to allow for SAML assertion decryption.","uniqueKey":"data.previous_object.oneOf.3.options.assertion_decryption_settings.algorithm_exceptions","typeLabel":"string[]"}},"required":["algorithm_profile"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.3.options.assertion_decryption_settings","typeLabel":"object"},"cert":{"type":"string","minLength":1,"maxLength":10240,"description":"X.509 signing certificate from the identity provider in .der format. Used to validate signatures in SAML Responses and Assertions. This is an alternative to signingCert and is kept for backward compatibility. Prefer using signingCert instead.","deprecated":true,"uniqueKey":"data.previous_object.oneOf.3.options.cert","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.previous_object.oneOf.3.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"digestAlgorithm":{"description":"Algorithm used for computing digest values when signing SAML requests and logout requests. Defaults to 'sha256'.","type":"string","enum":["sha1","sha256"],"uniqueKey":"data.previous_object.oneOf.3.options.digestAlgorithm","typeLabel":"enum\u003cstring>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.3.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":50001,"description":"Domain aliases for the connection","uniqueKey":"data.previous_object.oneOf.3.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the SAML Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'. This value is included in SAML AuthnRequest messages sent to the identity provider.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.previous_object.oneOf.3.options.entityId","typeLabel":"string"},"expires":{"type":"string","format":"date-time","description":"ISO 8601 formatted datetime indicating when the identity provider's signing certificate expires.","uniqueKey":"data.previous_object.oneOf.3.options.expires","typeLabel":"string\u003cdate-time>"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.3.options.icon_url","typeLabel":"string\u003curi>"},"idpinitiated":{"description":"Configuration for IdP-Initiated SAML Single Sign-On. When enabled, allows users to initiate login directly from their SAML identity provider without first visiting Auth0. The IdP must include the connection parameter in the post-back URL (Assertion Consumer Service URL).","type":"object","properties":{"client_authorizequery":{"type":"string","minLength":1,"maxLength":2048,"description":"The query string sent to the default application","uniqueKey":"data.previous_object.oneOf.3.options.idpinitiated.client_authorizequery","typeLabel":"string"},"client_id":{"type":"string","minLength":1,"maxLength":256,"description":"The client ID to use for IdP-initiated login requests.","uniqueKey":"data.previous_object.oneOf.3.options.idpinitiated.client_id","typeLabel":"string"},"client_protocol":{"description":"The response protocol used to communicate with the default application.","type":"string","enum":["oidc","samlp","wsfed"],"uniqueKey":"data.previous_object.oneOf.3.options.idpinitiated.client_protocol","typeLabel":"enum\u003cstring>"},"enabled":{"type":"boolean","description":"When true, enables IdP-initiated login support for this SAML connection. Allows users to log in directly from the identity provider without first visiting Auth0.","uniqueKey":"data.previous_object.oneOf.3.options.idpinitiated.enabled","typeLabel":"boolean"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.3.options.idpinitiated","typeLabel":"object"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.3.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.3.options.non_persistent_attrs","typeLabel":"string[]"},"protocolBinding":{"description":"SAML protocol binding mechanism for sending authentication requests to the identity provider.","type":"string","enum":["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST","urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"],"uniqueKey":"data.previous_object.oneOf.3.options.protocolBinding","typeLabel":"enum\u003cstring>"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.3.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signatureAlgorithm":{"description":"Algorithm used to sign SAML authentication requests and logout requests using the connection's signing key. Common values: 'rsa-sha256' (RSA signature with SHA-256 digest) or 'rsa-sha1'. Defaults to 'rsa-sha256'.","type":"string","enum":["rsa-sha1","rsa-sha256"],"uniqueKey":"data.previous_object.oneOf.3.options.signatureAlgorithm","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Identity provider's SAML SingleSignOnService endpoint URL where Auth0 sends SAML authentication requests. This is the primary login URL for the SAML connection. Required unless using metadataUrl or metadataXml.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.previous_object.oneOf.3.options.signInEndpoint","typeLabel":"string\u003curi>"},"signingCert":{"description":"Base64-encoded X.509 certificate from the identity provider used to validate signatures in SAML responses and assertions. The certificate is decoded and used for cryptographic signature verification.","type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV"],"minLength":1,"maxLength":10240,"uniqueKey":"data.previous_object.oneOf.3.options.signingCert","typeLabel":"string"},"signSAMLRequest":{"type":"boolean","description":"When true, Auth0 signs SAML authentication requests using the connection's signing key. The signature includes the request's digest and is validated by the identity provider. Defaults to false (unsigned requests).","uniqueKey":"data.previous_object.oneOf.3.options.signSAMLRequest","typeLabel":"boolean"},"subject":{"description":"Certificate Subject Distinguished Name (DN) extracted from the identity provider's signing certificate.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.3.options.subject","typeLabel":"object"},"tenant_domain":{"description":"For SAML connections, the tenant domain used to construct the login endpoint URL. Can be a string for single-tenant or an array of strings for multi-tenant validation.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.3.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["ef34ab56cd78901234567890123456789012efab"],"minLength":40,"maxLength":40,"uniqueKey":"data.previous_object.oneOf.3.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1,"description":"SHA-1 thumbprints (fingerprints) of the identity provider's signing certificates. Automatically computed from signingCert during connection creation. Each thumbprint must be a 40-character hexadecimal string.","uniqueKey":"data.previous_object.oneOf.3.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.3.options.upstream_params","typeLabel":"object"}},"required":["pingFederateBaseUrl"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.3.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.3.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.3","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.4.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.4.name","typeLabel":"string"},"strategy":{"type":"string","const":"adfs","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.4.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.4.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.4.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.4.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.4.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.4.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.4.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.4.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.4.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.4.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.4.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.4.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'adfs' connection","type":"object","properties":{"adfs_server":{"type":"string","examples":["adfs.example.com"],"minLength":0,"maxLength":2048,"description":"ADFS federation metadata host or XML URL used to discover WS-Fed endpoints and certificates. Errors if adfs_server and fedMetadataXml are both absent.","uniqueKey":"data.previous_object.oneOf.4.options.adfs_server","typeLabel":"string"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.previous_object.oneOf.4.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.4.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.previous_object.oneOf.4.options.domain_aliases","typeLabel":"string[]"},"entityId":{"description":"The entity identifier (Issuer) for the ADFS Service Provider. When not provided, defaults to 'urn:auth0:{tenant}:{connection}'.","type":"string","examples":["urn:auth0:my-tenant:my-connection"],"minLength":1,"maxLength":128,"uniqueKey":"data.previous_object.oneOf.4.options.entityId","typeLabel":"string"},"fedMetadataXml":{"type":"string","minLength":1,"maxLength":102400,"description":"Inline XML alternative to 'adfs_server'. Cannot be set together with 'adfs_server'.","uniqueKey":"data.previous_object.oneOf.4.options.fedMetadataXml","typeLabel":"string"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.4.options.icon_url","typeLabel":"string\u003curi>"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.4.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.4.options.non_persistent_attrs","typeLabel":"string[]"},"prev_thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.previous_object.oneOf.4.options.prev_thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.previous_object.oneOf.4.options.prev_thumbprints","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.4.