# Canopy > Canopy is a hierarchical identity and access-control platform — authentication, organizational hierarchy management, and hierarchical RBAC as a service for B2B applications. This file indexes the documentation and the machine-readable API surfaces for AI agents and other automated readers. The REST API's base origin is https://auth.canopy-io.com. The OpenAPI documents listed below enumerate every path, parameter, and response schema; an interactive Swagger UI for the same documents is served at https://auth.canopy-io.com/docs. Every documented API operation also has a human-readable page at https://canopy-io.com/docs/api-reference/{operationId}, where {operationId} is the operation's id from the OpenAPI document (for example ApiPermissionsController_evaluate). Do not guess these URLs from resource names — take the ids from the specs or the sitemap. Official SDKs: Node.js and TypeScript (`npm install @canopy-io/node`), NestJS (`npm install @canopy-io/nestjs`) — details at https://canopy-io.com/docs/sdks-and-libraries. Every capability also works over plain HTTP via the OpenAPI documents below; do not guess package names beyond these. Start here: https://canopy-io.com/docs/ai-quickstart — the setup walkthrough written for AI agents, from an empty Environment to a passing permission check. Canopy has two signed-in applications and the documentation is written for both. The Developer Console is where an integration is built: permissions, roles, hierarchy, keys, OAuth clients, webhooks. Most pages below serve it. The Admin Workspace is where a customer's own staff administer people, and its pages are the Administration set — start at https://canopy-io.com/docs/console-and-workspace for which application a task belongs to, or https://canopy-io.com/docs/what-administrators-can-do for what an administrator can be granted. ## Authentication by surface - Public API (https://auth.canopy-io.com/api/v1/*): send an API key in the X-API-Key header. Keys are created in the Developer Console or via the API, are Environment-scoped, and are prefixed cnpy_. A JWT bearer token also works. - Identity authentication (https://auth.canopy-io.com/v1/identity/auth/*): your application's end users sign in here. Whenever the identity has an enrolled MFA factor, login (and switch-organization) can answer requires_mfa_challenge: true with an mfa_challenge to complete instead of tokens, whether or not the Environment requires MFA; handle that shape on every Environment. Every public credential call carries your Environment's publishable key as a publishable_key field in the JSON request body (not a header); this surface issues the identity JWTs. To verify a publishable key, GET https://auth.canopy-io.com/v1/identity/auth/config?publishable_key=pk_... returns the Environment's sign-in configuration for a valid key and a distinct 400 for an unknown one — login deliberately answers a generic 401 either way. - OAuth 2.0 / OIDC (https://auth.canopy-io.com/oauth/*): authorization code with PKCE for Hosted Login. Discovery document at https://auth.canopy-io.com/.well-known/openid-configuration. - SCIM 2.0 (https://auth.canopy-io.com/scim/v2/environments/{environmentId}/*): per-Environment bearer token, prefixed scim_. - Portal API (https://auth.canopy-io.com/portal/v1/*): the surface behind Canopy's signed-in applications, authenticated with a Console user's JWT. Integrations should prefer the public API. ## Keeping a browser session alive Login works from any origin — the access token travels in the response body. Staying signed in does not: the refresh token rides in an httpOnly cookie, and if that cookie is third-party to your app, Safari drops it today and Chrome is deprecating it. The access token then expires after 15 minutes and the user is signed out. Nothing fails at build time; curl and same-origin dev servers work perfectly, so this only appears in real browsers on your production domain. Pick one of these deliberately: - Custom auth domain (recommended for browser apps on their own domain): point a subdomain you control, such as auth.yourapp.com, at Canopy and call it instead of https://auth.canopy-io.com. The refresh cookie is then first-party on your own site and silent refresh works everywhere, with no backend auth code. Configure it in the Developer Console under Environment → Integrations → Custom Auth Domain: add the subdomain, publish the CNAME and TXT records it shows, verify, and a certificate is issued automatically. Send the publishable key belonging to the Environment that domain serves — a key naming a different Environment is refused with auth.domain_host_key_mismatch. Setup: https://canopy-io.com/docs/authentication/direct-api#custom-domain - Backend proxy (BFF): when you cannot delegate a subdomain, or you already route API traffic through your own backend. Your backend calls the identity-auth API server-to-server with a secret API key in X-API-Key and receives the refresh token in the JSON body instead of a cookie, so it holds the session itself. Also the answer for native mobile, which has no useful cookie jar. Guide: https://canopy-io.com/docs/authentication/bff-proxy - Same-site: your app and the API origin are already the same site. Nothing to do; the refresh cookie is first-party as-is. ## Authorizing without a call per request A permission check does not need a network call per request. Fetch two things, cache them, and answer locally: - https://auth.canopy-io.com/api/v1/identities/{id}/grants returns each permission the identity holds mapped to the nodes it was granted at. The nodes are NOT expanded through their descendants: a grant already means "this node and everything beneath it". - https://auth.canopy-io.com/api/v1/nodes returns the hierarchy. Cache it once per process and share it across identities — its shape does not depend on who is asking. Revalidate with If-None-Match carrying the ETag from the response; a 304 means your copy is still current. To answer a check, climb from the node in question through its parents and return true if any ancestor appears in that permission's grant roots. An Application-wide check is simpler still: the permission appearing at all is the answer. Cache the grants for at most 60 seconds. That window is the delay between an access change and it taking effect, and it covers moved nodes as well as changed assignments — moving a node changes what an inherited grant reaches even though no grant changed. Do not shorten the window below the gap between a user's requests: every request would find it expired and refetch, which is the per-request call this avoids. Full explanation: https://canopy-io.com/docs/authorization-caching ## Multi-tenant applications: organizations For a multi-tenant application, each business customer is an organization: a tenant switched on per Environment as a container beside the access model (flat or hierarchy keep running inside it). A member holds exactly one role per organization, so one identity can be an Admin at one customer and a Viewer at another. - Enable the container once per Environment (PUT .../environments/{env}/organizations-feature with { enabled: true }, Console token), then POST https://auth.canopy-io.com/api/v1/organizations to create a tenant and POST .../organizations/{id}/members to add people with a role. Organizations are a Pro plan feature; the runtime below is never plan-gated. - Identity access tokens carry org_id and org_role for the organization the session is acting in. Take the tenant from the verified token, never from the request. A login may name its starting organization in an organization field; otherwise the session starts in the identity's most recently joined organization. - GET https://auth.canopy-io.com/v1/identity/auth/organizations lists the caller's memberships; POST https://auth.canopy-io.com/v1/identity/auth/switch-organization moves the session and mints new claims. The switch can answer requires_mfa_challenge when the target organization requires MFA the session has not presented. - Per-organization policy (GET/PATCH .../organizations/{id}/policy) tightens the Environment's MFA settings and can require SSO; it never loosens them. An organization also binds its own identity provider (.../organizations/{id}/sso-connections): sign-ins through that connection land in the organization. - Authorization inside a tenant is the node question at the organization: evaluate with scope node and node_id set to the token's org_id, or use the NestJS guard's scope: "org". - Provisioning at signup, in order: register the identity; create the organization with your own account id as external_id (unique per Environment, a repeat answers 409, GET /api/v1/organizations?external_id=... finds it); add the person as the first member with your owner role; then POST /v1/identity/auth/switch-organization with the refresh token so the session acts in the new organization. Skipping the switch ships a session with no org claims. - After a member is removed: their access token keeps its claims until it expires, org-scoped evaluation refuses them immediately, the next refresh mints no org claims, and a switch into that organization answers 403 organization.not_a_member. - Membership webhooks pair with assignment webhooks (organization.member.added with assignment.created, role_changed with assignment.updated, removed with assignment.removed); a membership created by a just-in-time SSO sign-in fires organization.member.added only, with data.metadata.source set to sso_jit and the connection_id; an invitation into an organization accepted by the invitee fires organization.member.added beside assignment.created, with source set to invite and the invite_id. - In @canopy-io/nestjs, resolveOrg is the CanopyModule option that tells the org-scoped guard where to read the acting organization when the verified claims are not on the request (a BFF or API-key surface); feed it only a value read off a verified token. In @canopy-io/node, orgContext(claims) reads the org pair safely, and the amr claim (pwd, otp, sso, plus mfa once verified) lets a backend insist on mfa before a sensitive action. - A role assigned at the Environment root is held in every organization (evaluation walks the lineage and organizations sit under the root). Use root roles for your own staff only; a customer's environment-wide role from before the container was on is a cross-tenant grant until that person is moved into memberships, so create the memberships, then remove the root assignment. Full guide: https://canopy-io.com/docs/organizations ## Response envelope Every Canopy-shaped endpoint (the OAuth and SCIM surfaces follow their own RFCs instead) returns one of five envelope shapes: - Single item: `{ "data": { ... } }` - Collection: `{ "items": [ ... ] }`, plus `"pagination"` when the endpoint pages. Offset pagination carries `page`, `take`, `item_count`, `page_count`, `has_previous_page`, `has_next_page`; cursor pagination carries `next_cursor` (opaque, null at end of feed). - Partial success (bulk operations): `{ "summary": { ... }, "results": [ ... ] }` - Error: `{ "error": { "statusCode", "code", "message", "timestamp", "path", "method" } }` — the same shape for every status. `code` is a machine-readable dot-notation string like `auth.invalid_credentials`. - No content: HTTP 204 with an empty body. ## Endpoints — Canopy Public API OpenAPI document: https://canopy-io.com/openapi/api.json ### api-permissions - GET /api/v1/permissions — List permission catalog. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_listPermissions - POST /api/v1/permissions — Register new permission(s). Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_createPermissions - GET /api/v1/permissions/{id} — Get a permission. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_getPermission - PATCH /api/v1/permissions/{id} — Update permission metadata. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_updatePermission - DELETE /api/v1/permissions/{id} — Remove a permission. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_deletePermission - GET /api/v1/permissions/{id}/usage — Get where a permission is used. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_getPermissionUsage - POST /api/v1/permissions/evaluate — Evaluate authorization. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_evaluate - POST /api/v1/permissions/evaluate/bulk — Bulk evaluate authorization. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_evaluateBulk - POST /api/v1/permissions/evaluate/explain — Explain a node-scoped authorization decision. Docs: https://canopy-io.com/docs/api-reference/ApiPermissionsController_explain ### api-identities - GET /api/v1/identities — List identities in Application. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_listIdentities - POST /api/v1/identities — Create an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_createIdentity - GET /api/v1/identities/with-roles — List identities with their role assignments. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_listIdentitiesWithRoles - GET /api/v1/identities/summary — Get Application identities summary. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentitiesSummary - POST /api/v1/identities/bulk-create — Bulk-create identities. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_bulkCreateIdentities - GET /api/v1/identities/{id} — Get an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentity - PATCH /api/v1/identities/{id} — Update an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_updateIdentity - DELETE /api/v1/identities/{id} — Remove an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_removeIdentity - GET /api/v1/identities/{id}/detail — Get identity detail with role assignments. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityDetail - POST /api/v1/identities/{id}/activate — Activate an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_activateIdentity - POST /api/v1/identities/{id}/deactivate — Deactivate an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_deactivateIdentity - POST /api/v1/identities/{id}/password — Set an identity's password (admin). Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_setIdentityPassword - POST /api/v1/identities/{id}/password/reset — Force a password reset for an identity (admin). Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_forceResetIdentityPassword - POST /api/v1/identities/{id}/sessions/revoke — Revoke all of an identity's sessions (admin). Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_revokeIdentitySessions - GET /api/v1/identities/{id}/mfa — Get MFA enrollment summary for an identity. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityMfa - POST /api/v1/identities/{id}/mfa/reset — Force-reset an identity's MFA — admin recovery action. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_resetIdentityMfa - GET /api/v1/identities/{id}/auth-state — Read an identity's auth state for backend decisioning. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityAuthState - POST /api/v1/identities/{id}/verify-email — Mark an identity's email verified (admin). Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_markIdentityEmailVerified - GET /api/v1/identities/{id}/assignments — Get identity's role assignments. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityAssignments - GET /api/v1/identities/{id}/permissions — Get identity's effective permissions. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityPermissions - GET /api/v1/identities/{id}/grants — Get where an identity holds each permission. Docs: https://canopy-io.com/docs/api-reference/ApiIdentitiesController_getIdentityGrants ### api-identity-invites - GET /api/v1/identity-invites — List invites. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_listInvites - POST /api/v1/identity-invites — Create an invite. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_createInvite - GET /api/v1/identity-invites/summary — Get invite summary. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_getInvitesSummary - POST /api/v1/identity-invites/bulk-create — Bulk-create invites. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_bulkCreateInvites - POST /api/v1/identity-invites/{id}/resend — Resend an invite. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_resendInvite - DELETE /api/v1/identity-invites/{id} — Revoke an invite. Docs: https://canopy-io.com/docs/api-reference/ApiIdentityInvitesController_revokeInvite ### api-nodes - GET /api/v1/nodes — List hierarchy (scoped tree). Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_listNodes - POST /api/v1/nodes — Create a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_createNode - GET /api/v1/nodes/parents — List the hierarchy as parent edges. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_listNodeParents - GET /api/v1/nodes/{id} — Get a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_getNode - PATCH /api/v1/nodes/{id} — Update a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_updateNode - DELETE /api/v1/nodes/{id} — Delete a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_deleteNode - GET /api/v1/nodes/{id}/tree — Get subtree from a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_getSubtree - GET /api/v1/nodes/{id}/ancestors — Get ancestor chain for a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_getAncestors - GET /api/v1/nodes/{id}/children — Get direct children of a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_getChildren - POST /api/v1/nodes/{id}/move — Move (reparent) a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_moveNode - GET /api/v1/nodes/{id}/identities — List identities at a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_listIdentityAssignments - GET /api/v1/nodes/{id}/identities/summary — Get identity summary for a node. Docs: https://canopy-io.com/docs/api-reference/ApiNodesController_getIdentityAssignmentsSummary ### api-organizations - GET /api/v1/organizations — List organizations. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_listOrganizations - POST /api/v1/organizations — Create an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_createOrganization - DELETE /api/v1/organizations — Delete every organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_deleteAllOrganizations - GET /api/v1/organizations/{id} — Get an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_getOrganization - PATCH /api/v1/organizations/{id} — Update an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_updateOrganization - DELETE /api/v1/organizations/{id} — Delete an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_deleteOrganization - GET /api/v1/organizations/{id}/policy — Get an organization's authentication policy. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_getPolicy - PATCH /api/v1/organizations/{id}/policy — Update an organization's authentication policy. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_updatePolicy - GET /api/v1/organizations/{id}/sso-connections — List an organization's SSO connections. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_listSsoConnections - POST /api/v1/organizations/{id}/sso-connections — Bind an SSO connection to an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_bindSsoConnection - DELETE /api/v1/organizations/{id}/sso-connections/{connectionId} — Unbind an SSO connection from an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_unbindSsoConnection - GET /api/v1/organizations/{id}/members — List an organization's members. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_listMembers - POST /api/v1/organizations/{id}/members — Add a member to an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_addMember - PATCH /api/v1/organizations/{id}/members/{identityId} — Change a member's role. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_changeMemberRole - DELETE /api/v1/organizations/{id}/members/{identityId} — Remove a member from an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_removeMember - GET /api/v1/organizations/{id}/invites — List an organization's invitations. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_listInvites - POST /api/v1/organizations/{id}/invites — Invite a member into an organization. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_createInvite - DELETE /api/v1/organizations/{id}/invites/{inviteId} — Revoke an organization invitation. Docs: https://canopy-io.com/docs/api-reference/ApiOrganizationsController_revokeInvite ### api-roles - GET /api/v1/roles — List roles. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_listRoles - POST /api/v1/roles — Create a custom role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_createRole - GET /api/v1/roles/{id} — Get a role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_getRole - PATCH /api/v1/roles/{id} — Update a role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_updateRole - DELETE /api/v1/roles/{id} — Delete a role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_deleteRole - GET /api/v1/roles/{id}/permissions — Get permissions for a role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_getRolePermissions - PUT /api/v1/roles/{id}/permissions — Replace permissions on a role. Docs: https://canopy-io.com/docs/api-reference/ApiRolesController_setRolePermissions ### api-assignments - GET /api/v1/assignments/app-wide — List all assignments across the Application. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_listAppWideAssignments - GET /api/v1/assignments/app-wide/summary — Get App-wide assignment summary. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_getAppWideAssignmentsSummary - POST /api/v1/assignments — Assign a role to an identity at a node. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_assignRole - PATCH /api/v1/assignments/{id} — Update an assignment. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_updateAssignment - DELETE /api/v1/assignments/{id} — Remove an assignment. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_removeAssignment - POST /api/v1/assignments/bulk-remove — Bulk remove assignments. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_bulkRemove - POST /api/v1/assignments/bulk-change-role — Bulk change role on assignments. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_bulkChangeRole - POST /api/v1/assignments/bulk-create — Bulk-create role assignments. All-or-nothing: any failure rolls back the entire batch. Docs: https://canopy-io.com/docs/api-reference/ApiAssignmentsController_bulkCreate ### api-audit-events - GET /api/v1/audit-events — Query identity audit events. Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_query - GET /api/v1/audit-events/export — List recent audit-log export jobs. Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_listExports - POST /api/v1/audit-events/export — Create an identity audit-events export job (CSV / NDJSON). Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_createExport - GET /api/v1/audit-events/export/{id} — Get an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_getExport - DELETE /api/v1/audit-events/export/{id} — Delete an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_deleteExport - GET /api/v1/audit-events/{id} — Get an identity audit event with related events. Docs: https://canopy-io.com/docs/api-reference/ApiAuditEventsController_getById ### api-changes - GET /api/v1/changes — Poll the permission-relevant change feed. Docs: https://canopy-io.com/docs/api-reference/ApiChangesController_query ### api-hierarchy-schema - GET /api/v1/hierarchy-schema — Get hierarchy schema for the active Environment. Docs: https://canopy-io.com/docs/api-reference/ApiHierarchySchemaController_getSchema - PATCH /api/v1/hierarchy-schema — Update hierarchy schema for the active Environment. Docs: https://canopy-io.com/docs/api-reference/ApiHierarchySchemaController_updateSchema ### api-webhooks - GET /api/v1/webhooks — List webhook subscriptions. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_list - POST /api/v1/webhooks — Create a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_create - GET /api/v1/webhooks/event-types — List subscribable webhook event types. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_listEventTypes - GET /api/v1/webhooks/{id}/deliveries — List delivery attempts for a webhook. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_listDeliveries - GET /api/v1/webhooks/{id} — Get a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_get - PATCH /api/v1/webhooks/{id} — Update a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_update - DELETE /api/v1/webhooks/{id} — Delete a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/ApiWebhooksController_remove ### api-api-keys - GET /api/v1/api-keys — List API keys for Application. Docs: https://canopy-io.com/docs/api-reference/ApiApiKeysController_list - POST /api/v1/api-keys — Create a new API key. Docs: https://canopy-io.com/docs/api-reference/ApiApiKeysController_create - PATCH /api/v1/api-keys/{id} — Activate or deactivate an API key. Docs: https://canopy-io.com/docs/api-reference/ApiApiKeysController_update - DELETE /api/v1/api-keys/{id} — Delete an API key. Docs: https://canopy-io.com/docs/api-reference/ApiApiKeysController_delete - POST /api/v1/api-keys/{id}/rotate-secret — Rotate an API key's secret. Docs: https://canopy-io.com/docs/api-reference/ApiApiKeysController_rotateSecret ## Endpoints — Canopy Portal API OpenAPI document: https://canopy-io.com/openapi/portal.json ### auth - POST /v1/auth/register — Register a new user. Docs: https://canopy-io.com/docs/api-reference/AuthController_register - POST /v1/auth/accounts — Create an additional Account for the authenticated admin (no new user). Docs: https://canopy-io.com/docs/api-reference/AuthController_createAccount - GET /v1/auth/accounts/resume — Review the parked account-creation intent before resuming. Docs: https://canopy-io.com/docs/api-reference/AuthController_getPendingAccountCreation - POST /v1/auth/accounts/resume — Resume a deferred account creation parked at the register form. Docs: https://canopy-io.com/docs/api-reference/AuthController_resumeAccountCreation - DELETE /v1/auth/accounts/resume — Dismiss the parked account-creation intent without creating anything. Docs: https://canopy-io.com/docs/api-reference/AuthController_dismissPendingAccountCreation - POST /v1/auth/invite-info — Look up invite details by token. Docs: https://canopy-io.com/docs/api-reference/AuthController_getInviteInfo - POST /v1/auth/accept-invite — Accept an invite. Docs: https://canopy-io.com/docs/api-reference/AuthController_acceptInvite - POST /v1/auth/login — Authenticate and receive tokens. Docs: https://canopy-io.com/docs/api-reference/AuthController_login - POST /v1/auth/select-account — Select an Account from a pre-auth session (multi-Account login). Docs: https://canopy-io.com/docs/api-reference/AuthController_selectAccount - POST /v1/auth/switch-application — Switch the active Application in an authenticated session. Docs: https://canopy-io.com/docs/api-reference/AuthController_switchApplication - POST /v1/auth/refresh — Refresh access token. Docs: https://canopy-io.com/docs/api-reference/AuthController_refresh - POST /v1/auth/logout — Logout and revoke tokens. Docs: https://canopy-io.com/docs/api-reference/AuthController_logout - GET /v1/auth/verify-email — Verify email address. Docs: https://canopy-io.com/docs/api-reference/AuthController_verifyEmail - POST /v1/auth/resend-verification — Resend verification email. Docs: https://canopy-io.com/docs/api-reference/AuthController_resendVerification - POST /v1/auth/resend-verification-by-token — Resend verification email by token. Docs: https://canopy-io.com/docs/api-reference/AuthController_resendVerificationByToken - POST /v1/auth/forgot-password — Request password reset. Docs: https://canopy-io.com/docs/api-reference/AuthController_forgotPassword - POST /v1/auth/reset-password — Reset password with token. Docs: https://canopy-io.com/docs/api-reference/AuthController_resetPassword - POST /v1/auth/change-password — Change password (authenticated). Docs: https://canopy-io.com/docs/api-reference/AuthController_changePassword - GET /v1/auth/me — Get current user profile. Docs: https://canopy-io.com/docs/api-reference/AuthController_getProfile - GET /v1/auth/me/avatar — Get current user avatar image. Docs: https://canopy-io.com/docs/api-reference/AuthController_getAvatar - POST /v1/auth/me/avatar — Upload profile avatar. Docs: https://canopy-io.com/docs/api-reference/AuthController_uploadAvatar - DELETE /v1/auth/me/avatar — Remove profile avatar. Docs: https://canopy-io.com/docs/api-reference/AuthController_deleteAvatar - POST /v1/auth/me/email — Request an email-address change. Docs: https://canopy-io.com/docs/api-reference/AuthController_requestEmailChange - POST /v1/auth/confirm-email-change — Confirm an email-address change. Docs: https://canopy-io.com/docs/api-reference/AuthController_confirmEmailChange - GET /v1/auth/me/permissions — Get current user permissions. Docs: https://canopy-io.com/docs/api-reference/AuthController_getMyPermissions - GET /v1/auth/me/accounts — List the Accounts the current user belongs to. Docs: https://canopy-io.com/docs/api-reference/AuthController_getAccounts - GET /v1/auth/sessions — List active sessions. Docs: https://canopy-io.com/docs/api-reference/AuthController_listSessions - DELETE /v1/auth/sessions — Revoke all sessions. Docs: https://canopy-io.com/docs/api-reference/AuthController_revokeAllSessions - DELETE /v1/auth/sessions/{id} — Revoke a specific session. Docs: https://canopy-io.com/docs/api-reference/AuthController_revokeSession ### identity-auth - GET /v1/identity/auth/config — Get an Environment's public sign-in configuration by publishable key. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_getConfig - POST /v1/identity/auth/login — Authenticate identity and receive tokens. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_login - POST /v1/identity/auth/login/email-otp/start — Request a passwordless email login code. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_emailOtpLoginStart - POST /v1/identity/auth/login/email-otp/verify — Verify an email login code and receive tokens. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_emailOtpLoginVerify - POST /v1/identity/auth/login/mfa-enroll/totp/verify — Complete a first TOTP factor during login and receive tokens. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_enrollTotpDuringLogin - POST /v1/identity/auth/login/mfa-enroll/webauthn/options — Get WebAuthn attestation options to enroll a first factor during login. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_enrollWebAuthnOptionsDuringLogin - POST /v1/identity/auth/login/mfa-enroll/webauthn/verify — Complete a first WebAuthn factor during login and receive tokens. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_enrollWebAuthnDuringLogin - POST /v1/identity/auth/refresh — Refresh identity access token. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_refresh - POST /v1/identity/auth/switch-organization — Switch the session's organization. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_switchOrganization - GET /v1/identity/auth/organizations — List the session's organizations. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_listOrganizations - POST /v1/identity/auth/logout — Logout identity and revoke tokens. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_logout - POST /v1/identity/auth/verify-email — Verify identity email address. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_verifyEmail - POST /v1/identity/auth/verify-email-code — Verify identity email with a self-signup OTP code. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_verifyEmailCode - POST /v1/identity/auth/resend-verification — Resend identity verification email. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_resendVerification - POST /v1/identity/auth/register — Self-service identity signup. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_register - POST /v1/identity/auth/forgot-password — Request identity password reset. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_forgotPassword - POST /v1/identity/auth/forgot-password-code — Request a self-signup password-reset OTP code. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_forgotPasswordCode - POST /v1/identity/auth/reset-password-code — Reset identity password with an OTP code. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_resetPasswordCode - POST /v1/identity/auth/reset-password — Reset identity password with token. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_resetPassword - POST /v1/identity/auth/change-password — Change identity password (authenticated). Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_changePassword - POST /v1/identity/auth/change-email — Request an email change (authenticated) — emails a confirmation code to the new address. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_requestEmailChange - POST /v1/identity/auth/change-email/confirm — Confirm an email change with the code sent to the new address. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_confirmEmailChange - GET /v1/identity/auth/me — Get current identity profile. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_getProfile - GET /v1/identity/auth/sessions — List identity active sessions. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_listSessions - DELETE /v1/identity/auth/sessions/{id} — Revoke a specific identity session. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_revokeSession - POST /v1/identity/auth/sessions/revoke-all — Sign out everywhere for the authenticated identity. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_revokeAllSessions - POST /v1/identity/auth/invite-info — Look up invite details by token. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_getInviteInfo - POST /v1/identity/auth/accept-invite — Accept an invite. Docs: https://canopy-io.com/docs/api-reference/IdentityAuthController_acceptInvite ### identity-mfa - GET /v1/identity/auth/mfa/factors — List enrolled MFA factors for the caller. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_listFactors - POST /v1/identity/auth/mfa/totp/enroll/start — Begin TOTP factor enrollment. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_startTotpEnrollment - POST /v1/identity/auth/mfa/totp/enroll/verify — Complete TOTP factor enrollment. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_verifyTotpEnrollment - POST /v1/identity/auth/mfa/webauthn/enroll/options — Begin WebAuthn factor enrollment. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_startWebAuthnEnrollment - POST /v1/identity/auth/mfa/webauthn/enroll/verify — Complete WebAuthn factor enrollment. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_verifyWebAuthnEnrollment - POST /v1/identity/auth/mfa/step-up — Prove a fresh factor to authorise a sensitive MFA mutation. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_stepUp - POST /v1/identity/auth/mfa/step-up/webauthn/options — Begin a WebAuthn-backed step-up ceremony. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_startWebAuthnStepUp - POST /v1/identity/auth/mfa/step-up/webauthn/verify — Complete a WebAuthn step-up ceremony. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_verifyWebAuthnStepUp - DELETE /v1/identity/auth/mfa/factors/{id} — Remove an enrolled MFA factor. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_removeFactor - POST /v1/identity/auth/mfa/recovery-codes/regenerate — Regenerate the identity's single-use recovery codes. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_regenerateRecoveryCodes - GET /v1/identity/auth/mfa/trusted-devices — List the identity's active 'remember this device' records. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_listTrustedDevices - DELETE /v1/identity/auth/mfa/trusted-devices — Revoke every trusted device for the caller. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_revokeAllTrustedDevices - DELETE /v1/identity/auth/mfa/trusted-devices/{id} — Revoke a single trusted device. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaController_revokeTrustedDevice ### identity-mfa-challenge - POST /v1/identity/auth/mfa/challenge/totp — Submit a TOTP code to satisfy an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_challengeTotp - POST /v1/identity/auth/mfa/challenge/recovery-code — Redeem a single-use recovery code to satisfy an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_challengeRecoveryCode - POST /v1/identity/auth/mfa/challenge/webauthn/options — Generate WebAuthn authentication options for an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_webauthnOptions - POST /v1/identity/auth/mfa/challenge/webauthn/verify — Submit a WebAuthn assertion to satisfy an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_challengeWebAuthn - POST /v1/identity/auth/mfa/challenge/email-otp/send — Trigger an email OTP for an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_sendEmailOtp - POST /v1/identity/auth/mfa/challenge/email-otp/verify — Submit an email OTP to satisfy an in-flight MFA challenge. Docs: https://canopy-io.com/docs/api-reference/IdentityMfaChallengeController_verifyEmailOtp ### oauth-clients - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients — List OAuth clients for Application. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_listClients - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients — Register a new OAuth client. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_createClient - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients/summary — Active/inactive OAuth client counts for the environment. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_summary - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients/{id} — Get OAuth client details. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_getClient - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients/{id} — Update OAuth client. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_updateClient - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients/{id} — Delete OAuth client. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_deleteClient - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/oauth-clients/{id}/rotate-secret — Rotate an OAuth client's secret. Docs: https://canopy-io.com/docs/api-reference/OAuthClientsController_rotateClientSecret ### portal-accounts - GET /portal/v1/accounts/{accountSlug} — Get the current Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountsController_getAccount - PATCH /portal/v1/accounts/{accountSlug} — Update the Account name or settings. Docs: https://canopy-io.com/docs/api-reference/PortalAccountsController_updateAccount - DELETE /portal/v1/accounts/{accountSlug} — Delete the Account (owner only). Docs: https://canopy-io.com/docs/api-reference/PortalAccountsController_deleteAccount ### portal-admin-roles - GET /portal/v1/accounts/{accountSlug}/admin-roles — List operational-administrator roles for the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_listRoles - POST /portal/v1/accounts/{accountSlug}/admin-roles — Create an operational-administrator role. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_createRole - GET /portal/v1/accounts/{accountSlug}/admin-roles/capabilities — List the operational capabilities a role may grant. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_listCapabilities - GET /portal/v1/accounts/{accountSlug}/admin-roles/{adminRoleId} — Get an operational-administrator role. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_getRole - PATCH /portal/v1/accounts/{accountSlug}/admin-roles/{adminRoleId} — Update an operational-administrator role. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_updateRole - DELETE /portal/v1/accounts/{accountSlug}/admin-roles/{adminRoleId} — Delete an administrator role. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_deleteRole - GET /portal/v1/accounts/{accountSlug}/admin-roles/{adminRoleId}/grantable-roles — List the identity roles an administrator role may grant in an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_listGrantableRoles - PUT /portal/v1/accounts/{accountSlug}/admin-roles/{adminRoleId}/grantable-roles — Set the identity roles an administrator role may grant in an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalAdminRolesController_setGrantableRoles ### portal-workspace-environments - GET /portal/v1/accounts/{accountSlug}/workspace-environments — List the Environments the caller may operate in. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceEnvironmentsController_listWorkspaceEnvironments ### portal-admin-assignments - GET /portal/v1/accounts/{accountSlug}/admin-assignments — List operational administrators in an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalAdminAssignmentsController_listAssignments - POST /portal/v1/accounts/{accountSlug}/admin-assignments — Grant an operational administrator. Docs: https://canopy-io.com/docs/api-reference/PortalAdminAssignmentsController_createAssignment - DELETE /portal/v1/accounts/{accountSlug}/admin-assignments/{adminAssignmentId} — Revoke an operational administrator. Docs: https://canopy-io.com/docs/api-reference/PortalAdminAssignmentsController_revokeAssignment ### portal-account-applications - GET /portal/v1/accounts/{accountSlug}/applications — List Applications in the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountApplicationsController_listApplications - POST /portal/v1/accounts/{accountSlug}/applications — Create a new Application in the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountApplicationsController_createApplication ### portal-sso-connections - GET /portal/v1/accounts/{accountSlug}/sso/connections — List SSO connections. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_list - POST /portal/v1/accounts/{accountSlug}/sso/connections — Create an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_create - GET /portal/v1/accounts/{accountSlug}/sso/connections/{id} — Get an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_detail - PATCH /portal/v1/accounts/{accountSlug}/sso/connections/{id} — Update an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_update - DELETE /portal/v1/accounts/{accountSlug}/sso/connections/{id} — Delete an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_remove - POST /portal/v1/accounts/{accountSlug}/sso/connections/{id}/activate — Activate an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_activate - POST /portal/v1/accounts/{accountSlug}/sso/connections/{id}/disable — Disable an SSO connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_disable - GET /portal/v1/accounts/{accountSlug}/sso/connections/{id}/oauth-clients — List OAuth-client links for an end-user connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_listOAuthClientLinks - POST /portal/v1/accounts/{accountSlug}/sso/connections/{id}/oauth-clients/{oauthClientId} — Link an OAuth client to an end-user connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_linkOAuthClient - PATCH /portal/v1/accounts/{accountSlug}/sso/connections/{id}/oauth-clients/{oauthClientId} — Update an OAuth-client link. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_updateOAuthClientLink - DELETE /portal/v1/accounts/{accountSlug}/sso/connections/{id}/oauth-clients/{oauthClientId} — Unlink an OAuth client from a connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_unlinkOAuthClient - GET /portal/v1/accounts/{accountSlug}/sso/connections/{id}/environments — List Environment bindings for an end-user connection. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_listEnvironmentLinks - POST /portal/v1/accounts/{accountSlug}/sso/connections/{id}/environments/{environmentId} — Bind an end-user connection to an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_linkEnvironment - PATCH /portal/v1/accounts/{accountSlug}/sso/connections/{id}/environments/{environmentId} — Update an Environment binding. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_updateEnvironmentLink - DELETE /portal/v1/accounts/{accountSlug}/sso/connections/{id}/environments/{environmentId} — Unbind an end-user connection from an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_unlinkEnvironment - GET /portal/v1/accounts/{accountSlug}/sso/connections/{id}/organizations — List the organizations an end-user connection is bound to. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_listOrganizationBindings - GET /portal/v1/accounts/{accountSlug}/sso/connections/{id}/recent-logins — List a connection's recent login attempts. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_recentLogins - GET /portal/v1/accounts/{accountSlug}/sso/oauth-clients/{oauthClientId}/links — List an OAuth client's SSO connection links. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_listClientLinks - GET /portal/v1/accounts/{accountSlug}/sso/sign-in-coverage — List Environments reachable by SSO. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_signInCoverage - GET /portal/v1/accounts/{accountSlug}/sso/domains — List SSO domain claims. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_listDomains - POST /portal/v1/accounts/{accountSlug}/sso/domains — Claim a domain for admin SSO. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_claimDomain - POST /portal/v1/accounts/{accountSlug}/sso/domains/{domain}/verify — Verify a claimed domain. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_verifyDomain - DELETE /portal/v1/accounts/{accountSlug}/sso/domains/{domain} — Remove a domain claim. Docs: https://canopy-io.com/docs/api-reference/PortalSsoConnectionsController_removeDomain ### portal-account-identities - GET /portal/v1/accounts/{accountSlug}/identities — List identities in Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_listIdentities - POST /portal/v1/accounts/{accountSlug}/identities — Create an Account identity. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_createIdentity - POST /portal/v1/accounts/{accountSlug}/identities/bulk-create — Bulk-create Account identities. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_bulkCreateIdentities - GET /portal/v1/accounts/{accountSlug}/identities/summary — Get directory counts for the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_getDirectorySummary - GET /portal/v1/accounts/{accountSlug}/identities/{id} — Get an Account identity. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_getIdentity - PATCH /portal/v1/accounts/{accountSlug}/identities/{id} — Update an Account identity profile. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_updateIdentity - PATCH /portal/v1/accounts/{accountSlug}/identities/{id}/status — Set Account-wide is_active flag. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_setStatus - POST /portal/v1/accounts/{accountSlug}/identities/{id}/erase — Erase an identity (GDPR/CCPA right to be forgotten). Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_eraseIdentity - POST /portal/v1/accounts/{accountSlug}/identities/{id}/reset-password — Admin-trigger a password reset email. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_resetPassword - POST /portal/v1/accounts/{accountSlug}/identities/{id}/resend-verification — Re-send email verification. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_resendVerification - POST /portal/v1/accounts/{accountSlug}/identities/{id}/revoke-sessions — Revoke all active sessions for an identity. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_revokeSessions - GET /portal/v1/accounts/{accountSlug}/identities/{id}/audit — List audit events for an Account identity. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_listIdentityAudit - POST /portal/v1/accounts/{accountSlug}/identities/{id}/environment-memberships — Add an identity to an Environment (create EnvironmentMembership). Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_addEnvMembership - POST /portal/v1/accounts/{accountSlug}/identities/environment-memberships/bulk-attach — Bulk-attach EnvironmentMemberships for the Add-from-directory picker. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_bulkAttachEnvMemberships - DELETE /portal/v1/accounts/{accountSlug}/identities/{id}/environment-memberships/{envId} — Remove an identity from an Environment (revoke EnvironmentMembership). Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentitiesController_removeEnvMembership ### portal-account-identity-mfa - GET /portal/v1/accounts/{accountSlug}/identities/{id}/mfa — Get MFA enrollment summary for an identity. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityMfaController_getSummary - POST /portal/v1/accounts/{accountSlug}/identities/{id}/mfa/reset — Force-reset an identity's MFA — admin recovery action. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityMfaController_forceReset ### portal-account-identity-invites - GET /portal/v1/accounts/{accountSlug}/identity-invites — List invites. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityInvitesController_listInvites - POST /portal/v1/accounts/{accountSlug}/identity-invites — Invite an identity at the Account tier. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityInvitesController_createInvite - GET /portal/v1/accounts/{accountSlug}/identity-invites/summary — Get invite summary. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityInvitesController_getInvitesSummary - POST /portal/v1/accounts/{accountSlug}/identity-invites/{id}/resend — Resend an invite. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityInvitesController_resendInvite - DELETE /portal/v1/accounts/{accountSlug}/identity-invites/{id} — Revoke an invite. Docs: https://canopy-io.com/docs/api-reference/PortalAccountIdentityInvitesController_revokeInvite ### portal-account-members - GET /portal/v1/accounts/{accountSlug}/members — List platform-admin members of the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountMembersController_listMembers - DELETE /portal/v1/accounts/{accountSlug}/members/{memberId} — Remove a platform admin from the Account. Docs: https://canopy-io.com/docs/api-reference/PortalAccountMembersController_removeMember ### portal-account-webhooks - GET /portal/v1/accounts/{accountSlug}/webhooks — List webhook subscriptions. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_list - POST /portal/v1/accounts/{accountSlug}/webhooks — Create a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_create - GET /portal/v1/accounts/{accountSlug}/webhooks/summary — Active/inactive webhook counts for the environment. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_summary - GET /portal/v1/accounts/{accountSlug}/webhooks/event-types — List subscribable webhook event types. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_listEventTypes - GET /portal/v1/accounts/{accountSlug}/webhooks/{id}/deliveries — List delivery attempts for a webhook. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_listDeliveries - GET /portal/v1/accounts/{accountSlug}/webhooks/{id} — Get a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_get - PATCH /portal/v1/accounts/{accountSlug}/webhooks/{id} — Update a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_update - DELETE /portal/v1/accounts/{accountSlug}/webhooks/{id} — Delete a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_remove - POST /portal/v1/accounts/{accountSlug}/webhooks/{id}/rotate-secret — Rotate a webhook subscription's signing secret. Docs: https://canopy-io.com/docs/api-reference/PortalAccountWebhooksController_rotateSecret ### portal-applications - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug} — Get the current Application. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_getApplication - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug} — Update the Application name or settings. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_updateApplication - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug} — Delete an Application. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_deleteApplication - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/default-environment — Set the App's default Environment. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_setDefaultEnvironment - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/me/state — Get the admin's resume-state for this Application. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_getUserState - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/me/state — Update the admin's resume-state for this Application. Docs: https://canopy-io.com/docs/api-reference/PortalApplicationsController_setUserState ### portal-audit-log-admin - GET /portal/v1/accounts/{accountSlug}/audit-log/admin/stream — Live-tail admin audit-log events (SSE). Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_liveTail - GET /portal/v1/accounts/{accountSlug}/audit-log/admin — Query admin audit-log events. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_query - GET /portal/v1/accounts/{accountSlug}/audit-log/admin/export — List recent audit-log export jobs. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_listExports - POST /portal/v1/accounts/{accountSlug}/audit-log/admin/export — Create an admin audit-log export job (CSV / NDJSON). Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_createExport - GET /portal/v1/accounts/{accountSlug}/audit-log/admin/export/{id} — Get an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_getExport - DELETE /portal/v1/accounts/{accountSlug}/audit-log/admin/export/{id} — Delete an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_deleteExport - GET /portal/v1/accounts/{accountSlug}/audit-log/admin/{id} — Get an admin audit-log row with related events. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogAdminController_getById ### portal-audit-log-identities - GET /portal/v1/accounts/{accountSlug}/audit-log/identities/stream — Live-tail identity audit-log events (SSE). Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_liveTail - GET /portal/v1/accounts/{accountSlug}/audit-log/identities — Query identity audit-log events. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_query - GET /portal/v1/accounts/{accountSlug}/audit-log/identities/export — List recent audit-log export jobs. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_listExports - POST /portal/v1/accounts/{accountSlug}/audit-log/identities/export — Create an identity audit-log export job (CSV / NDJSON). Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_createExport - GET /portal/v1/accounts/{accountSlug}/audit-log/identities/export/{id} — Get an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_getExport - DELETE /portal/v1/accounts/{accountSlug}/audit-log/identities/export/{id} — Delete an audit-log export job. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_deleteExport - GET /portal/v1/accounts/{accountSlug}/audit-log/identities/{id} — Get an identity audit-log row with related events. Docs: https://canopy-io.com/docs/api-reference/PortalAuditLogIdentitiesController_getById ### portal-environments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments — List Environments in an Application. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_list - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments — Create a new Environment in an Application. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_create - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug} — Get a single Environment by slug. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_getOne - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug} — Rename or re-slug an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_update - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug} — Delete an Environment. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_delete - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-settings — Get an Environment's sign-in settings. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_getAuthSettings - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-settings — Change an Environment's sign-in settings. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_updateAuthSettings - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/export — Export an Environment's configuration as JSON. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_export - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/import — Replace an Environment's configuration from a JSON payload (destructive). Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_import - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/access-model — Get the Environment's access model. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_getAccessModel - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/access-model — Switch the Environment's access model. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_setAccessModel - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations-feature — Switch the Environment's organizations container on or off. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_setOrganizationsFeature - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/hierarchy-schema — Get hierarchy schema for the active Environment. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_getHierarchySchema - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/hierarchy-schema — Update hierarchy schema for the active Environment. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_updateHierarchySchema - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/hierarchy-schema/node-types-in-use — List hierarchy node types with existing nodes. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_getNodeTypesInUse - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/revert-to-flat — Revert this Environment from hierarchy to flat. Docs: https://canopy-io.com/docs/api-reference/PortalEnvironmentsController_revertToFlat ### portal-hierarchy - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes — List hierarchy (scoped tree). Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_listNodes - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes — Create a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_createNode - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id} — Get a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_getNode - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id} — Update a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_updateNode - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id} — Delete a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_deleteNode - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/tree — Get subtree from a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_getSubtree - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/ancestors — Get ancestor chain for a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_getAncestors - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/children — Get direct children of a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_getChildren - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/move — Move (reparent) a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_moveNode - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/identities — List identities at a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_listIdentityAssignments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/nodes/{id}/identities/summary — Get identity summary for a node. Docs: https://canopy-io.com/docs/api-reference/PortalHierarchyController_getIdentityAssignmentsSummary ### portal-organizations - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations — List organizations. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_listOrganizations - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations — Create an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_createOrganization - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations — Delete every organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_deleteAllOrganizations - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id} — Get an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_getOrganization - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id} — Update an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_updateOrganization - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id} — Delete an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_deleteOrganization - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/policy — Get an organization's authentication policy. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_getPolicy - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/policy — Update an organization's authentication policy. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_updatePolicy - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/sso-connections — List an organization's SSO connections. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_listSsoConnections - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/sso-connections — Bind an SSO connection to an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_bindSsoConnection - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/sso-connections/{connectionId} — Unbind an SSO connection from an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_unbindSsoConnection - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/members — List an organization's members. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_listMembers - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/members — Add a member to an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_addMember - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/members/{identityId} — Change a member's role. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_changeMemberRole - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/members/{identityId} — Remove a member from an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_removeMember - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/invites — List an organization's invitations. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_listInvites - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/invites — Invite a member into an organization. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_createInvite - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/organizations/{id}/invites/{inviteId} — Revoke an organization invitation. Docs: https://canopy-io.com/docs/api-reference/PortalOrganizationsController_revokeInvite ### portal-identity-invites - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites — List invites. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_listInvites - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites — Create an invite. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_createInvite - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites/summary — Get invite summary. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_getInvitesSummary - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites/bulk-create — Bulk-create invites. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_bulkCreateInvites - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites/{id}/resend — Resend an invite. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_resendInvite - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identity-invites/{id} — Revoke an invite. Docs: https://canopy-io.com/docs/api-reference/PortalIdentityInvitesController_revokeInvite ### portal-rbac-roles - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles — List roles. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_listRoles - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles — Create a custom role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_createRole - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles/{id} — Get a role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_getRole - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles/{id} — Update a role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_updateRole - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles/{id} — Delete a role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_deleteRole - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles/{id}/permissions — Get permissions for a role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_getRolePermissions - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/roles/{id}/permissions — Replace permissions on a role. Docs: https://canopy-io.com/docs/api-reference/PortalRbacRolesController_setRolePermissions ### portal-rbac-permissions - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions — List permission catalog. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_listPermissions - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions — Register new permission(s). Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_createPermissions - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions/evaluate/explain — Explain a node-scoped authorization decision. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_explain - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions/{id} — Get a permission. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_getPermission - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions/{id} — Update permission metadata. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_updatePermission - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions/{id} — Remove a permission. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_deletePermission - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/permissions/{id}/usage — Get where a permission is used. Docs: https://canopy-io.com/docs/api-reference/PortalRbacPermissionsController_getPermissionUsage ### portal-rbac-assignments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/app-wide — List all assignments across the Application. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_listAppWideAssignments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/app-wide/summary — Get App-wide assignment summary. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_getAppWideAssignmentsSummary - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments — Assign a role to an identity at a node. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_assignRole - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/{id} — Update an assignment. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_updateAssignment - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/{id} — Remove an assignment. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_removeAssignment - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/bulk-remove — Bulk remove assignments. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_bulkRemove - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/bulk-change-role — Bulk change role on assignments. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_bulkChangeRole - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/assignments/bulk-create — Bulk-create role assignments. All-or-nothing: any failure rolls back the entire batch. Docs: https://canopy-io.com/docs/api-reference/PortalRbacAssignmentsController_bulkCreate ### portal-api-keys - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys — List API keys for Application. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_list - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys — Create a new API key. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_create - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/scopes — List the permission scopes a scoped key can hold. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_listScopes - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/summary — Active/inactive API key counts for the environment. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_summary - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/{id} — Activate or deactivate an API key. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_update - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/{id} — Delete an API key. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_delete - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/{id}/rotate-secret — Rotate an API key's secret. Docs: https://canopy-io.com/docs/api-reference/PortalApiKeysController_rotateSecret ### portal-scim-tokens - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-tokens — List active SCIM tokens for the Environment. Docs: https://canopy-io.com/docs/api-reference/PortalScimTokensController_list - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-tokens — Mint a SCIM bearer token for the Environment. Docs: https://canopy-io.com/docs/api-reference/PortalScimTokensController_create - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-tokens/activity — Recent SCIM sync activity for the Environment. Docs: https://canopy-io.com/docs/api-reference/PortalScimTokensController_activity - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-tokens/{id} — Revoke a SCIM token. Docs: https://canopy-io.com/docs/api-reference/PortalScimTokensController_revoke ### portal-scim-groups - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-groups — List IdP-pushed SCIM groups for the Environment. Docs: https://canopy-io.com/docs/api-reference/PortalScimGroupsController_list - PUT /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-groups/{id}/mapping — Map a SCIM group to a role at a node. Docs: https://canopy-io.com/docs/api-reference/PortalScimGroupsController_map - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/scim-groups/{id}/mapping — Clear a SCIM group's role mapping. Docs: https://canopy-io.com/docs/api-reference/PortalScimGroupsController_unmap ### portal-identities - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities — List identities in Application. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_listIdentities - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities — Create an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_createIdentity - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/with-roles — List identities with their role assignments. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_listIdentitiesWithRoles - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/summary — Get Application identities summary. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_getIdentitiesSummary - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/bulk-create — Bulk-create identities. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_bulkCreateIdentities - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/bulk-import-events — Record a bulk-import wizard completion. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_logBulkImportEvent - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id} — Get an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_getIdentity - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id} — Update an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_updateIdentity - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id} — Remove an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_removeIdentity - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id}/detail — Get identity detail with role assignments. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_getIdentityDetail - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id}/activate — Activate an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_activateIdentity - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id}/deactivate — Deactivate an identity. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_deactivateIdentity - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id}/assignments — Get identity's role assignments. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_getIdentityAssignments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/identities/{id}/permissions — Get identity's effective permissions. Docs: https://canopy-io.com/docs/api-reference/PortalIdentitiesController_getIdentityPermissions ### portal-me-audit-views - GET /portal/v1/me/audit-views — List saved audit-log views for the current admin. Docs: https://canopy-io.com/docs/api-reference/PortalMeAuditViewsController_list - POST /portal/v1/me/audit-views — Create or replace a saved audit-log view. Docs: https://canopy-io.com/docs/api-reference/PortalMeAuditViewsController_create - DELETE /portal/v1/me/audit-views/{surface}/{name} — Delete a saved audit-log view. Docs: https://canopy-io.com/docs/api-reference/PortalMeAuditViewsController_remove ### portal-me - GET /portal/v1/accounts/{accountSlug}/me/landing — Resolve the current user's product access and landing. Docs: https://canopy-io.com/docs/api-reference/PortalMeLandingController_getLanding - GET /portal/v1/accounts/{accountSlug}/me/console-capabilities — List the current user's own Developer Console capabilities. Docs: https://canopy-io.com/docs/api-reference/PortalMeLandingController_getMyConsoleCapabilities - GET /portal/v1/accounts/{accountSlug}/me/governance-capabilities — List the current user's own Account-governance capabilities. Docs: https://canopy-io.com/docs/api-reference/PortalMeLandingController_getMyGovernanceCapabilities ### portal-me-preferences - GET /portal/v1/me/preferences — Get the admin's preferences. Docs: https://canopy-io.com/docs/api-reference/PortalMePreferencesController_get - PATCH /portal/v1/me/preferences — Update the admin's preferences. Docs: https://canopy-io.com/docs/api-reference/PortalMePreferencesController_patch ### portal-setup - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/access-bootstrap — Bootstrap the Environment's permission catalog and roles. Docs: https://canopy-io.com/docs/api-reference/PortalSetupController_bootstrapAccess - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/setup/resource-permissions — Add resource permissions to existing roles. Docs: https://canopy-io.com/docs/api-reference/PortalSetupController_addResourcePermissions ### portal-setup-summaries - GET /portal/v1/accounts/{accountSlug}/setup-summaries — List setup status for every Environment in the Account. Docs: https://canopy-io.com/docs/api-reference/PortalSetupSummariesController_list ### portal-user-invites - GET /portal/v1/accounts/{accountSlug}/user-invites — List invites. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_listInvites - POST /portal/v1/accounts/{accountSlug}/user-invites — Create an invite. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_createInvite - GET /portal/v1/accounts/{accountSlug}/user-invites/summary — Get invite summary. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_getInvitesSummary - POST /portal/v1/accounts/{accountSlug}/user-invites/{id}/resend — Resend an invite. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_resendInvite - PATCH /portal/v1/accounts/{accountSlug}/user-invites/{id} — Change the role a pending invite grants. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_updateInviteIntent - DELETE /portal/v1/accounts/{accountSlug}/user-invites/{id} — Revoke an invite. Docs: https://canopy-io.com/docs/api-reference/PortalUserInvitesController_revokeInvite ### portal-users - GET /portal/v1/accounts/{accountSlug}/users — List users in Account. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_listUsers - GET /portal/v1/accounts/{accountSlug}/users/summary — Get Account users summary. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_getUsersSummary - GET /portal/v1/accounts/{accountSlug}/users/{id} — Get a user. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_getUser - DELETE /portal/v1/accounts/{accountSlug}/users/{id} — Remove user from Account. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_removeUser - POST /portal/v1/accounts/{accountSlug}/users/{id}/activate — Activate a user. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_activateUser - POST /portal/v1/accounts/{accountSlug}/users/{id}/deactivate — Deactivate a user. Docs: https://canopy-io.com/docs/api-reference/PortalUsersController_deactivateUser ### portal-webhooks - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks — List webhook subscriptions. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_list - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks — Create a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_create - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/summary — Active/inactive webhook counts for the environment. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_summary - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/event-types — List subscribable webhook event types. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_listEventTypes - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/{id}/deliveries — List delivery attempts for a webhook. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_listDeliveries - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/{id} — Get a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_get - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/{id} — Update a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_update - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/{id} — Delete a webhook subscription. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_remove - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/webhooks/{id}/rotate-secret — Rotate a webhook subscription's signing secret. Docs: https://canopy-io.com/docs/api-reference/PortalWebhooksController_rotateSecret ### portal-auth-domain - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-domain — Get the environment's custom auth domain. Docs: https://canopy-io.com/docs/api-reference/PortalAuthDomainController_get - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-domain — Add a custom auth domain. Docs: https://canopy-io.com/docs/api-reference/PortalAuthDomainController_add - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-domain — Remove a custom auth domain. Docs: https://canopy-io.com/docs/api-reference/PortalAuthDomainController_remove - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/auth-domain/verify — Verify a custom auth domain's DNS. Docs: https://canopy-io.com/docs/api-reference/PortalAuthDomainController_verify ### portal-publishable-keys - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/publishable-keys — List the environment's publishable keys. Docs: https://canopy-io.com/docs/api-reference/PortalPublishableKeysController_list - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/publishable-keys — Create a publishable key. Docs: https://canopy-io.com/docs/api-reference/PortalPublishableKeysController_create - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/publishable-keys/{id} — Rename a publishable key. Docs: https://canopy-io.com/docs/api-reference/PortalPublishableKeysController_rename - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/publishable-keys/{id} — Revoke a publishable key. Docs: https://canopy-io.com/docs/api-reference/PortalPublishableKeysController_revoke ### portal-workspace - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/context — Resolve the caller's operational authority in the Environment. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_getContext - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/identities — List identities within the caller's operational scope. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listIdentities - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/identities/{identityId}/assignments — List an identity's responsibilities within the caller's scope. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listIdentityAssignments - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/assignable-roles — List the identity roles the caller may grant. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listAssignableRoles - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/assignable-nodes — List the hierarchy locations the caller may assign at. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listAssignableNodes - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/visible-nodes — List the hierarchy nodes the caller can see in this Environment. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listVisibleNodes - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/invitations — List identity invitations within the caller's scope. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listInvitations - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/invitations — Invite an identity into a location with a role. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_createInvitation - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/activity — List scoped operational activity within the caller's scope. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_listActivity - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/activity/export — Download the scoped activity feed as CSV. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_exportActivity - GET /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/activity/retention — How long activity history is kept for this Account. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_getActivityRetention - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/invitations/{invitationId}/resend — Resend a scoped invitation. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_resendInvitation - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/invitations/{invitationId} — Revoke a scoped invitation. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_revokeInvitation - POST /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/assignments — Grant an identity a role at a hierarchy node. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_assignRole - PATCH /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/assignments/{assignmentId} — Move or re-role an existing assignment. