samlAPI-Referenz
PUT
/v2/samlSAML-Provider ändern
Ändert Provider-Konfiguration, Login-Geltungsbereich, Feldmapping und Teilnehmer-Tags. Aktivierung prüft Metadaten und Pflichtmapping für first_name, last_name, email sowie bedingt acl. offer_filter_tags müssen Teil der normalen Provider-tags sein. regenerate_certificate=true/1/"1" ersetzt das aktive SP-Zertifikat; das erfordert einen abgeglichenen IdP. Die öffentliche Ziel-ID muss als id im JSON-Request angegeben werden.
Operation-ID put_v2_saml
01
Vertrag & Verhalten
- Dokumentationsstand
- reviewed
- Ändert Zustand
- Ja
- Als readOnly markiert
- Nein
- Für Automation markiert
- Nein
02
Authentifizierung
Eine der folgenden Alternativen muss erfüllt sein (ODER). Innerhalb jeder Alternative werden alle angegebenen Schemas gemeinsam benötigt (UND).
Alternative 1
bearerAuthhttp · bearerExisting edoobox v2 access token. Never substitute API key/secret headers.
Format: JWT
Security-Schema als JSON
{
"type": "http",
"scheme": "bearer",
"bearerFormat": "JWT",
"description": "Existing edoobox v2 access token. Never substitute API key/secret headers."
}accountContextapiKeySelected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.
header: edid
Security-Schema als JSON
{
"type": "apiKey",
"in": "header",
"name": "edid",
"description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
}Alternative 2
sessionCookieapiKeyExisting browser login session, with the same permission checks as Bearer authentication.
cookie: _edlogin
Security-Schema als JSON
{
"type": "apiKey",
"in": "cookie",
"name": "_edlogin",
"description": "Existing browser login session, with the same permission checks as Bearer authentication."
}accountContextapiKeySelected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.
header: edid
Security-Schema als JSON
{
"type": "apiKey",
"in": "header",
"name": "edid",
"description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
}03
Parameter
Header
languageoptionalAccount language code, where the resource supports setLanguage().
string
Schema-Beispiel
"de"Vollständiges Schema als JSON
{
"type": "string",
"examples": [
"de"
]
}X-Edoobox-If-RevisionoptionalOptional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review.
string
- pattern
"^[a-f0-9]{32}$"
Schema-Beispiel
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"Vollständiges Schema als JSON
{
"type": "string",
"pattern": "^[a-f0-9]{32}$",
"examples": [
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
]
}04
Request Body
erforderlichapplication/json
object
data object erforderlich Source-declared fields; action-specific and account validation still apply.
- minProperties
1
id kein Wert zulässig status string | number | boolean | null | array | object Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.
Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.
Schema-Beispiel
falseFeld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 40,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 224,
"reason": "Create forbids activating before setup and forces initial disabled status.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1274,
"reason": "Actual activation hook: strict false short circuit, settings/URL and required mapping checks.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Provider config depends on stored certificate/mapping and may refresh metadata XML in real runtime.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1357,
"reason": "Metadata refresh delegates parsing and may fetch XML during real runtime; not invoked by this source review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 85,
"reason": "Login URL wrapper delegates to OneLogin auth login with stay=true.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Required mapping keys are explicit.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 246,
"reason": "Followed injectSettings/getSettings: build SP/IdP settings and instantiate OneLogin Auth, with signing and stored certificate settings.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 115,
"reason": "Followed service-provider settings construction used for activation.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 174,
"reason": "Installed OneLogin Auth delegates validation to its Settings constructor.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 542,
"reason": "Installed OneLogin login builds the SAML request and a redirect URL; this is not a completed external provider handshake.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}permission string Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.
- pattern
"^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$"
Schema-Beispiel
"permission_012345abcdef_123456"Feld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 50
}provider_name Typ nicht eingeschränkt bei Anlage erforderlich Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
Maximal gespeicherte Länge: 150. Diese Speichergrenze ist keine maxLength-Validierung der Eingabe.
The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.
Schema-Beispiel
"Example"Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-maxStoredLength": 150,
"x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
"x-edoobox-requiredOnCreate": true,
"x-edoobox-sourceLine": 63
}remote_xml_url kein Wert zulässig remote_xml_content Typ nicht eingeschränkt PUT getter returns strict false; generic update throws ED80100 for remote_xml_content. This is not a metadata upload field.