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"description":"Choose how Auth0 sets the email_verified field in the user profile.","type":"string","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"data.previous_object.oneOf.4.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"description":"Passive Requestor (WS-Fed) sign-in endpoint discovered from metadata or provided explicitly.","type":"string","examples":["https://idp.example.com/saml/sso"],"minLength":8,"maxLength":2048,"format":"uri","uniqueKey":"data.previous_object.oneOf.4.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"description":"Tenant domain","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.4.options.tenant_domain","typeLabel":"string"},"thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.previous_object.oneOf.4.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.previous_object.oneOf.4.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.4.options.upstream_params","typeLabel":"object"},"user_id_attribute":{"type":"string","minLength":1,"maxLength":128,"description":"Custom ADFS claim to use as the unique user identifier. When provided, this attribute is prepended to the default user_id mapping list with highest priority. Accepts a string (single ADFS claim name).","uniqueKey":"data.previous_object.oneOf.4.options.user_id_attribute","typeLabel":"string"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.4.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.4.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.4","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.5.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.5.name","typeLabel":"string"},"strategy":{"type":"string","const":"ad","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.5.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.5.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.5.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.5.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.5.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.5.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.5.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.5.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.5.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.5.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.5.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.5.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'ad' connection","type":"object","properties":{"agentIP":{"description":"IP address of the AD connector agent used to validate that authentication requests originate from the corporate network for Kerberos authentication (managed by the AD Connector agent).","type":"string","examples":["192.168.1.10"],"minLength":2,"maxLength":39,"uniqueKey":"data.previous_object.oneOf.5.options.agentIP","typeLabel":"string"},"agentMode":{"type":"boolean","description":"When enabled, allows direct username/password authentication through the AD connector agent instead of WS-Federation protocol (managed by the AD Connector agent).","uniqueKey":"data.previous_object.oneOf.5.options.agentMode","typeLabel":"boolean"},"agentVersion":{"type":"string","examples":["1.4.2"],"minLength":5,"maxLength":12,"description":"Version identifier of the installed AD connector agent software (managed by the AD Connector agent).","uniqueKey":"data.previous_object.oneOf.5.options.agentVersion","typeLabel":"string"},"brute_force_protection":{"type":"boolean","description":"Enables Auth0's brute force protection to prevent credential stuffing attacks. When enabled, blocks suspicious login attempts from specific IP addresses after repeated failures.","uniqueKey":"data.previous_object.oneOf.5.options.brute_force_protection","typeLabel":"boolean"},"certAuth":{"type":"boolean","description":"Enables client SSL certificate authentication for the AD connector, requiring HTTPS on the sign-in endpoint","uniqueKey":"data.previous_object.oneOf.5.options.certAuth","typeLabel":"boolean"},"certs":{"type":"array","items":{"type":"string","examples":["MIIDDTCCAfWgAwIBAgIJALFkBP7GVlWkMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNVBAMTGmV4YW1wbGUuYXV0aDAuY29tIENlcnQgQ0EwHhcNMjUwMTAxMDAwMDAwWhcNMjYwMTAxMDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7o4qne60TB3wolFrzabc1234567890ABCDEFG"],"minLength":256,"maxLength":3072,"uniqueKey":"data.previous_object.oneOf.5.options.certs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":2,"description":"Array of X.509 certificates in PEM format used for validating SAML signatures from the AD identity provider (managed by the AD Connector agent).","uniqueKey":"data.previous_object.oneOf.5.options.certs","typeLabel":"string[]"},"disable_cache":{"type":"boolean","description":"When enabled, disables caching of AD connector authentication results to ensure real-time validation against the directory","uniqueKey":"data.previous_object.oneOf.5.options.disable_cache","typeLabel":"boolean"},"disable_self_service_change_password":{"type":"boolean","description":"When enabled, hides the 'Forgot Password' link on login pages to prevent users from initiating self-service password resets","uniqueKey":"data.previous_object.oneOf.5.options.disable_self_service_change_password","typeLabel":"boolean"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.5.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"List of domain names that can be used with identifier-first authentication flow to route users to this AD connection; each domain must be a valid DNS name up to 256 characters","uniqueKey":"data.previous_object.oneOf.5.options.domain_aliases","typeLabel":"string[]"},"icon_url":{"description":"https url of the icon to be shown","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.5.options.icon_url","typeLabel":"string\u003curi>"},"ips":{"type":"array","items":{"type":"string","examples":["192.168.1.10"],"minLength":2,"maxLength":39,"uniqueKey":"data.previous_object.oneOf.5.options.ips.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":256,"description":"Array of IP address ranges in CIDR notation used to determine if authentication requests originate from the corporate network for Kerberos or certificate authentication.","uniqueKey":"data.previous_object.oneOf.5.options.ips","typeLabel":"string[]"},"kerberos":{"type":"boolean","description":"Enables Windows Integrated Authentication (Kerberos) for seamless SSO when users authenticate from within the corporate network IP ranges","uniqueKey":"data.previous_object.oneOf.5.options.kerberos","typeLabel":"boolean"},"kerberos_only":{"type":"boolean","description":"When true, restricts the connection to Kerberos-only authentication, disallowing username/password fallback.","uniqueKey":"data.previous_object.oneOf.5.options.kerberos_only","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.5.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.5.options.non_persistent_attrs","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.5.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"signInEndpoint":{"type":"string","examples":["https://ad-connector.example.com"],"minLength":8,"maxLength":255,"format":"uri","description":"The sign-in endpoint type for the AD-LDAP connector agent (managed by the AD Connector agent).","uniqueKey":"data.previous_object.oneOf.5.options.signInEndpoint","typeLabel":"string\u003curi>"},"tenant_domain":{"type":"string","examples":["corp.example.com"],"minLength":1,"maxLength":512,"format":"hostname","description":"Primary AD domain hint used for HRD and discovery.","uniqueKey":"data.previous_object.oneOf.5.options.tenant_domain","typeLabel":"string\u003chostname>"},"thumbprints":{"type":"array","items":{"type":"string","examples":["8233ec9c12a44625d4a64ee413651fd928b5168f"],"minLength":40,"maxLength":40,"uniqueKey":"data.previous_object.oneOf.5.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":2,"description":"Array of certificate SHA-1 thumbprints for validating signatures. Managed by Auth0 when using the AD Connector agent.","uniqueKey":"data.previous_object.oneOf.5.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.5.options.upstream_params","typeLabel":"object"}},"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.5.options","typeLabel":"object"}},"uniqueKey":"data.previous_object.oneOf.5","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.name","typeLabel":"string"},"strategy":{"type":"string","const":"google-apps","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.6.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.6.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.6.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.6.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.6.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.6.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.6.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.6.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.6.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'google-apps' connection","type":"object","properties":{"client_id":{"type":"string","examples":["123456789-abc123def456.apps.googleusercontent.com"],"minLength":1,"maxLength":128,"description":"Your Google OAuth 2.0 client ID. You can find this in your [Google Cloud Console](https://console.cloud.google.com/apis/credentials) under the OAuth 2.0 Client IDs section.