SSO Management API is a REST API for managing SSO Server. With Management API it is possible to automate management tasks that previously were only possible with the web browser based Management Console.

To operate REST API an OAuth2 access token is needed. To get the access token an OAuth2 Resource Server configured as Ubisecure agent needs to be activated and configured in the Ubisecure SSO server.

SSO Management REST API calls need to have the access token in the bearer authorization header.

Please check OAuth 2.0 API - SSO page for more information about OAuth API.
Please check SSO Management API Configuration Guide for information how to configure and start using SSO API.

Ubisecure SSO REST API can be used to create:

• Sites

• Applications

  • Update application metadata

• Groups

• Authentication Policies

  • PolicyItem

• Links between objects

• Users

• Mappings

• Keys - see Management API - SSO#Using Management API to manage keys for API calls and SSO key rotation for further details

The URI format of Ubisecure SSO Management API is based on the following principles:

• Path starts with object type

  • Example: /site

• After object type, the path to the object

  • Example: /site/acmecorporation/

  • Example: /group/acmecorporation/users

  • Example: /application/acmecorporation/salesforce

  • Example: /policy/acmecorporation/policy

URI can contain a terminator ($link, $attribute) after the path to an object. This is described in more detail below in section Terminators.

To get more information on how the attributes and linkings are connected, there are three sub-pages explaining them in more detail.

• Management API Services - SSO

• Management API inbound integrations - SSO

• Management API application integrations - SSO

You can also see a overview of the schema in our example site https://manage.example.ubidemo.com/sso-api-sample/schema/models

GET is used to query data.

POST writes a new object.

PUT writes object (update existing object)

DELETE is used to delete object or remove object linking.

Is used as part of the URI to link objects to other objects, and to list/query objects linked to other objects.
After $link the URI contains the path to another object as setter for the scope for the listing of related objects.
Section Response Messages describes in detail how links are used.

Is used to query or update object attribute values. Version Ubisecure SSO 7.5.0 contains $attribute setting for application metadata – other $attribute settings will be available in future versions.

Ubisecure SSO Management REST API uses following HTTP response status codes:

• HTTP Response Status 200 (GET, DELETE)

  • Operation was successful. Returned when no error in GET, and after DELETE.

• HTTP Response Status 201 (Create, Update) (POST, PUT)

  • Resource created or updated successfully.

• HTTP Response Status 400 (Bad Request)

  • The request was invalid.

• HTTP Response Status 401 (Not Authorized)

  • Invalid credentials

Client can choose the result to be plain text, JSON or XML.This is set on the HTTP accept – header by setting the media type to Accept: text/plain; or Accept: application/json; or Accept: application/xml.

POST /site/AcmeCorporation

Response:

• Plain text: site /site/SiteTest

• JSON: {"type":"site","id":"/site/SiteTest","attributes":{"name":"SiteTest"}}

• XML: <object type="site" id="/site/SiteTest"><attribute name="name" value="SiteTest"/></object>

For successful GET operations the API returns HTTP status code 200. Response content contains object type, id (path) and attributes.
Format of query to Ubisecure SSO REST API is as described in the section URI Format. Section Response Messages describes in more detail the querying of object links.

Example GET-query and response