Schema-Regel not
Typ nicht eingeschränkt
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "reviewed-not-writable",
"x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 90,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 236,
"reason": "Creation reads remote_xml_file or remote_xml_url, validates/parses XML and assigns escaped metadata content.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 232,
"reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
"line": 115,
"reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
"sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}login_service_url kein Wert zulässig logout_service_url kein Wert zulässig field_maping Typ nicht eingeschränkt Replaces field mappings while keeping provider idp metadata. Empty/false-like mapping is rejected. Duplicate first_name,last_name,email or acl targets are rejected; additional user-field duplicates are not checked by this loop.
Schema-Beispiel
[
{
"name": "Synthetic given name",
"description": "Synthetic field",
"attr": "givenName",
"field": "first_name",
"only_user": false
}
]anyOf · Mindestens eine Variante muss passen
Variante 1 array - minItems
1
Array-Elemente
object
Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false.
name string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}description string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}attr string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}field string | number | boolean | null Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
}only_user string | number | boolean | null | array | object PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.
Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Variante 2 object - minProperties
1
Schema für zusätzliche Felder
object
Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false.
name string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}description string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}attr string | number | boolean | null | array | object aP normalizes strings and replaces every non-string JSON value with empty string.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
aP normalizes strings and replaces every non-string JSON value with empty string.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string."
}field string | number | boolean | null Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
}only_user string | number | boolean | null | array | object PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.
Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 123,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2861,
"reason": "Actual PUT mapping loop, truthiness requirement, duplicate detection and full replacement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 480,
"reason": "Followed target normalizer and additional-user-field classifier.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Followed base required mapping keys.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 319,
"reason": "Create mapping starts with idp metadata and empty field list.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 389,
"reason": "Create mapping is derived from offered/default claims and stored, overwriting submitted batch value.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Followed getProviderData: existing provider/certificate lookup and mapping metadata; refresh may load remote XML in actual runtime, never during this review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}allow_migration_user Typ nicht eingeschränkt Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.
Schema-Beispiel
falseFeld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 135,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction."
}allow_permission_acl Typ nicht eingeschränkt Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.
Schema-Beispiel
falseFeld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 144,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction."
}login_scope Typ nicht eingeschränkt Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.
Kanonischer Typ nach Normalisierung: string. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.
anyOf · Mindestens eine Variante muss passen
Variante 1 string - pattern
"^[ \\t\\n\\r\\x00\\x0B]*(?:[bB][oO][tT][hH]|[aA][dD][mM][iI][nN]|[uU][sS][eE][rR])?[ \\t\\n\\r\\x00\\x0B]*$"
Variante 2 number | boolean | null | array | object Feld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
"x-edoobox-recognizedValues": [
"both",
"admin",
"user"
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 153,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 22,
"reason": "Followed validateProvidedLoginScope and provider normalizer.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 197,
"reason": "Before-insert sets scope and applies dependent permission requirement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2840,
"reason": "Actual PUT hook delegates to scope validator.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 42,
"reason": "Allowed normalized scopes and default both; output normalizer.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}name_id_format string Exact OneLogin NameID format; input validator strictly rejects every other value. No trimming/case folding precedes validation.
Erlaubte Werte
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified""urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress""urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"Schema-Beispiel
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"Feld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 172,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2770,
"reason": "PUT checks exact NameID allowed values before aP storage.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 14,
"reason": "Strict allowed formats and separate response fallback.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Constants.php",
"line": 26,
"reason": "Followed installed dependency constants to actual standard URI strings.",
"sha256": "a7f6ab35d1209e34d499662ae1f8f5bedf0ae6f08325388e8b186ea85f6c236d"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}auth_request_signed string | number | boolean | null | array | object PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.
Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.
Schema-Beispiel
trueFeld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 190,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2801,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}disable_third_party_cookie string | number | boolean | null | array | object PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.
Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.
Schema-Beispiel
trueFeld-Metadaten aus der Spezifikation
{
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 200,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2810,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}regenerate_certificate Typ nicht eingeschränkt writeOnly PUT command accepts only true, integer 1 or string 1 by strict in_array. Rotates service-provider certificate; false is rejected.