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.options.client_id","typeLabel":"string"},"admin_access_token_expiresin":{"type":"string","format":"date-time","description":"Expiration timestamp for the `admin_access_token` in ISO 8601 format. Auth0 uses this value to determine when to refresh the token.","uniqueKey":"data.previous_object.oneOf.6.options.admin_access_token_expiresin","typeLabel":"string\u003cdate-time>"},"allow_setting_login_scopes":{"type":"boolean","description":"When true, allows customization of OAuth scopes requested during user login. Custom scopes are appended to the mandatory email and profile scopes. When false or omitted, only the default email and profile scopes are used. This property is automatically enabled when Token Vault or Connected Accounts features are activated.","uniqueKey":"data.previous_object.oneOf.6.options.allow_setting_login_scopes","typeLabel":"boolean"},"api_enable_groups":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API for groups. When true, Auth0 can synchronize groups \u0026 group memberships and supports inbound directory provisioning for groups. Defaults to false.","uniqueKey":"data.previous_object.oneOf.6.options.api_enable_groups","typeLabel":"boolean"},"api_enable_users":{"type":"boolean","description":"Enables integration with the Google Workspace Admin SDK Directory API. When true, Auth0 can retrieve extended user attributes (admin status, suspension status, group memberships) and supports inbound directory provisioning (SCIM). Defaults to true.","uniqueKey":"data.previous_object.oneOf.6.options.api_enable_users","typeLabel":"boolean"},"domain":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":1024,"description":"Primary Google Workspace domain name that users must belong to.","uniqueKey":"data.previous_object.oneOf.6.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","items":{"type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"description":"A domain alias used for Home Realm Discovery.","uniqueKey":"data.previous_object.oneOf.6.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Email domains associated with this connection for Home Realm Discovery (HRD). When a user's email matches one of these domains, they are automatically routed to this connection during authentication.","uniqueKey":"data.previous_object.oneOf.6.options.domain_aliases","typeLabel":"string[]"},"email":{"type":"boolean","description":"Whether the OAuth flow requests the `email` scope.","uniqueKey":"data.previous_object.oneOf.6.options.email","typeLabel":"boolean"},"ext_agreed_terms":{"type":"boolean","description":"Fetches the `agreedToTerms` flag from the Google Directory profile.","uniqueKey":"data.previous_object.oneOf.6.options.ext_agreed_terms","typeLabel":"boolean"},"ext_groups":{"type":"boolean","description":"Enables enrichment with Google group memberships (required for `ext_groups_extended`).","uniqueKey":"data.previous_object.oneOf.6.options.ext_groups","typeLabel":"boolean"},"ext_groups_extended":{"type":"boolean","description":"Controls whether enriched group entries include `id`, `email`, `name` (true) or only the group name (false); can only be set when `ext_groups` is true.","uniqueKey":"data.previous_object.oneOf.6.options.ext_groups_extended","typeLabel":"boolean"},"ext_is_admin":{"type":"boolean","description":"Fetches the Google Directory admin flag for the signing-in user.","uniqueKey":"data.previous_object.oneOf.6.options.ext_is_admin","typeLabel":"boolean"},"ext_is_suspended":{"type":"boolean","description":"Fetches the Google Directory suspended flag for the signing-in user.","uniqueKey":"data.previous_object.oneOf.6.options.ext_is_suspended","typeLabel":"boolean"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.previous_object.oneOf.6.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.6.options.federated_connections_access_tokens","typeLabel":"object"},"handle_login_from_social":{"type":"boolean","description":"When enabled, users who sign in with their Google account through a social login will be automatically routed to this Google Workspace connection if their email domain matches the configured tenant_domain or domain_aliases. This ensures enterprise users authenticate through their organization's Google Workspace identity provider rather than through a generic Google social login, enabling access to directory-based attributes and enforcing organizational security policies. Defaults to true for new connections.","uniqueKey":"data.previous_object.oneOf.6.options.handle_login_from_social","typeLabel":"boolean"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.6.options.icon_url","typeLabel":"string\u003curi>"},"map_user_id_to_id":{"type":"boolean","description":"Determines how Auth0 generates the user_id for Google Workspace users. When false (default), the user's email address is used. When true, Google's stable numeric user ID is used instead, which persists even if the user's email changes. This setting can only be configured when creating the connection and cannot be changed afterward.","uniqueKey":"data.previous_object.oneOf.6.options.map_user_id_to_id","typeLabel":"boolean"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.6.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.6.options.non_persistent_attrs","typeLabel":"string[]"},"profile":{"type":"boolean","description":"Whether the OAuth flow requests the `profile` scope.","uniqueKey":"data.previous_object.oneOf.6.options.profile","typeLabel":"boolean"},"scope":{"type":"array","items":{"type":"string","minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.6.options.scope.items.[INDEX]","typeLabel":"string"},"minItems":1,"maxItems":64,"description":"Additional OAuth scopes requested beyond the default `email profile` scopes; ignored unless `allow_setting_login_scopes` is true.","uniqueKey":"data.previous_object.oneOf.6.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.6.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"tenant_domain":{"description":"The Google Workspace primary domain used to identify the organization during authentication.","type":"string","examples":["example.com"],"minLength":1,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.6.options.tenant_domain","typeLabel":"string"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.6.options.upstream_params","typeLabel":"object"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.6.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.6.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.6","typeLabel":"object"},{"type":"object","description":"The event content as it was prior to the change described by this event, when applicable.","required":["id","name","strategy"],"x-auth0-owner":"authn-b2b-enterprise-federations","properties":{"id":{"description":"The connection's identifier","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.id","typeLabel":"string"},"name":{"description":"The name of the connection. Must start and end with an alphanumeric character and can only contain alphanumeric characters and '-'. Max length 128","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.name","typeLabel":"string"},"strategy":{"type":"string","const":"waad","description":"The connection strategy.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.strategy","typeLabel":"string"},"authentication":{"description":"Configure the purpose of a connection to be used for authentication during login.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.authentication.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.7.authentication","typeLabel":"object"},"connected_accounts":{"description":"Configure the purpose of a connection to be used for connected accounts and Token Vault.","type":"object","properties":{"active":{"type":"boolean","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.connected_accounts.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.7.connected_accounts","typeLabel":"object"},"display_name":{"type":"string","examples":["My Enterprise Connection"],"minLength":1,"maxLength":128,"description":"Connection name used in the new universal login experience","uniqueKey":"data.previous_object.oneOf.7.display_name","typeLabel":"string"},"enabled_clients":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.7.enabled_clients.items.[INDEX]","typeLabel":"string"},"examples":[["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"]],"description":"Use of this property is NOT RECOMMENDED. Use the PATCH /v2/connections/{id}/clients endpoint to enable the connection for a set of clients.","uniqueKey":"data.previous_object.oneOf.7.enabled_clients","typeLabel":"string[]"},"is_domain_connection":{"type":"boolean","description":"\u003ccode>true\u003c/code> promotes to a domain-level connection so that third-party applications can use it. \u003ccode>false\u003c/code> does not promote the connection, so only first-party applications with the connection enabled can use it. (Defaults to \u003ccode>false\u003c/code>.)","uniqueKey":"data.previous_object.oneOf.7.is_domain_connection","typeLabel":"boolean"},"metadata":{"description":"Metadata associated with the connection in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed.","type":"object","properties":{},"unevaluatedProperties":{"type":"string"},"uniqueKey":"data.previous_object.oneOf.7.metadata","typeLabel":"object"},"realms":{"type":"array","items":{"type":"string","uniqueKey":"data.previous_object.oneOf.7.realms.items.