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_updateAssignment - DELETE /portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/workspace/assignments/{assignmentId} — Remove an identity's role assignment. Docs: https://canopy-io.com/docs/api-reference/PortalWorkspaceController_removeAssignment ## Endpoints — Canopy OAuth 2.0 / OIDC OpenAPI document: https://canopy-io.com/openapi/oauth.json ### oidc - GET /.well-known/openid-configuration — OIDC discovery document. Docs: https://canopy-io.com/docs/api-reference/DiscoveryController_getOpenIdConfiguration - GET /.well-known/jwks.json — JSON Web Key Set. Docs: https://canopy-io.com/docs/api-reference/DiscoveryController_getJwks ### oauth - GET /oauth/authorize — OAuth2 authorization endpoint. Docs: https://canopy-io.com/docs/api-reference/OAuthController_authorize - POST /oauth/authorize — OAuthController_authorizePost. Docs: https://canopy-io.com/docs/api-reference/OAuthController_authorizePost - POST /oauth/login/email-otp/start — OAuth hosted login: email a passwordless login code. Docs: https://canopy-io.com/docs/api-reference/OAuthController_loginEmailOtpStartPost - POST /oauth/login/email-otp/verify — OAuth hosted login: verify the passwordless login code. Docs: https://canopy-io.com/docs/api-reference/OAuthController_loginEmailOtpVerifyPost - GET /oauth/register — OAuth hosted login: self-signup page. Docs: https://canopy-io.com/docs/api-reference/OAuthController_registerPage - POST /oauth/register — OAuth hosted login: self-signup form submission. Docs: https://canopy-io.com/docs/api-reference/OAuthController_registerPost - POST /oauth/mfa-challenge — OAuth hosted login: submit MFA challenge. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaChallengePost - POST /oauth/mfa/email-otp/send — OAuth hosted login: email a one-time MFA code. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaEmailOtpSendPost - POST /oauth/mfa/email-otp/verify — OAuth hosted login: verify the emailed MFA code. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaEmailOtpVerifyPost - POST /oauth/mfa/webauthn/options — OAuth hosted login: WebAuthn authentication options. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaWebAuthnOptionsPost - POST /oauth/mfa/webauthn/verify — OAuth hosted login: verify a WebAuthn assertion. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaWebAuthnVerifyPost - POST /oauth/mfa/webauthn/enroll/options — OAuth hosted login: WebAuthn enrollment options. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaWebAuthnEnrollOptionsPost - POST /oauth/mfa/webauthn/enroll/verify — OAuth hosted login: verify a WebAuthn enrollment attestation. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaWebAuthnEnrollVerifyPost - GET /oauth/mfa-enroll-codes — OAuth hosted login: view sealed enrollment recovery codes (WebAuthn fetch-flow seam). Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaEnrollCodesView - POST /oauth/mfa-enroll-verify — OAuth hosted login: verify MFA enrollment. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaEnrollVerifyPost - POST /oauth/mfa-enroll-codes-ack — OAuth hosted login: acknowledge recovery codes. Docs: https://canopy-io.com/docs/api-reference/OAuthController_mfaEnrollCodesAckPost - POST /oauth/token — OAuth2 token exchange. Docs: https://canopy-io.com/docs/api-reference/OAuthController_token - POST /oauth/revoke — Revoke a token. Docs: https://canopy-io.com/docs/api-reference/OAuthController_revoke - GET /oauth/userinfo — OIDC UserInfo endpoint. Docs: https://canopy-io.com/docs/api-reference/OAuthController_userinfo ## Endpoints — Canopy SCIM 2.0 OpenAPI document: https://canopy-io.com/openapi/scim.json ### scim-users - GET /scim/v2/environments/{environmentId}/Users — ScimUsersController_list. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_list - POST /scim/v2/environments/{environmentId}/Users — ScimUsersController_create. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_create - GET /scim/v2/environments/{environmentId}/Users/{id} — ScimUsersController_getById. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_getById - PUT /scim/v2/environments/{environmentId}/Users/{id} — ScimUsersController_replace. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_replace - PATCH /scim/v2/environments/{environmentId}/Users/{id} — ScimUsersController_patch. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_patch - DELETE /scim/v2/environments/{environmentId}/Users/{id} — ScimUsersController_remove. Docs: https://canopy-io.com/docs/api-reference/ScimUsersController_remove ### scim-groups - GET /scim/v2/environments/{environmentId}/Groups — ScimGroupsController_list. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_list - POST /scim/v2/environments/{environmentId}/Groups — ScimGroupsController_create. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_create - GET /scim/v2/environments/{environmentId}/Groups/{id} — ScimGroupsController_getById. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_getById - PUT /scim/v2/environments/{environmentId}/Groups/{id} — ScimGroupsController_replace. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_replace - PATCH /scim/v2/environments/{environmentId}/Groups/{id} — ScimGroupsController_patch. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_patch - DELETE /scim/v2/environments/{environmentId}/Groups/{id} — ScimGroupsController_remove. Docs: https://canopy-io.com/docs/api-reference/ScimGroupsController_remove ### scim-discovery - GET /scim/v2/environments/{environmentId}/ServiceProviderConfig — ScimDiscoveryController_serviceProviderConfig. Docs: https://canopy-io.com/docs/api-reference/ScimDiscoveryController_serviceProviderConfig - GET /scim/v2/environments/{environmentId}/ResourceTypes — ScimDiscoveryController_resourceTypes. Docs: https://canopy-io.com/docs/api-reference/ScimDiscoveryController_resourceTypes - GET /scim/v2/environments/{environmentId}/Schemas — ScimDiscoveryController_schemas. Docs: https://canopy-io.com/docs/api-reference/ScimDiscoveryController_schemas ## Webhook event types Webhook subscriptions match on these event-type strings verbatim; a subscription may also use the wildcard "*" to receive every event in its scope. ### Environment-scoped events - identity.status_set: An identity was activated or deactivated. - identity.erased: An identity's personal data was erased (GDPR/CCPA). The payload carries only the pseudonymous identity id. - identity.env_membership.added: An identity was granted membership to an environment. - identity.env_membership.removed: An identity's environment membership was removed. - assignment.created: A role was assigned to an identity at a node. - assignment.updated: An existing role assignment was updated. - assignment.removed: A role assignment was removed from an identity. - assignment.bulk_created: Multiple role assignments were created in one operation. - assignment.bulk_removed: Multiple role assignments were removed in one operation. - assignment.bulk_role_changed: The role on multiple assignments was changed in bulk. - role.created: A role was created. - role.updated: A role's name or metadata was updated. - role.deleted: A role was deleted. - role.permissions.updated: The permissions attached to a role were changed. - permission.created: A permission was created. - permission.updated: A permission was updated. - permission.deleted: A permission was deleted. - node.created: A hierarchy node was created. - node.updated: A hierarchy node was updated. - node.deleted: A hierarchy node was deleted. - node.moved: A hierarchy node was moved, changing inheritance. - hierarchy_schema.updated: The hierarchy node-type schema was updated. - organization.created: An organization was created in the Environment. - organization.updated: An organization was renamed or updated. - organization.deleted: An organization was deleted, along with its memberships and pending invitations. - organization.member.added: An identity was added to an organization with a role. - organization.member.role_changed: An organization member's role was replaced. - organization.member.removed: An identity was removed from an organization. - organization.deleted_all: Every organization in the Environment was deleted in one call, with their memberships, pending invitations, and subtrees. - organization.policy.updated: An organization's authentication policy was changed (MFA requirement, factor allowlist, MFA after SSO, or require SSO). - organization.sso_connection.bound: An SSO connection was bound to an organization; sign-ins through it now land there. - organization.sso_connection.unbound: An SSO connection was unbound from an organization. ### Account-scoped events Delivered to account-scoped subscriptions, created from the Console's Account Webhooks page or POST /portal/v1/accounts/:accountSlug/webhooks with a Console token. identity.status_set, identity.erased, and the two identity.env_membership events also reach the subscriptions of every Environment the identity belongs to, so an environment API key's subscription (POST /api/v1/webhooks) hears about its own members. The rest are account-only: GET /api/v1/webhooks/event-types lists every event with a scope field, and naming an account-only event on an environment subscription answers 400 webhook.invalid_event_type. - identity.created: An identity was created. - identity.updated: An identity's profile or attributes were updated. - identity.status_set: An identity was activated or deactivated. - identity.erased: An identity's personal data was erased (GDPR/CCPA). The payload carries only the pseudonymous identity id. - identity.env_membership.added: An identity was granted membership to an environment. - identity.env_membership.removed: An identity's environment membership was removed. - account_member.added: A member was added to the account. - account_member.removed: A member was removed from the account. - session.all_revoked: All active sessions for an identity were revoked. ### What each event carries Every delivery's data is the audit entry's envelope (see below); what differs per event is resource_type, resource_id, and the keys inside metadata. Ids are Canopy ids; external_id on organization events is the id you supplied when you created the organization, so a receiver can correlate without a follow-up read. - Assignments (resource_type: "role_assignment", resource_id the assignment): assignment.created, assignment.updated, and assignment.removed carry identity_id, node_id, and role_id; one accepted from an invitation adds source: "invite". assignment.bulk_created carries assignment_ids, succeeded, and failed; assignment.bulk_removed carries assignment_ids and affected (a list of identity_id, node_id, role_id); assignment.bulk_role_changed carries assignment_ids, the new role_id, and affected (identity_id, node_id). - Roles (resource_type: "role", resource_id the role): role.created and role.deleted carry name; role.updated carries changes, the fields written; role.permissions.updated carries permission_keys, the role's full list after the write. - Permissions (resource_type: "permission", resource_id the permission): permission.created and permission.deleted carry key; permission.updated carries changes. - Hierarchy (resource_type: "node", resource_id the node): node.created carries name, node_type, and parent_node_id; node.updated and node.moved carry name, plus parent_node_id and status when those changed; node.deleted carries name, descendant_count, and assignments_removed. hierarchy_schema.updated (resource_type: "hierarchy_schema") carries node_types and max_depth. - Organizations (resource_type: "organization", resource_id the organization): organization.created and organization.updated carry name, slug, and external_id; organization.deleted carries name, external_id, memberships_removed, invites_revoked, and nodes_deleted. organization.deleted_all (resource_type: "environment") carries organizations_deleted, memberships_removed, invites_revoked, and nodes_deleted. - Memberships (resource_type: "organization", resource_id the organization, every one with external_id): organization.member.added carries identity_id, role_id, and assignment_id, or, when a just-in-time SSO sign-in created it, identity_id, role_id, connection_id, and source: "sso_jit"; organization.member.role_changed carries identity_id, from_role_id, and to_role_id; organization.member.removed carries identity_id, role_id, and scoped_assignments_removed. - Organization policy and SSO (resource_type: "organization", with external_id): organization.policy.updated carries mfa_required, mfa_factor_allowlist, mfa_after_sso, and require_sso; organization.sso_connection.bound carries connection_id, connection_name, and default_role_id; organization.sso_connection.unbound carries connection_id. - Identities (resource_type: "identity", resource_id the identity): identity.created carries email and password_set, plus environment_id when created inside an Environment or source: "invite" when an invitation was accepted; identity.updated carries changes or fields_updated; identity.status_set carries previous_is_active and new_is_active, and on an account delivery environment_ids, the Environments the identity belonged to; identity.erased carries environment_ids the same way. An Environment delivery of either names that Environment alone: its own id and Application in the envelope, and no environment_ids, since one Environment's subscriber is not told about the others. The two identity.env_membership events carry the Environment in the envelope's environment_id. identity.env_membership.added carries membership_id, reactivated, and a source of identity_create, invite (with invite_id), or sso_jit (with connection_id); identity.env_membership.removed carries revoked_pending_invites. Which action fires which: POST /api/v1/identities/{id}/deactivate and activate (and a PATCH that changes is_active) fire identity.status_set; DELETE /api/v1/identities/{id} removes the identity from that Environment and fires identity.env_membership.removed, never identity.erased, which only the Account-level erase action fires. - Account members and sessions: account_member.added (resource_type: "account_member") carries email and invite_id; account_member.removed carries no metadata; session.all_revoked (resource_type: "identity") carries revoked_count and reason. Full reference: https://canopy-io.com/docs/webhooks/event-types ## Documentation - [Canopy Documentation](https://canopy-io.com/docs): Guides, concepts, and