Erlaubte Werte
true1"1"Schema-Beispiel
trueFeld-Metadaten aus der Spezifikation
{
"x-edoobox-validation": "PHP strict in_array(value, [true, 1, string 1], true); numeric token 1.0 decodes to float and is rejected.",
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 210,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2819,
"reason": "Strict command allowlist and generation/storage delegation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1087,
"reason": "Followed certificate payload generation and replace-active storage behavior.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1077,
"reason": "Followed certificate host resolution: base URL host is required; a bad host throws RuntimeException.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
}enforce_offer_tags Typ nicht eingeschränkt Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.
Schema-Beispiel
falseFeld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 222,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction."
}offer_tags_additive Typ nicht eingeschränkt Kanonischer Typ nach Normalisierung: boolean. Dies ist keine zusätzliche Einschränkung des Eingabetyps.
PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.
Schema-Beispiel
falseFeld-Metadaten aus der Spezifikation
{
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 231,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction."
}tags Typ nicht eingeschränkt Null or [] clears provider tags. Only participant/normal tags are supported. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.
anyOf · Mindestens eine Variante muss passen
Variante 1 array Array-Elemente
object
tag string erforderlich Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook.
- pattern
"^tag_[a-f0-9]{12}_-?[0-9]+$"
type string Optional; missing type defaults to normal. ASCII case is normalized before validation.
- pattern
"^[nN][oO][rR][mM][aA][lL]$"
Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Variante 2 null Feld-Metadaten aus der Spezifikation
{
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2610,
"reason": "Array or null accepted; each item must contain a public tag ID.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2630,
"reason": "Missing type defaults to normal; supplied type is lowercased before validation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 256,
"reason": "Response is an array of {tag,type:normal}.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
}offer_filter_tags Typ nicht eingeschränkt Null or [] clears offer-filter tags. Every filter tag must also be a provider tag. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.
anyOf · Mindestens eine Variante muss passen
Variante 1 array Array-Elemente
string
Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook.
- pattern
"^tag_[a-f0-9]{12}_-?[0-9]+$"
Variante 2 null Feld-Metadaten aus der Spezifikation
{
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2653,
"reason": "Array or null accepted; items decode as public tag IDs.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2678,
"reason": "Filter tags must be contained in provider tags.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 298,
"reason": "Response is an array of public tag IDs.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
}date_valid kein Wert zulässig date_create kein Wert zulässig Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Feld-Metadaten aus der Spezifikation
{
"x-edoobox-readOnlyFields": [
"remote_xml_url",
"login_service_url",
"logout_service_url",
"date_valid",
"date_create"
],
"x-edoobox-clientRestriction": "Read-only fields are forbidden by this client contract to prevent silently ignored writes; the legacy API itself skips them. Explicit source-marked update context fields remain accepted for hook validation without changing their immutable database columns."
}id string erforderlich Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.
- pattern
"^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$"
Schema-Beispiel
"saml_012345abcdef_123456"Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Vollständiges Schema als JSON
{
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"id": false,
"status": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.",
"description": "Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.",
"examples": [
false
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 40,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 224,
"reason": "Create forbids activating before setup and forces initial disabled status.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1274,
"reason": "Actual activation hook: strict false short circuit, settings/URL and required mapping checks.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Provider config depends on stored certificate/mapping and may refresh metadata XML in real runtime.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1357,
"reason": "Metadata refresh delegates parsing and may fetch XML during real runtime; not invoked by this source review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 85,
"reason": "Login URL wrapper delegates to OneLogin auth login with stay=true.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Required mapping keys are explicit.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 246,
"reason": "Followed injectSettings/getSettings: build SP/IdP settings and instantiate OneLogin Auth, with signing and stored certificate settings.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 115,
"reason": "Followed service-provider settings construction used for activation.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 174,
"reason": "Installed OneLogin Auth delegates validation to its Settings constructor.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 542,
"reason": "Installed OneLogin login builds the SAML request and a redirect URL; this is not a completed external provider handshake.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"permission": {
"type": "string",
"pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
"description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
"examples": [
"permission_012345abcdef_123456"
],
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 50
},
"provider_name": {
"x-edoobox-canonicalType": "string",
"x-edoobox-maxStoredLength": 150,
"x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
"examples": [
"Example"
],
"x-edoobox-requiredOnCreate": true,
"x-edoobox-sourceLine": 63
},
"remote_xml_url": false,
"remote_xml_content": {
"not": {},
"description": "PUT getter returns strict false; generic update throws ED80100 for remote_xml_content. This is not a metadata upload field.",
"x-edoobox-schemaStatus": "reviewed-not-writable",
"x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 90,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 236,
"reason": "Creation reads remote_xml_file or remote_xml_url, validates/parses XML and assigns escaped metadata content.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 232,
"reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
"line": 115,
"reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
"sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"login_service_url": false,