[INDEX]","typeLabel":"string"},"examples":[["example.com"]],"minItems":0,"maxItems":10,"description":"Defines the realms for which the connection will be used (ie: email domains). If the array is empty or the property is not specified, the connection name will be added as realm.","uniqueKey":"data.previous_object.oneOf.7.realms","typeLabel":"string[]"},"options":{"description":"Options for the 'waad' connection","type":"object","properties":{"client_id":{"type":"string","examples":["12345678-1234-1234-1234-123456789012"],"minLength":0,"maxLength":100,"description":"OAuth 2.0 client identifier issued by the identity provider during application registration. This value identifies your Auth0 connection to the identity provider.","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.options.client_id","typeLabel":"string"},"api_enable_users":{"type":"boolean","description":"Enable users API","uniqueKey":"data.previous_object.oneOf.7.options.api_enable_users","typeLabel":"boolean"},"app_domain":{"type":"string","examples":["contoso.onmicrosoft.com"],"minLength":0,"maxLength":255,"description":"The Azure AD application domain (e.g., 'contoso.onmicrosoft.com'). Used primarily with WS-Federation protocol and Azure AD v1 endpoints.","uniqueKey":"data.previous_object.oneOf.7.options.app_domain","typeLabel":"string"},"app_id":{"type":"string","examples":["api://contoso-azure-app"],"minLength":0,"maxLength":500,"description":"The Application ID URI (App ID URI) for the Azure AD application. Required when using Azure AD v1 with the Resource Owner Password flow. Used to identify the resource being requested in OAuth token requests.","uniqueKey":"data.previous_object.oneOf.7.options.app_id","typeLabel":"string"},"basic_profile":{"type":"boolean","description":"Includes basic user profile information from Azure AD (name, email, given_name, family_name). Always enabled and required - represents the minimum profile data retrieved during authentication.","uniqueKey":"data.previous_object.oneOf.7.options.basic_profile","typeLabel":"boolean"},"cert_rollover_notification":{"type":"string","format":"date-time","description":"Timestamp of the last certificate expiring soon notification.","uniqueKey":"data.previous_object.oneOf.7.options.cert_rollover_notification","typeLabel":"string\u003cdate-time>"},"domain":{"type":"string","examples":["contoso.onmicrosoft.com"],"minLength":0,"maxLength":512,"description":"The primary Azure AD tenant domain (e.g., 'contoso.onmicrosoft.com' or 'contoso.com').","uniqueKey":"data.previous_object.oneOf.7.options.domain","typeLabel":"string"},"domain_aliases":{"type":"array","items":{"type":"string","minLength":0,"maxLength":255,"uniqueKey":"data.previous_object.oneOf.7.options.domain_aliases.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":1000,"description":"Alternative domain names associated with this Azure AD tenant. Allows users from multiple verified domains to authenticate through this connection. Can be an array of domain strings.","uniqueKey":"data.previous_object.oneOf.7.options.domain_aliases","typeLabel":"string[]"},"ext_groups":{"type":"boolean","description":"When enabled (true), retrieves and stores Azure AD security group memberships for the user. Requires Microsoft Graph API permissions (Directory.Read.All). Allows configuring max_groups_to_retrieve.","uniqueKey":"data.previous_object.oneOf.7.options.ext_groups","typeLabel":"boolean"},"ext_nested_groups":{"type":"boolean","description":"When true, stores all groups the user is member of, including transitive group memberships (groups within groups). When false (default), only direct group memberships are included.","uniqueKey":"data.previous_object.oneOf.7.options.ext_nested_groups","typeLabel":"boolean"},"ext_profile":{"type":"boolean","description":"When enabled (true), retrieves extended profile attributes from Azure AD via Microsoft Graph API (job title, department, office location, etc.). Requires Graph API permissions. Only available with Azure AD v1 or when explicitly enabled for v2.","uniqueKey":"data.previous_object.oneOf.7.options.ext_profile","typeLabel":"boolean"},"federated_connections_access_tokens":{"description":"Configuration for storing identity provider tokens in Auth0's Token Vault. When active, Auth0 securely stores access and refresh tokens from federated logins, enabling your application to make authenticated API calls on behalf of users.","type":"object","properties":{"active":{"type":"boolean","description":"Enables refresh tokens and access tokens collection for federated connections","isRequired":true,"uniqueKey":"data.previous_object.oneOf.7.options.federated_connections_access_tokens.active","typeLabel":"boolean"}},"required":["active"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.7.options.federated_connections_access_tokens","typeLabel":"object"},"granted":{"type":"boolean","description":"Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.","uniqueKey":"data.previous_object.oneOf.7.options.granted","typeLabel":"boolean"},"icon_url":{"description":"URL for the connection icon displayed in Auth0 login pages. Accepts HTTPS URLs. Used for visual branding in authentication flows.","type":"string","examples":["https://example.com/logo.png"],"minLength":8,"maxLength":255,"format":"uri","uniqueKey":"data.previous_object.oneOf.7.options.icon_url","typeLabel":"string\u003curi>"},"identity_api":{"description":"The Azure AD endpoint version for authentication. 'microsoft-identity-platform-v2.0' (recommended, default) supports modern OAuth 2.0 features. 'azure-active-directory-v1.0' is the legacy endpoint with protocol limitations. Selection affects available features.","type":"string","enum":["microsoft-identity-platform-v2.0","azure-active-directory-v1.0"],"uniqueKey":"data.previous_object.oneOf.7.options.identity_api","typeLabel":"enum\u003cstring>"},"max_groups_to_retrieve":{"type":"string","examples":["100"],"minLength":0,"maxLength":10,"description":"Maximum number of Azure AD groups to retrieve per user during authentication. Helps prevent performance issues for users in many groups. Only applies when ext_groups is enabled. Leave empty to use platform default.","uniqueKey":"data.previous_object.oneOf.7.options.max_groups_to_retrieve","typeLabel":"string"},"non_persistent_attrs":{"type":"array","items":{"type":"string","examples":["ethnicity"],"minLength":0,"maxLength":255,"description":"A user field name that should not be stored in the Auth0 database.","uniqueKey":"data.previous_object.oneOf.7.options.non_persistent_attrs.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":96,"description":"An array of user fields that should not be stored in the Auth0 database (https://auth0.com/docs/security/data-security/denylist)","uniqueKey":"data.previous_object.oneOf.7.options.non_persistent_attrs","typeLabel":"string[]"},"scope":{"type":"array","items":{"type":"string","minLength":0,"maxLength":100,"uniqueKey":"data.previous_object.oneOf.7.options.scope.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":100,"description":"OAuth 2.0 scopes to request from Azure AD during authentication. Each scope represents a permission (e.g., 'User.Read', 'Group.Read.All'). Only applies with Microsoft Identity Platform v2.0. See Microsoft Graph permissions reference for available scopes.","uniqueKey":"data.previous_object.oneOf.7.options.scope","typeLabel":"string[]"},"set_user_root_attributes":{"description":"Controls how user profile root attributes (name, nickname, picture, etc.) are synchronized from the identity provider. 'on_each_login': updates on every authentication (default); 'on_first_login': sets attributes only during initial login, allowing independent updates afterward; 'never_on_login': never syncs from IdP, preserving locally-set values.","type":"string","enum":["on_each_login","on_first_login","never_on_login"],"uniqueKey":"data.previous_object.oneOf.7.options.set_user_root_attributes","typeLabel":"enum\u003cstring>"},"should_trust_email_verified_connection":{"description":"Choose how Auth0 sets the email_verified field in the user profile.","type":"string","enum":["never_set_emails_as_verified","always_set_emails_as_verified"],"uniqueKey":"data.previous_object.oneOf.7.options.should_trust_email_verified_connection","typeLabel":"enum\u003cstring>"},"tenant_domain":{"oneOf":[{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"hostname","maxLength":512,"minLength":0,"example":"contoso.onmicrosoft.com","uniqueKey":"data.previous_object.oneOf.7.options.tenant_domain.oneOf.0","typeLabel":"string\u003chostname>"},{"type":"string","description":"The Azure AD tenant domain or tenant ID (UUID). Auto-populated from the 'domain' field. Can be either a hostname (e.g., 'contoso.onmicrosoft.com') or a UUID tenant ID.","format":"uuid","uniqueKey":"data.previous_object.oneOf.7.options.tenant_domain.oneOf.1","typeLabel":"string\u003cuuid>"}],"uniqueKey":"data.previous_object.oneOf.7.options.tenant_domain","typeLabel":"string\u003chostname> | string\u003cuuid>"},"tenantId":{"type":"string","examples":["12345678-1234-1234-1234-123456789012"],"minLength":36,"maxLength":36,"format":"uuid","description":"The Azure AD tenant ID as a UUID. The unique identifier for your Azure AD organization. Must be a valid 36-character UUID.","uniqueKey":"data.previous_object.oneOf.7.options.tenantId","typeLabel":"string\u003cuuid>"},"thumbprints":{"type":"array","items":{"type":"string","examples":["AB12CD34EF56789012345678901234567890ABCD"],"minLength":0,"maxLength":64,"description":"Certificate thumbprints for ADFS and Azure AD connections.","uniqueKey":"data.previous_object.oneOf.7.options.thumbprints.items.[INDEX]","typeLabel":"string"},"minItems":0,"maxItems":20,"description":"Array of certificate thumbprints (SHA-128/SHA-256/SHA-512 hex hashes) for validating SAML signatures. Used with WS-Federation protocol. Maximum 20 thumbprints. Each thumbprint must be a hexadecimal string.","uniqueKey":"data.previous_object.oneOf.7.options.thumbprints","typeLabel":"string[]"},"upstream_params":{"description":"Additional parameters to include in authorization requests sent to the identity provider. Useful for passing custom claims, selecting specific identity sources, or configuring provider-specific behavior. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps","type":"object","properties":{},"unevaluatedProperties":{},"uniqueKey":"data.previous_object.oneOf.7.options.upstream_params","typeLabel":"object"},"use_wsfed":{"type":"boolean","description":"Indicates WS-Federation protocol usage. When true, uses WS-Federation; when false, uses OpenID Connect.","uniqueKey":"data.previous_object.oneOf.7.options.use_wsfed","typeLabel":"boolean"},"useCommonEndpoint":{"type":"boolean","description":"When enabled (true), uses the Azure AD common endpoint for multi-tenant authentication. Allows users from any Azure AD organization to sign in. Requires userid_attribute set to 'sub' (not 'oid'). Cannot be used with SCIM provisioning. Defaults to false.","uniqueKey":"data.previous_object.oneOf.7.options.useCommonEndpoint","typeLabel":"boolean"},"userid_attribute":{"description":"The Azure AD claim to use as the unique user identifier. 'oid' (Object ID) is recommended for single-tenant connections and required for SCIM. 'sub' (Subject) is required for multi-tenant/common endpoint. Only applies with OpenID Connect protocol.","type":"string","enum":["oid","sub"],"uniqueKey":"data.previous_object.oneOf.7.options.userid_attribute","typeLabel":"enum\u003cstring>"},"waad_protocol":{"description":"The authentication protocol for Azure AD v1 endpoints. 'openid-connect' (default, recommended) uses modern OAuth 2.0/OIDC. 'ws-federation' is a legacy SAML-based protocol for older integrations. Only available with Azure AD v1 API.","type":"string","enum":["ws-federation","openid-connect"],"uniqueKey":"data.previous_object.oneOf.7.options.waad_protocol","typeLabel":"enum\u003cstring>"}},"required":["client_id"],"unevaluatedProperties":{"not":{}},"uniqueKey":"data.previous_object.oneOf.7.options","typeLabel":"object"},"show_as_button":{"type":"boolean","description":"Enables showing a button for the connection in the login page (new experience only). If false, it will be usable only by HRD. Defaults to `false`.","uniqueKey":"data.previous_object.oneOf.7.show_as_button","typeLabel":"boolean"}},"uniqueKey":"data.previous_object.oneOf.7","typeLabel":"object"}],"uniqueKey":"data.previous_object","typeLabel":"object"},"context":{"description":"Information about the context in which the event was produced. This may include things like\nHTTP request details, client information, connection information, etc.\n\nNote: This field may not be present on all events, depending on the event type and the\ncontext in which it was generated.","type":"object","properties":{"tenant":{"type":"object","properties":{"id":{"type":"string","examples":["my-tenant"],"minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","description":"User-provided tenant identifier.","isRequired":true,"uniqueKey":"data.context.tenant.id","typeLabel":"string"}},"required":["id"],"unevaluatedProperties":{"not":{}},"description":"Reference to a tenant in event context","isRequired":true,"uniqueKey":"data.context.tenant","typeLabel":"object"},"client":{"type":"object","properties":{"id":{"description":"The client identifier.","type":"string","examples":["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"],"isRequired":true,"uniqueKey":"data.context.client.id","typeLabel":"string"},"name":{"type":"string","description":"The client name.","isRequired":true,"uniqueKey":"data.context.client.name","typeLabel":"string"},"metadata":{"description":"Client metadata.","type":"object","properties":{},"unevaluatedProperties":{},"isRequired":true,"uniqueKey":"data.context.client.metadata","typeLabel":"object"}},"required":["id","name","metadata"],"unevaluatedProperties":{"not":{}},"description":"The OAuth Client requesting or presenting an access token.","x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.client","typeLabel":"object"},"connection":{"type":"object","properties":{"id":{"description":"The ID of the connection.","type":"string","examples":["con_kFOHQUeaCSC1Kjqz"],"pattern":"con_[a-zA-Z0-9]{16}","isRequired":true,"uniqueKey":"data.context.connection.id","typeLabel":"string"},"name":{"description":"The name of the connection.","type":"string","examples":["Username-Password-Authentication"],"minLength":1,"maxLength":128,"pattern":"^[a-zA-Z0-9](-[a-zA-Z0-9]|[a-zA-Z0-9])*$","isRequired":true,"uniqueKey":"data.context.connection.name","typeLabel":"string"},"strategy":{"type":"string","description":"The auth strategy implemented by the connection.","isRequired":true,"uniqueKey":"data.context.connection.strategy","typeLabel":"string"}},"required":["id","name","strategy"],"unevaluatedProperties":{"not":{}},"description":"The Auth0 Connection used for the authentication transaction that generated the event.","x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.connection","typeLabel":"object"},"request":{"type":"object","properties":{"geo":{"description":"Geographic information about the request origin.","type":"object","properties":{"continent_code":{"type":"string","description":"Continent code.","uniqueKey":"data.context.request.geo.continent_code","typeLabel":"string"},"country_code":{"type":"string","description":"Country code.","uniqueKey":"data.context.request.geo.country_code","typeLabel":"string"},"country_name":{"type":"string","description":"Country name.","uniqueKey":"data.context.request.geo.country_name","typeLabel":"string"},"latitude":{"type":"number","description":"Latitude coordinate.","uniqueKey":"data.context.request.geo.latitude","typeLabel":"number"},"longitude":{"type":"number","description":"Longitude coordinate.","uniqueKey":"data.context.request.geo.longitude","typeLabel":"number"},"subdivision_code":{"type":"string","description":"Subdivision (state/province) code.","uniqueKey":"data.context.request.geo.subdivision_code","typeLabel":"string"},"subdivision_name":{"type":"string","description":"Subdivision (state/province) name.","uniqueKey":"data.context.request.geo.subdivision_name","typeLabel":"string"},"city_name":{"type":"string","description":"City name.","uniqueKey":"data.context.request.geo.city_name","typeLabel":"string"},"time_zone":{"type":"string","description":"Time zone.","uniqueKey":"data.context.request.geo.time_zone","typeLabel":"string"}},"unevaluatedProperties":{"not":{}},"x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","isRequired":true,"uniqueKey":"data.context.request.geo","typeLabel":"object"},"hostname":{"type":"string","description":"The hostname the request is for.","isRequired":true,"uniqueKey":"data.context.request.hostname","typeLabel":"string"},"ip":{"type":"string","description":"The originating IP address of the request.","isRequired":true,"uniqueKey":"data.context.request.ip","typeLabel":"string"},"method":{"type":"string","description":"The HTTP method used for the request.","isRequired":true,"uniqueKey":"data.context.request.method","typeLabel":"string"},"user_agent":{"type":"string","description":"The value of the `User-Agent` header.","isRequired":true,"uniqueKey":"data.context.request.user_agent","typeLabel":"string"},"custom_domain":{"type":"string","description":"The custom domain used in the request (if any).","uniqueKey":"data.context.request.custom_domain","typeLabel":"string"}},"required":["geo","hostname","ip","method","user_agent"],"unevaluatedProperties":{"not":{}},"description":"An HTTP request.","x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.request","typeLabel":"object"},"transaction":{"type":"object","properties":{"acr_values":{"type":"array","items":{"type":"string","uniqueKey":"data.context.transaction.acr_values.items.[INDEX]","typeLabel":"string"},"description":"acr_values in the request.","isRequired":true,"uniqueKey":"data.context.transaction.acr_values","typeLabel":"string[]"},"locale":{"type":"string","description":"The locale used for this transaction.","isRequired":true,"uniqueKey":"data.context.transaction.locale","typeLabel":"string"},"requested_scopes":{"type":"array","items":{"type":"string","uniqueKey":"data.context.transaction.requested_scopes.items.[INDEX]","typeLabel":"string"},"description":"The scopes requested.","isRequired":true,"uniqueKey":"data.context.transaction.requested_scopes","typeLabel":"string[]"},"ui_locales":{"type":"array","items":{"type":"string","uniqueKey":"data.context.transaction.ui_locales.items.[INDEX]","typeLabel":"string"},"description":"The ui_locales requested for this transaction.","isRequired":true,"uniqueKey":"data.context.transaction.ui_locales","typeLabel":"string[]"},"login_hint":{"type":"string","description":"Hint about the login identifier the user might use in this transaction.","uniqueKey":"data.context.transaction.login_hint","typeLabel":"string"},"prompt":{"type":"array","items":{"type":"string","uniqueKey":"data.context.transaction.prompt.items.