the full API reference for Canopy: hierarchical identity and access management for B2B SaaS. Start with the quick start guide. - [Account Structure | Canopy Docs](https://canopy-io.com/docs/account-structure): How Accounts, Applications, and Environments fit together in Canopy, and which part of your access-control configuration lives at each of those levels. - [Environments | Canopy Docs](https://canopy-io.com/docs/account-structure/environments): How Environments isolate access-control configuration inside an Application: a separate permission catalog, roles, and hierarchy in each one. - [AI Quickstart | Canopy Docs](https://canopy-io.com/docs/ai-quickstart): Point an AI coding agent at Canopy's machine-readable surfaces (llms.txt, OpenAPI, sitemap), then drive the API from empty Environment to a passing check. - [API Keys | Canopy Docs](https://canopy-io.com/docs/api-keys): Authenticate server-to-server requests with scoped, Environment-bound API keys: how to create them, what they reach, and how to rotate them. - [API Reference | Canopy Docs](https://canopy-io.com/docs/api-reference): Every Canopy endpoint across the public API, identity, OAuth, SCIM, and portal surfaces, with parameters, response shapes, errors, and examples. - [Assign Roles | Canopy Docs](https://canopy-io.com/docs/assign-roles): Give identities the access a role bundles, one at a time or many at once, scoped to exactly the part of the hierarchy where it should apply. - [Assign Roles Quickstart | Canopy Docs](https://canopy-io.com/docs/assign-roles/quick-start): Assign roles to identities end to end: a single grant first, then the bulk path for onboarding many people into the same part of your hierarchy. - [Audit Log | Canopy Docs](https://canopy-io.com/docs/audit-log): An immutable, queryable record of every meaningful change in your Canopy Account: who did what, when, and to which resource it happened. - [Authentication | Canopy Docs](https://canopy-io.com/docs/authentication): How identities sign in to Canopy. Two paths lead into the same platform, so pick the one that matches how much of the login UI your application owns. - [Backend Proxy (BFF) Integration | Canopy Docs](https://canopy-io.com/docs/authentication/bff-proxy): Proxy Direct API auth through your own backend so the refresh cookie is first-party, for apps that cannot delegate a subdomain, and for native mobile. - [Direct API Authentication | Canopy Docs](https://canopy-io.com/docs/authentication/direct-api): Own the login UI and call the identity-auth API directly, including pointing a custom auth domain at Canopy so the refresh cookie stays first-party. - [Hosted Login | Canopy Docs](https://canopy-io.com/docs/authentication/hosted-login): Let Canopy host the login UI. Your app redirects to /oauth/authorize, the user signs in on Canopy's page, and your callback receives the auth code. - [Native & Mobile Apps | Canopy Docs](https://canopy-io.com/docs/authentication/native-apps): Sign users in from an installed iOS or Android app: register a native publishable key and store the refresh token in the OS keychain, not a cookie. - [Authorization Caching | Canopy Docs](https://canopy-io.com/docs/authorization-caching): How a permission check is answered inside your own process, what the SDK caches to do it, and the window before an access change takes effect. - [Console and Workspace | Canopy Docs](https://canopy-io.com/docs/console-and-workspace): Canopy has two applications you sign in to: the Developer Console and the Admin Workspace. Which one you land in depends on what you administer. - [Hierarchy | Canopy Docs](https://canopy-io.com/docs/hierarchy): Typed nodes, parent-child rules, and role assignments that cascade down the tree, inside an Environment or beneath each organization. - [Identities | Canopy Docs](https://canopy-io.com/docs/identities): The end users of your application: Account-level rows holding credentials and federation hints, granted access into specific Applications. - [Create Identities via API | Canopy Docs](https://canopy-io.com/docs/identities/api-create): Server-to-server identity creation through the public Canopy API, with no email and no acceptance ceremony; the row exists once the call returns. - [Invite Identities via API | Canopy Docs](https://canopy-io.com/docs/identities/api-invite): Programmatic invitations: your backend issues the invite and Canopy sends the email, or hands the link back so you can deliver it yourself. - [Create an Identity from the Console | Canopy](https://canopy-io.com/docs/identities/dashboard-create): Admin-driven direct creation: the identity row is written immediately, with an optional starting password and no email confirmation step at all. - [CSV Identity Import | Canopy Docs](https://canopy-io.com/docs/identities/dashboard-csv-import): A six-step wizard that takes a CSV of identities and either invites them by email, creates Environment-scoped rows, or pre-stages Account records. - [Invite an Identity from the Console | Canopy](https://canopy-io.com/docs/identities/dashboard-invite): The admin-driven invite flow: Canopy sends the email, and the identity row is created when the recipient follows the link and sets their password. - [Identities Quickstart | Canopy Docs](https://canopy-io.com/docs/identities/quick-start): Invite your first identity end to end: send the invitation, watch the identity row appear on acceptance, and confirm the access it received. - [Identity Scope Model | Canopy Docs](https://canopy-io.com/docs/identities/scope-model): How a person exists across three scopes (Account, Application, and Environment), and what invited, joined, and assigned each mean in Canopy. - [Introduction | Canopy Docs](https://canopy-io.com/docs/introduction): Authorization that matches how organizations actually work, and why flat RBAC breaks as soon as your customers have regions, departments, and teams. - [Keys & Credentials | Canopy Docs](https://canopy-io.com/docs/keys-and-credentials): Every credential Canopy issues, which integration scenario needs which, and exactly what belongs in your application's configuration for each one. - [Multi-Factor Authentication | Canopy Docs](https://canopy-io.com/docs/multi-factor): Four factor types (authenticator app, passkeys, email codes, recovery codes) enforced per Environment and tightened per organization. - [OAuth Clients | Canopy Docs](https://canopy-io.com/docs/oauth-clients): Register an OAuth client so your application can request tokens through Hosted Login or any OIDC-compatible flow, with PKCE required throughout. - [Organizations | Canopy Docs](https://canopy-io.com/docs/organizations): Multi-tenant access control: an organization per customer, a role per membership, per-organization MFA and SSO policy, and org context in every token. - [Permissions | Canopy Docs](https://canopy-io.com/docs/permissions): Define the actions your application supports as permission keys, and let Canopy store, enforce, and evaluate access to them for every identity. - [Permissions Quickstart | Canopy Docs](https://canopy-io.com/docs/permissions/quick-start): Define your permission vocabulary end to end: create the keys your application checks for, then confirm them with a live permission evaluation. - [Places | Canopy Docs](https://canopy-io.com/docs/places): A place is a region, branch, or team in your organization. Places are how Canopy knows a manager administers one branch and not the one beside it. - [Quick Start Guide | Canopy Docs](https://canopy-io.com/docs/quick-start): Pick a concept and walk through it end to end. Each guide covers one Canopy feature from first principles to a working example you can run yourself. - [Roles | Canopy Docs](https://canopy-io.com/docs/roles): Group permissions into roles and assign them to identities, so access is granted by job function rather than one permission key at a time. - [Roles Quickstart | Canopy Docs](https://canopy-io.com/docs/roles/quick-start): Create your first Canopy role end to end: bundle a set of permissions, name it, and confirm exactly what an identity holding that role can do. - [SDKs and Libraries | Canopy Docs](https://canopy-io.com/docs/sdks-and-libraries): The official Canopy SDKs for Node.js/TypeScript and NestJS, what they handle that hand-rolled HTTP misses, and how to generate a client for any language. - [Single Sign-On (SSO) | Canopy Docs](https://canopy-io.com/docs/sso): Let admins and end users authenticate through a corporate identity provider over SAML 2.0 or OIDC, configured per Environment and bound per organization. - [SSO Quick Start | Canopy Docs](https://canopy-io.com/docs/sso/quick-start): Stand up Single Sign-On end to end: gather the prerequisites, then follow the guide for the surface you are configuring, admin or end user. - [Webhooks | Canopy Docs](https://canopy-io.com/docs/webhooks): Subscribe to events in your Environment and receive HTTPS callbacks the moment they happen, with signed payloads and automatic retries. - [Webhook Event Types | Canopy Docs](https://canopy-io.com/docs/webhooks/event-types): Every event you can subscribe a Canopy webhook to, grouped by scope, with the payload each one delivers and the action that fires it. - [What administrators can do | Canopy Docs](https://canopy-io.com/docs/what-administrators-can-do): Every administrator capability in the Admin Workspace: what each one allows, where it can be granted, and the single capability an owner cannot delegate. - [Where signing in takes you | Canopy Docs](https://canopy-io.com/docs/where-sign-in-takes-you): One sign-in form, two applications. What you hold decides whether you reach the Developer Console, the Admin Workspace, or a choice between them. - [Assigning access | Canopy Docs](https://canopy-io.com/docs/workspace-access): How an administrator gives someone a role at a place, which roles they are permitted to hand out, and how moving or removing an assignment works. - [Account settings | Canopy Docs](https://canopy-io.com/docs/workspace-account-settings): The account's own details in the Admin Workspace, what an administrator can change there, and why almost everything else lives somewhere other than here. - [Activity | Canopy Docs](https://canopy-io.com/docs/workspace-activity): The activity log in the Admin Workspace: what it records, how it is narrowed to the places you administer, how long it is kept, and how to export it. - [Administrators and roles | Canopy Docs](https://canopy-io.com/docs/workspace-administrators): Who holds authority in a Canopy account: the administrator roster, what an administrator role is, how one is composed, and how it is granted to a person. - [Billing | Canopy Docs](https://canopy-io.com/docs/workspace-billing): The subscription behind a Canopy account: what the billing page shows, who may change the plan or the card on file, and the limits a growing account meets. - [Danger zone | Canopy Docs](https://canopy-io.com/docs/workspace-danger-zone): Deleting a Canopy account: exactly what it removes, what it asks for first, and why it is the one capability an owner cannot delegate to anybody. - [Environments for administrators | Canopy Docs](https://canopy-io.com/docs/workspace-environments): Why the same organization exists more than once in Canopy, why an administrator's authority stops at one Environment, and what switching between them changes. - [Administering identities | Canopy Docs](https://canopy-io.com/docs/workspace-identities): The people you administer in the Admin Workspace: who is in your part of the organization, the roles they hold, and what deactivating one actually does. - [Invitations | Canopy Docs](https://canopy-io.com/docs/workspace-invitations): Invite someone into a place you administer, and what happens next: what they receive, how long it lasts, and what resending or revoking changes. - [Roles for administrators | Canopy Docs](https://canopy-io.com/docs/workspace-roles): What a role is in Canopy, how a role held by one of your end users differs from an administrator role held by your staff, and who creates each kind. - [Your responsibility | Canopy Docs](https://canopy-io.com/docs/your-responsibility): The Admin Workspace opens on one screen stating what you administer and what you may do there, including the authority you do not hold. How to read it. ## API specifications - [Canopy Public API (OpenAPI 3 JSON)](https://canopy-io.com/openapi/api.json): The public machine-to-machine API (/api/v1/*) — identities, permissions, roles, assignments, hierarchy nodes, webhooks, audit events. Authenticate with an API key in the X-API-Key header. - [Canopy Portal API (OpenAPI 3 JSON)](https://canopy-io.com/openapi/portal.json): The API behind Canopy's signed-in applications (/portal/v1/*) plus identity authentication (/v1/identity/auth/*). JWT bearer authentication. - [Canopy OAuth 2.0 / OIDC (OpenAPI 3 JSON)](https://canopy-io.com/openapi/oauth.json): OAuth 2.0 / OIDC endpoints (/oauth/*, /.well-known/*) — authorization code with PKCE, token exchange, UserInfo, and discovery. Responses follow the OAuth2/OIDC specifications, not the Canopy envelope. - [Canopy SCIM 2.0 (OpenAPI 3 JSON)](https://canopy-io.com/openapi/scim.json): SCIM 2.0 directory sync (/scim/v2/*) for IdP connectors — RFC 7643/7644 schemas and envelopes, per-Environment bearer token. - [Specification index](https://canopy-io.com/openapi): JSON index listing every published OpenAPI document with its URL. ## Machine-readable indexes - [llms-full.txt](https://canopy-io.com/llms-full.txt): This index plus the full endpoint catalog, authentication and response-envelope reference, and every webhook event type. - [sitemap.xml](https://canopy-io.com/sitemap.xml): Every page on this site, including one URL per documented API operation.