"logout_service_url": false,
"field_maping": {
"description": "Replaces field mappings while keeping provider idp metadata. Empty/false-like mapping is rejected. Duplicate first_name,last_name,email or acl targets are rejected; additional user-field duplicates are not checked by this loop.",
"examples": [
[
{
"name": "Synthetic given name",
"description": "Synthetic field",
"attr": "givenName",
"field": "first_name",
"only_user": false
}
]
],
"x-edoobox-schemaStatus": "source-reviewed",
"anyOf": [
{
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"properties": {
"name": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"description": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"attr": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"field": {
"type": [
"string",
"number",
"boolean",
"null"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"description": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
},
"only_user": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.",
"description": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}
},
"additionalProperties": true,
"description": "Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false."
}
},
{
"type": "object",
"minProperties": 1,
"additionalProperties": {
"type": "object",
"properties": {
"name": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"description": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"attr": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"field": {
"type": [
"string",
"number",
"boolean",
"null"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"description": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
},
"only_user": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.",
"description": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}
},
"additionalProperties": true,
"description": "Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false."
}
}
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 123,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2861,
"reason": "Actual PUT mapping loop, truthiness requirement, duplicate detection and full replacement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 480,
"reason": "Followed target normalizer and additional-user-field classifier.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Followed base required mapping keys.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 319,
"reason": "Create mapping starts with idp metadata and empty field list.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 389,
"reason": "Create mapping is derived from offered/default claims and stored, overwriting submitted batch value.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Followed getProviderData: existing provider/certificate lookup and mapping metadata; refresh may load remote XML in actual runtime, never during this review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"allow_migration_user": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 135,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"allow_permission_acl": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 144,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"login_scope": {
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
"description": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
"x-edoobox-recognizedValues": [
"both",
"admin",
"user"
],
"anyOf": [
{
"type": "string",
"pattern": "^[ \\t\\n\\r\\x00\\x0B]*(?:[bB][oO][tT][hH]|[aA][dD][mM][iI][nN]|[uU][sS][eE][rR])?[ \\t\\n\\r\\x00\\x0B]*$"
},
{
"type": [
"number",
"boolean",
"null",
"array",
"object"
]
}
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 153,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 22,
"reason": "Followed validateProvidedLoginScope and provider normalizer.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 197,
"reason": "Before-insert sets scope and applies dependent permission requirement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2840,
"reason": "Actual PUT hook delegates to scope validator.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 42,
"reason": "Allowed normalized scopes and default both; output normalizer.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
],
"description": "Exact OneLogin NameID format; input validator strictly rejects every other value. No trimming/case folding precedes validation.",
"examples": [
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
],
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 172,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2770,
"reason": "PUT checks exact NameID allowed values before aP storage.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 14,
"reason": "Strict allowed formats and separate response fallback.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Constants.php",
"line": 26,
"reason": "Followed installed dependency constants to actual standard URI strings.",
"sha256": "a7f6ab35d1209e34d499662ae1f8f5bedf0ae6f08325388e8b186ea85f6c236d"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"auth_request_signed": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"description": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"examples": [
true
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 190,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2801,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"disable_third_party_cookie": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"description": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"examples": [
true
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 200,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2810,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"regenerate_certificate": {
"enum": [
true,
1,
"1"
],
"description": "PUT command accepts only true, integer 1 or string 1 by strict in_array. Rotates service-provider certificate; false is rejected.",
"writeOnly": true,
"x-edoobox-validation": "PHP strict in_array(value, [true, 1, string 1], true); numeric token 1.0 decodes to float and is rejected.",
"examples": [
true
],
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 210,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2819,
"reason": "Strict command allowlist and generation/storage delegation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1087,
"reason": "Followed certificate payload generation and replace-active storage behavior.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1077,
"reason": "Followed certificate host resolution: base URL host is required; a bad host throws RuntimeException.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"enforce_offer_tags": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 222,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"offer_tags_additive": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 231,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"tags": {
"anyOf": [
{
"type": "array",
"items": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
"description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
},
"type": {
"type": "string",
"pattern": "^[nN][oO][rR][mM][aA][lL]$",
"description": "Optional; missing type defaults to normal. ASCII case is normalized before validation."