[INDEX]","typeLabel":"string"},"description":"Instructions indicating whether the user may be prompted for re-authentication and consent.","uniqueKey":"data.context.transaction.prompt","typeLabel":"string[]"},"protocol":{"description":"The protocol used for this transaction.","type":"string","enum":["oidc-basic-profile","oidc-implicit-profile","oauth2-device-code","oauth2-resource-owner","oauth2-resource-owner-jwt-bearer","oauth2-password","oauth2-webauthn","oauth2-access-token","oauth2-refresh-token","oauth2-token-exchange","oidc-hybrid-profile","samlp","wsfed","wstrust-usernamemixed"],"x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.transaction.protocol","typeLabel":"enum\u003cstring>"},"redirect_uri":{"type":"string","description":"The URL to which the client will be redirected when the transaction completes.","uniqueKey":"data.context.transaction.redirect_uri","typeLabel":"string"},"response_mode":{"description":"This transaction's method for returning parameters from the Authorization Endpoint.","type":"string","enum":["query","fragment","form_post","web_message"],"x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.transaction.response_mode","typeLabel":"enum\u003cstring>"},"response_type":{"type":"array","items":{"type":"string","enum":["code","token","id_token"],"description":"OAuth/OIDC response types.","x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.transaction.response_type.items.[INDEX]","typeLabel":"enum\u003cstring>"},"description":"The kind of credential issued by this transaction.","uniqueKey":"data.context.transaction.response_type","typeLabel":"enum\u003cstring>[]"},"state":{"type":"string","description":"The OAuth state parameter for this transaction.","uniqueKey":"data.context.transaction.state","typeLabel":"string"}},"required":["acr_values","locale","requested_scopes","ui_locales"],"unevaluatedProperties":{"not":{}},"description":"An auth transaction.","x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context.transaction","typeLabel":"object"}},"required":["tenant"],"unevaluatedProperties":{"not":{}},"x-release-lifecycle":"EA","x-auth0-owner":"platform-streaming-foundations","uniqueKey":"data.context","typeLabel":"object"}},"required":["object"],"unevaluatedProperties":{"not":{}},"x-auth0-owner":"platform-streaming-foundations","isRequired":true,"uniqueKey":"data","typeLabel":"object"},"a0tenant":{"description":"The auth0 tenant ID to which the event is associated.","type":"string","examples":["my-tenant"],"minLength":3,"maxLength":63,"pattern":"[a-z0-9][-a-z0-9]{1,62}[a-z0-9]","isRequired":true,"uniqueKey":"a0tenant","typeLabel":"string"},"a0stream":{"description":"The auth0 event stream ID of the stream the event was delivered on.\nPresent when the event is delivered via an event stream; omitted when\nevents are retrieved via the Events API (GET /api/v2/events).","type":"string","examples":["est_vjFVP5pVdfvsfRKatshkVV"],"pattern":"est_[a-zA-Z0-9]{22}","uniqueKey":"a0stream","typeLabel":"string"}},"required":["specversion","type","source","id","time","data","a0tenant"],"unevaluatedProperties":{"not":{}},"description":"Represents an event that occurs when a connection is deleted.","x-release-lifecycle":"EA","x-auth0-owner":"iam-login","x-auth0-event-category":"connection","example":{"title":"Example","value":{"specversion":"1.0","type":"connection.deleted","source":"urn:auth0:example.auth0app.com","id":"evt_vjFVP5pVdfvsfRKatshkVV","time":"2025-02-01T12:34:56Z","data":{"object":{"authentication":{"active":false},"display_name":"My Enterprise Connection","enabled_clients":["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"],"id":"con_kFOHQUeaCSC1Kjqz","is_domain_connection":false,"metadata":{},"name":"Username-Password-Authentication","realms":["example.com"],"connected_accounts":{"active":false,"cross_app_access":false},"options":{"authorization_endpoint":"https://provider.example.com/oauth/authorize","client_id":"abc123def456ghi789","connection_settings":{"pkce":"auto"},"domain_aliases":["example.com"],"dpop_signing_alg":"ES256","federated_connections_access_tokens":{"active":false},"icon_url":"https://example.com/logo.png","id_token_session_expiry_supported":false,"id_token_signed_response_algs":["ES256"],"issuer":"https://accounts.example.com","jwks_uri":"https://provider.example.com/.well-known/jwks.json","non_persistent_attrs":["ethnicity"],"oidc_metadata":{"acr_values_supported":["urn:mace:incommon:iap:silver"],"authorization_endpoint":"https://provider.example.com/oauth/authorize","claim_types_supported":["normal"],"claims_locales_supported":["en-US"],"claims_parameter_supported":false,"claims_supported":["sub"],"code_challenge_methods_supported":["S256"],"display_values_supported":["page"],"dpop_signing_alg_values_supported":["ES256"],"end_session_endpoint":"https://provider.example.com/oauth/logout","grant_types_supported":["authorization_code"],"id_token_encryption_alg_values_supported":["RSA-OAEP"],"id_token_encryption_enc_values_supported":["A128CBC-HS256"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://accounts.example.com","jwks_uri":"https://provider.example.com/.well-known/jwks.json","op_policy_uri":"https://provider.example.com/policy","op_tos_uri":"https://provider.example.com/terms","registration_endpoint":"https://provider.example.com/oauth/register","request_object_encryption_alg_values_supported":["RSA-OAEP"],"request_object_encryption_enc_values_supported":["A128CBC-HS256"],"request_object_signing_alg_values_supported":["RS256"],"request_parameter_supported":false,"request_uri_parameter_supported":false,"require_request_uri_registration":false,"response_modes_supported":["query"],"response_types_supported":["code"],"scopes_supported":["openid"],"service_documentation":"https://provider.example.com/docs","subject_types_supported":["public"],"token_endpoint":"https://provider.example.com/oauth/token","token_endpoint_auth_methods_supported":["client_secret_basic"],"token_endpoint_auth_signing_alg_values_supported":["RS256"],"ui_locales_supported":["en-US"],"userinfo_encryption_alg_values_supported":["RS256"],"userinfo_encryption_enc_values_supported":["A128CBC-HS256"],"userinfo_endpoint":"https://provider.example.com/oauth/userinfo","userinfo_signing_alg_values_supported":["RS256"]},"schema_version":"openid-1.0.0","scope":"openid profile email","send_back_channel_nonce":false,"set_user_root_attributes":"on_each_login","tenant_domain":"example.com","token_endpoint":"https://provider.example.com/oauth/token","token_endpoint_auth_method":"client_secret_post","token_endpoint_auth_signing_alg":"ES256","token_endpoint_jwtca_aud_format":"issuer","upstream_params":{},"useOauthSpecScope":false,"userinfo_endpoint":"https://provider.example.com/oauth/userinfo","attribute_map":{"attributes":{},"userinfo_scope":"openid profile email","mapping_mode":"bind_all"},"discovery_url":"https://provider.example.com/.well-known/openid-configuration","type":"back_channel"},"show_as_button":false,"strategy":"oidc"},"previous_object":{"authentication":{"active":false},"display_name":"My Enterprise Connection","enabled_clients":["QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc"],"id":"con_kFOHQUeaCSC1Kjqz","is_domain_connection":false,"metadata":{},"name":"Username-Password-Authentication","realms":["example.com"],"connected_accounts":{"active":false,"cross_app_access":false},"options":{"authorization_endpoint":"https://provider.example.com/oauth/authorize","client_id":"abc123def456ghi789","connection_settings":{"pkce":"auto"},"domain_aliases":["example.com"],"dpop_signing_alg":"ES256","federated_connections_access_tokens":{"active":false},"icon_url":"https://example.com/logo.png","id_token_session_expiry_supported":false,"id_token_signed_response_algs":["ES256"],"issuer":"https://accounts.example.com","jwks_uri":"https://provider.example.com/.well-known/jwks.json","non_persistent_attrs":["ethnicity"],"oidc_metadata":{"acr_values_supported":["urn:mace:incommon:iap:silver"],"authorization_endpoint":"https://provider.example.com/oauth/authorize","claim_types_supported":["normal"],"claims_locales_supported":["en-US"],"claims_parameter_supported":false,"claims_supported":["sub"],"code_challenge_methods_supported":["S256"],"display_values_supported":["page"],"dpop_signing_alg_values_supported":["ES256"],"end_session_endpoint":"https://provider.example.com/oauth/logout","grant_types_supported":["authorization_code"],"id_token_encryption_alg_values_supported":["RSA-OAEP"],"id_token_encryption_enc_values_supported":["A128CBC-HS256"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://accounts.example.com","jwks_uri":"https://provider.example.com/.well-known/jwks.json","op_policy_uri":"https://provider.example.com/policy","op_tos_uri":"https://provider.example.com/terms","registration_endpoint":"https://provider.example.com/oauth/register","request_object_encryption_alg_values_supported":["RSA-OAEP"],"request_object_encryption_enc_values_supported":["A128CBC-HS256"],"request_object_signing_alg_values_supported":["RS256"],"request_parameter_supported":false,"request_uri_parameter_supported":false,"require_request_uri_registration":false,"response_modes_supported":["query"],"response_types_supported":["code"],"scopes_supported":["openid"],"service_documentation":"https://provider.example.com/docs","subject_types_supported":["public"],"token_endpoint":"https://provider.example.com/oauth/token","token_endpoint_auth_methods_supported":["client_secret_basic"],"token_endpoint_auth_signing_alg_values_supported":["RS256"],"ui_locales_supported":["en-US"],"userinfo_encryption_alg_values_supported":["RS256"],"userinfo_encryption_enc_values_supported":["A128CBC-HS256"],"userinfo_endpoint":"https://provider.example.com/oauth/userinfo","userinfo_signing_alg_values_supported":["RS256"]},"schema_version":"openid-1.0.0","scope":"openid profile email","send_back_channel_nonce":false,"set_user_root_attributes":"on_each_login","tenant_domain":"example.com","token_endpoint":"https://provider.example.com/oauth/token","token_endpoint_auth_method":"client_secret_post","token_endpoint_auth_signing_alg":"ES256","token_endpoint_jwtca_aud_format":"issuer","upstream_params":{},"useOauthSpecScope":false,"userinfo_endpoint":"https://provider.example.com/oauth/userinfo","attribute_map":{"attributes":{},"userinfo_scope":"openid profile email","mapping_mode":"bind_all"},"discovery_url":"https://provider.example.com/.well-known/openid-configuration","type":"back_channel"},"show_as_button":false,"strategy":"oidc"},"context":{"client":{"id":"QG4F6eABIgDzPvcKCMKUjo8c9iet2Skc","name":"sample","metadata":{}},"connection":{"id":"con_kFOHQUeaCSC1Kjqz","name":"Username-Password-Authentication","strategy":"sample"},"request":{"geo":{"continent_code":"sample","country_code":"sample","country_name":"sample","latitude":3.14,"longitude":3.14,"subdivision_code":"sample","subdivision_name":"sample","city_name":"sample","time_zone":"sample"},"hostname":"sample","custom_domain":"sample","ip":"sample","method":"sample","user_agent":"sample"},"tenant":{"id":"my-tenant"},"transaction":{"acr_values":["sample"],"locale":"sample","login_hint":"sample","prompt":["sample"],"protocol":"oidc-basic-profile","redirect_uri":"sample","requested_scopes":["sample"],"response_mode":"query","response_type":["code"],"state":"sample","ui_locales":["sample"]}}},"a0tenant":"my-tenant","a0stream":"est_vjFVP5pVdfvsfRKatshkVV"}},"uniqueKey":"","typeLabel":"object"},"originalFileLocation":"docs/oas/events/events-schema.json"},"subdomain":"auth0","siteName":"Auth0 Docs","title":"connection.deleted - Auth0 Docs","relatedPagesConfig":{"enabled":true,"limit":5,"mode":"manual"},"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{"en":{"href":"/docs/events/connection/connection.deleted","matchLevel":0},"fr-ca":{"href":"/docs/fr-ca/events/connection/connection.deleted","matchLevel":1},"ja-jp":{"href":"/docs/ja-jp/events/connection/connection.deleted","matchLevel":1}}},"lastModified":"2026-11-12T20:36:49.238Z","originalFileLocation":"docs/events/connection/connection.deleted.mdx","locale":"en"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"application-name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/svg+xml\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"icon\" type=\"image/svg+xml\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"icon\" type=\"image/svg+xml\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/favicon.svg\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/svg+xml\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/favicon.svg\">\u003cmeta data-mint-head property=\"og:title\" content=\"connection.deleted - Auth0 Docs\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Auth0 Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://auth0.com/docs/events/connection/connection.deleted\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://auth0.mintlify.site/docs/images/share-image.png\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"connection.deleted - Auth0 Docs\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://auth0.mintlify.site/docs/images/share-image.png\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Auth0 Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#9921FE\">\u003clink data-mint-head rel=\"canonical\" href=\"https://auth0.com/docs/events/connection/connection.deleted\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/events/connection/connection.deleted.md\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"en\" href=\"https://auth0.com/docs/events/connection/connection.deleted\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"fr-CA\" href=\"https://auth0.com/docs/fr-ca/events/connection/connection.deleted\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"ja-JP\" href=\"https://auth0.com/docs/ja-jp/events/connection/connection.deleted\">\u003clink data-mint-head rel=\"alternate\" hreflang=\"x-default\" href=\"https://auth0.com/docs/events/connection/connection.deleted\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://auth0.com/#organization\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://auth0.com#website\",\"name\":\"Auth0 Docs\",\"url\":\"https://auth0.com\",\"publisher\":{\"@id\":\"https://auth0.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://auth0.com/docs/events/connection/connection.deleted#webpage\",\"url\":\"https://auth0.com/docs/events/connection/connection.deleted\",\"name\":\"connection.deleted\",\"dateModified\":\"2026-11-12T20:36:49.238Z\",\"isPartOf\":{\"@id\":\"https://auth0.com#website\"},\"breadcrumb\":{\"@id\":\"https://auth0.com/docs/events/connection/connection.deleted#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://auth0.com/docs/events/connection/connection.deleted#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Reference\",\"item\":\"https://auth0.com/docs/events/connection/connection.created\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Events Catalog\",\"item\":\"https://auth0.com/docs/events\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Connection\",\"item\":\"https://auth0.com/docs/events/connection/connection.created\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"connection.deleted\",\"item\":\"https://auth0.com/docs/events/connection/connection.deleted\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://auth0.com/docs/events/connection/connection.deleted#apireference\",\"headline\":\"connection.deleted\",\"name\":\"connection.deleted\",\"url\":\"https://auth0.com/docs/events/connection/connection.deleted\",\"mainEntityOfPage\":{\"@id\":\"https://auth0.com/docs/events/connection/connection.deleted#webpage\"},\"image\":\"https://auth0.com/docs/images/share-image.png\",\"dateModified\":\"2026-11-12T20:36:49.238Z\",\"publisher\":{\"@id\":\"https://auth0.com/#organization\"},\"isPartOf\":{\"@id\":\"https://auth0.com#website\"}}]}\u003c/script>","agentPointerHref":"/docs/events/connection/connection.deleted.md","siteName":"Auth0 Docs","nav":{"global":null,"languages":[{"language":"en","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"Developers","items":[{"label":"Developer Hub","href":"https://developer.auth0.com"},{"label":"Code Samples \u0026 Guides","href":"https://developer.auth0.com/resources"},{"label":"Zero Index Newsletter","href":"https://auth0.com/blog/newsletter"},{"label":"Blog","href":"https://auth0.com/blog"},{"label":"Changelog","href":"https://auth0.com/changelog"}]},{"header":"Docs","items":[{"label":"Documentation","href":"https://auth0.com/docs"},{"label":"Quickstarts","href":"https://auth0.com/docs/quickstarts"},{"label":"APIs","href":"https://auth0.com/docs/api"},{"label":"SDK Libraries","href":"https://auth0.com/docs/libraries"},{"label":"Learn","href":"https://auth0.com/learn"},{"label":"Intro to IAM (CIAM)","href":"https://auth0.com/intro-to-iam"},{"label":"Reports","href":"https://auth0.com/resources/whitepapers"},{"label":"Webinars","href":"https://auth0.com/resources/webinars"}]},{"header":"Support Center","items":[{"label":"Community","href":"https://community.auth0.com"},{"label":"Help","href":"https://support.auth0.com"},{"label":"FAQs","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"Company","items":[{"label":"Our Customers","href":"https://auth0.com/customers"},{"label":"Compliance","href":"https://auth0.com/security"},{"label":"Partners","href":"https://auth0.com/partners"},{"label":"Careers","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"About us","href":"https://auth0.com/about"}]}]},"tabs":[{"tab":"Get Started","icon":"play","directory":"accordion","pages":[{"title":"Get Started","href":"/docs/get-started"}]},{"tab":"Authenticate","icon":"lock-keyhole","pages":[{"title":"Authenticate","href":"/docs/authenticate"}]},{"tab":"Manage Users","icon":"user-group","directory":"accordion","pages":[{"title":"Manage Users","href":"/docs/manage-users"}]},{"tab":"Brand","icon":"swatchbook","directory":"accordion","pages":[{"title":"Brand","href":"/docs/customize"}]},{"tab":"Extend","icon":"arrow-up-small-big","directory":"accordion","anchors":[{"anchor":"Overview","pages":[{"title":"Overview","href":"/docs/extend"}]},{"anchor":"Actions","icon":"bolt","pages":[{"title":"Actions","href":"/docs/customize/actions"}]},{"anchor":"Events","icon":"compass","pages":[{"title":"Events Overview","sidebarTitle":"Overview","href":"/docs/customize/events"},{"group":"Concepts","expanded":true,"pages":[{"title":"Events Best Practices","sidebarTitle":"Best Practices","href":"/docs/customize/events/events-best-practices"}]},{"group":"How To","expanded":true,"pages":[{"title":"How to Create an Event Stream","sidebarTitle":"Create an Event Stream","href":"/docs/customize/events/create-an-event-stream"},{"title":"How to Test, Monitor, and Retry Event Streams","sidebarTitle":"Test, Monitor, and Retry Event Streams","href":"/docs/customize/events/event-testing-observability-and-failure-recovery"},{"title":"How to Consume Events with the Events API","sidebarTitle":"Consume Events with the Events API","href":"/docs/customize/events/consume-events-with-events-api"}]},{"group":"Reference","expanded":true,"pages":[{"group":"Events Catalog","root":{"title":"Events Catalog