}
},
"additionalProperties": true,
"required": [
"tag"
]
}
},
{
"type": "null"
}
],
"description": "Null or [] clears provider tags. Only participant/normal tags are supported. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2610,
"reason": "Array or null accepted; each item must contain a public tag ID.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2630,
"reason": "Missing type defaults to normal; supplied type is lowercased before validation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 256,
"reason": "Response is an array of {tag,type:normal}.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
},
"offer_filter_tags": {
"anyOf": [
{
"type": "array",
"items": {
"type": "string",
"pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
"description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
}
},
{
"type": "null"
}
],
"description": "Null or [] clears offer-filter tags. Every filter tag must also be a provider tag. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2653,
"reason": "Array or null accepted; items decode as public tag IDs.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2678,
"reason": "Filter tags must be contained in provider tags.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 298,
"reason": "Response is an array of public tag IDs.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
},
"date_valid": false,
"date_create": false
},
"additionalProperties": true,
"description": "Source-declared fields; action-specific and account validation still apply.",
"minProperties": 1,
"x-edoobox-readOnlyFields": [
"remote_xml_url",
"login_service_url",
"logout_service_url",
"date_valid",
"date_create"
],
"x-edoobox-clientRestriction": "Read-only fields are forbidden by this client contract to prevent silently ignored writes; the legacy API itself skips them. Explicit source-marked update context fields remain accepted for hook validation without changing their immutable database columns."
},
"id": {
"type": "string",
"pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
"description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
"examples": [
"saml_012345abcdef_123456"
]
}
},
"additionalProperties": true,
"required": [
"data",
"id"
]
}SAML-Provider ändern
{
"id": "saml_012345abcdef_123456",
"data": {
"provider_name": "Beispiel-IDP"
}
}05
Antworten
11HTTP-Status und Antwortinhalt gemeinsam auswerten. In dieser API können auch Antworten mit HTTP 200 einen Fehler enthalten.
200application/json
Response; inspect error and success as legacy failures may also use HTTP 200.
Response Header
X-Edoobox-Revision
Rotated account revision supplied for the next action in one reviewed sequence.
string
- pattern
"^[a-f0-9]{32}$"
Vollständiges Schema als JSON
{
"type": "string",
"pattern": "^[a-f0-9]{32}$"
}application/json
object
success boolean error boolean | string error_code string data Typ nicht eingeschränkt Action-dependent data; deliberately unconstrained until a complete field contract is established.
type string Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Vollständiges Schema als JSON
{
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": [
"boolean",
"string"
]
},
"error_code": {
"type": "string"
},
"data": {
"description": "Action-dependent data; deliberately unconstrained until a complete field contract is established."
},
"type": {
"type": "string"
}
},
"additionalProperties": true
}Beispiel
{
"success": true,
"error": false,
"data": {
"id": "saml_012345abcdef_123456"
}
}400application/json
Invalid request.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED40006"
}401application/json
Missing/expired token, missing account context, account paused or model-specific authorization failure.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED40103"
}402application/json
Missing/invalid action data or subscription/operation restriction.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED80100"
}403application/json
Permission denied. Browser CORS rejection may have an empty body.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED40340"
}404application/json
Unknown resource/action or unsupported method.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED80019"
}409application/json
The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.
application/json
object
Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Vollständiges Schema als JSON
{
"type": "object",
"additionalProperties": true
}Beispiel
{
"error": "ED40901",
"error_code": "mutation_revision_conflict"
}422application/json
Validation failed.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED80020"
}429application/json
Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.