Overview","sidebarTitle":"Overview","href":"/docs/events"},"expanded":true,"pages":[{"group":"Connection","pages":[{"title":"connection.created","description":null,"href":"/docs/events/connection/connection.created"},{"title":"connection.deleted","href":"/docs/events/connection/connection.deleted"},{"title":"connection.updated","description":null,"href":"/docs/events/connection/connection.updated"}]},{"group":"Group","pages":[{"title":"group.created","href":"/docs/events/group/group.created"},{"title":"group.deleted","href":"/docs/events/group/group.deleted"},{"title":"group.member.added","href":"/docs/events/group/group.member.added"},{"title":"group.member.deleted","href":"/docs/events/group/group.member.deleted"},{"title":"group.role.assigned","href":"/docs/events/group/group.role.assigned"},{"title":"group.role.deleted","href":"/docs/events/group/group.role.deleted"},{"title":"group.updated","href":"/docs/events/group/group.updated"}]},{"group":"Organization","pages":[{"title":"organization.connection.added","href":"/docs/events/organization/organization.connection.added"},{"title":"organization.connection.removed","href":"/docs/events/organization/organization.connection.removed"},{"title":"organization.connection.updated","href":"/docs/events/organization/organization.connection.updated"},{"title":"organization.created","href":"/docs/events/organization/organization.created"},{"title":"organization.deleted","href":"/docs/events/organization/organization.deleted"},{"title":"organization.group.role.assigned","href":"/docs/events/organization/organization.group.role.assigned"},{"title":"organization.group.role.deleted","href":"/docs/events/organization/organization.group.role.deleted"},{"title":"organization.member.added","href":"/docs/events/organization/organization.member.added"},{"title":"organization.member.deleted","href":"/docs/events/organization/organization.member.deleted"},{"title":"organization.member.role.assigned","href":"/docs/events/organization/organization.member.role.assigned"},{"title":"organization.member.role.deleted","href":"/docs/events/organization/organization.member.role.deleted"},{"title":"organization.updated","href":"/docs/events/organization/organization.updated"}]},{"group":"User","pages":[{"title":"user.created","href":"/docs/events/user/user.created"},{"title":"user.deleted","href":"/docs/events/user/user.deleted"},{"title":"user.updated","href":"/docs/events/user/user.updated"}]}]}]},{"group":"Use Cases","expanded":true,"pages":[{"title":"Synchronize Data Across Systems with Event Streams","sidebarTitle":"Synchronize Data Across Systems","href":"/docs/customize/events/sync-data-across-systems"},{"title":"Correlate Identity Changes with External Systems with Event Streams","sidebarTitle":"Correlate Identity Changes with External Systems","href":"/docs/customize/events/correlate-identity-changes"},{"title":"Orchestrate Business Workflows with Event Streams and Auth0 Actions","sidebarTitle":"Orchestrate Business Workflows","href":"/docs/customize/events/orchestrate-business-workflows"},{"title":"How to Synchronize User Changes with Outbound SCIM Requests using Event Streams","sidebarTitle":"Send Outbound SCIM Requests","href":"/docs/customize/events/send-outbound-scim"}]}]},{"anchor":"Extensions","icon":"microchip","pages":[{"title":"Extensions","href":"/docs/customize/extensions"}]},{"anchor":"Forms","icon":"diagram-successor","pages":[{"title":"Forms","href":"/docs/customize/forms"}]},{"anchor":"Integrations","icon":"layer-plus","pages":[{"title":"Integrations","href":"/docs/customize/integrations"}]},{"anchor":"Rules \u0026 Hooks","icon":"toggle-off","pages":[{"title":"Rules \u0026 Hooks","href":"/docs/customize/rules"}]}]},{"tab":"Secure","icon":"shield-check","pages":[{"title":"Secure","href":"/docs/secure"}]},{"tab":"Monitor","icon":"chart-simple","directory":"accordion","pages":[{"title":"Monitor","href":"/docs/deploy-monitor"}]},{"tab":"AI Agents \u0026 MCP","icon":"robot","directory":"accordion","pages":[{"title":"AI Agents \u0026 MCP","href":"/docs/ai-agents-mcp"}]},{"tab":"Platform","icon":"credit-card","pages":[{"title":"Platform","href":"/docs/troubleshoot"}]},{"tab":"Dev Tools","icon":"code-simple","menu":[{"item":"APIs","icon":"code-pull-request","pages":[{"title":"APIs","href":"/docs/api"}]},{"item":"CLIs","icon":"terminal","pages":[{"title":"CLIs","href":"/docs/deploy-monitor/auth0-cli"}]},{"item":"SDKs","icon":"cube","dropdowns":[{"dropdown":"SDK Libraries","icon":"book","description":"","pages":[{"title":"SDK Libraries","href":"/docs/libraries"}]},{"dropdown":"auth0-spa-js","icon":"book-open","description":"version: v2.30.0","pages":[{"title":"auth0-spa-js","href":"/docs/sdk/auth0-spa-js/functions/createAuth0Client"}]},{"dropdown":"auth0-react","icon":"book-open","description":"version: v2.30.0","pages":[{"title":"auth0-react","href":"/docs/sdk/auth0-react/functions/Auth0Provider"}]},{"dropdown":"auth0-acul-js","icon":"book-open","description":"","pages":[{"title":"auth0-acul-js","href":"/docs/libraries/acul/js-sdk"}]},{"dropdown":"auth0-acul-react","icon":"book-open","description":"","pages":[{"title":"auth0-acul-react","href":"/docs/libraries/acul/react-sdk"}]},{"dropdown":"auth0-android","icon":"book-open","description":"","pages":[{"title":"auth0-android","href":"/docs/libraries/auth0-android/auth0-android-configuration"}]},{"dropdown":"auth0-php","icon":"book-open","description":"","pages":[{"title":"auth0-php","href":"/docs/libraries/auth0-php"}]}]},{"item":"Universal Components","icon":"objects-column","pages":[{"title":"Universal Components","href":"/docs/get-started/universal-components/universal-components-overview"}]}],"pages":[{"title":"Dev Tools","href":"/docs/api"}]},{"tab":"auth0-spa-js","hidden":true,"pages":[{"title":"auth0-spa-js","href":"/docs/sdk/auth0-spa-js/package-overview"}]},{"tab":"auth0-react","hidden":true,"pages":[{"title":"auth0-react","href":"/docs/sdk/auth0-react/package-overview"}]}]},{"language":"fr-ca","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"Développeurs","items":[{"label":"Espace développeurs","href":"https://developer.auth0.com"},{"label":"Exemples de code et guides","href":"https://developer.auth0.com/resources"},{"label":"Infolettre Zero Index","href":"https://auth0.com/blog/newsletter"},{"label":"Blogue","href":"https://auth0.com/blog"},{"label":"Journal des modifications","href":"https://auth0.com/changelog"}]},{"header":"Documentation","items":[{"label":"Documentation","href":"https://auth0.com/docs"},{"label":"Guides de démarrage rapide","href":"https://auth0.com/docs/quickstarts"},{"label":"API","href":"https://auth0.com/docs/api"},{"label":"Bibliothèques SDK","href":"https://auth0.com/docs/libraries"},{"label":"Apprendre","href":"https://auth0.com/learn"},{"label":"Introduction à l’IAM (CIAM)","href":"https://auth0.com/intro-to-iam"},{"label":"Rapports","href":"https://auth0.com/resources/whitepapers"},{"label":"Webinaires","href":"https://auth0.com/resources/webinars"}]},{"header":"Centre d’assistance","items":[{"label":"Communauté","href":"https://community.auth0.com"},{"label":"Aide","href":"https://support.auth0.com"},{"label":"Foire aux questions","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"Entreprise","items":[{"label":"Nos clients","href":"https://auth0.com/customers"},{"label":"Conformité","href":"https://auth0.com/security"},{"label":"Partenaires","href":"https://auth0.com/partners"},{"label":"Carrières","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"À propos de nous","href":"https://auth0.com/about"}]}]},"pages":[{"title":"fr-ca","href":"/docs/fr-ca/events/connection/connection.deleted"}]},{"language":"ja-jp","footer":{"socials":{"x-twitter":"https://x.com/auth0","github":"https://github.com/auth0","linkedin":"https://www.linkedin.com/company/auth0"},"links":[{"header":"開発者向け","items":[{"label":"開発者ハブ","href":"https://developer.auth0.com"},{"label":"コードサンプルとガイド","href":"https://developer.auth0.com/resources"},{"label":"Zero Index Newsletter","href":"https://auth0.com/blog/newsletter"},{"label":"ブログ","href":"https://auth0.com/blog"},{"label":"変更履歴","href":"https://auth0.com/changelog"}]},{"header":"ドキュメント","items":[{"label":"ドキュメント","href":"https://auth0.com/docs"},{"label":"クイックスタート","href":"https://auth0.com/docs/quickstarts"},{"label":"API","href":"https://auth0.com/docs/api"},{"label":"SDKライブラリ","href":"https://auth0.com/docs/libraries"},{"label":"教育","href":"https://auth0.com/learn"},{"label":"IAM(CIAM)入門","href":"https://auth0.com/intro-to-iam"},{"label":"レポート","href":"https://auth0.com/resources/whitepapers"},{"label":"ウェビナー","href":"https://auth0.com/resources/webinars"}]},{"header":"サポートセンター","items":[{"label":"コミュニティ","href":"https://community.auth0.com"},{"label":"ヘルプ","href":"https://support.auth0.com"},{"label":"よくある質問","href":"https://auth0.com/docs/troubleshoot"},{"label":"Auth0","href":"https://auth0.com"}]},{"header":"会社情報","items":[{"label":"導入企業","href":"https://auth0.com/customers"},{"label":"コンプライアンス","href":"https://auth0.com/security"},{"label":"パートナー","href":"https://auth0.com/partners"},{"label":"採用情報","href":"https://www.okta.com/company/careers"},{"label":"Okta + Auth0","href":"https://www.okta.com/okta-and-auth0"},{"label":"私たちについて","href":"https://auth0.com/about"}]}]},"pages":[{"title":"ja-jp","href":"/docs/ja-jp/events/connection/connection.deleted"}]}]},"basePath":"","title":"connection.deleted - Auth0 Docs","buildId":"dpl_8hoxaqFTU7hTr6A2fUraxAyjuiZo","deploymentId":"dpl_8hoxaqFTU7hTr6A2fUraxAyjuiZo","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CDiBsYGW.js","utils-KF9rPlmF.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-C26urKTX.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-BdjmJAC1.js","snippetPresets-3IpDBjt3.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","conditional-requirements-CFM0id0Q.js","ApiExamples-D4x_2vvo.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-BIWdc5Pa.js","shallow-LQqfiMNd.js","getApiPlaygroundDisplay-DryzlOZG.js","CodeSnippet-tcJujU4r.js","CodeSnippets-BHp0nVLL.js","Page-1CZdsdAn.js","getPastedJson-DU-1ayUv.js","icon-CZK2hPr4.js","MethodPill-DOaqmTFC.js","DuplicateIcon-B5-nUxxl.js","createIcon-CDP_U77G.js","DynamicMarkdown-GHvayGOn.js","SectionHeading-BYvpkmUD.js","axios-vUo_bRtp.js","Markdown-uxhlayGT.js","clsx-B35qUV0p.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BvrGG8gU.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-CAf0yVYe.js"]}