Response Header
Retry-After
Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.
string
Schema-Beispiel
"30"Vollständiges Schema als JSON
{
"type": "string",
"examples": [
"30"
]
}application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED42902"
}502application/json
Server-side operation failed.
application/json
Typ nicht eingeschränkt
Kein Schema angegeben. Daraus lässt sich kein vollständiger Feldvertrag ableiten.
Beispiel
{
"success": false,
"error": "ED50201"
}503application/json
The account mutation lock or revision store is unavailable. No unprotected fallback is executed.
Response Header
Retry-After
integer
Fester Wert: 1
Vollständiges Schema als JSON
{
"type": "integer",
"const": 1
}application/json
object
Zusätzliche, hier nicht aufgeführte Felder sind erlaubt.
Vollständiges Schema als JSON
{
"type": "object",
"additionalProperties": true
}Beispiel
{
"error": "ED50301",
"error_code": "mutation_revision_busy"
}06
Quelle & Metadaten
Quelle laut Spezifikation
application/models/v2/Saml.php:373updateSaml()Diese Angaben stammen unverändert aus der gelieferten OpenAPI-Datei. Zusätzliche Freigaben, Vorbedingungen, sensible Felder und Hinweise stehen in den Erweiterungen.
x-edoobox-mutates-state
truex-edoobox-runtimeMutationGuard
truex-edoobox-documentationReview
{
"file": "docs/openapi/operation-contracts/05-auth.json",
"notes": []
}x-edoobox-source
{
"file": "application/models/v2/Saml.php",
"method": "updateSaml",
"line": 373
}x-edoobox-documentationStatus
"reviewed"x-edoobox-readOnly
falsex-edoobox-safeForAutomation
falsex-edoobox-permission
{
"resource": "saml",
"short": "saml",
"checkedByDispatcher": true,
"levels": [
3,
4
],
"description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
}Vollständige Operation als JSON
{
"operationId": "put_v2_saml",
"summary": "SAML-Provider ändern",
"description": "Ändert Provider-Konfiguration, Login-Geltungsbereich, Feldmapping und Teilnehmer-Tags. Aktivierung prüft Metadaten und Pflichtmapping für first_name, last_name, email sowie bedingt acl. offer_filter_tags müssen Teil der normalen Provider-tags sein. regenerate_certificate=true/1/\"1\" ersetzt das aktive SP-Zertifikat; das erfordert einen abgeglichenen IdP. Die öffentliche Ziel-ID muss als id im JSON-Request angegeben werden.",
"tags": [
"saml"
],
"security": [
{
"bearerAuth": [],
"accountContext": []
},
{
"sessionCookie": [],
"accountContext": []
}
],
"parameters": [
{
"name": "language",
"in": "header",
"required": false,
"description": "Account language code, where the resource supports setLanguage().",
"schema": {
"type": "string",
"examples": [
"de"
]
}
},
{
"name": "X-Edoobox-If-Revision",
"in": "header",
"required": false,
"schema": {
"type": "string",
"pattern": "^[a-f0-9]{32}$",
"examples": [
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
]
},
"description": "Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review."
}
],
"responses": {
"200": {
"description": "Response; inspect error and success as legacy failures may also use HTTP 200.",
"content": {
"application/json": {
"example": {
"success": true,
"error": false,
"data": {
"id": "saml_012345abcdef_123456"
}
},
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": [
"boolean",
"string"
]
},
"error_code": {
"type": "string"
},
"data": {
"description": "Action-dependent data; deliberately unconstrained until a complete field contract is established."
},
"type": {
"type": "string"
}
},
"additionalProperties": true
}
}
},
"headers": {
"X-Edoobox-Revision": {
"schema": {
"type": "string",
"pattern": "^[a-f0-9]{32}$"
},
"description": "Rotated account revision supplied for the next action in one reviewed sequence."
}
}
},
"400": {
"description": "Invalid request.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED40006"
}
}
}
},
"401": {
"description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED40103"
}
}
}
},
"402": {
"description": "Missing/invalid action data or subscription/operation restriction.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED80100"
}
}
}
},
"403": {
"description": "Permission denied. Browser CORS rejection may have an empty body.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED40340"
}
}
}
},
"404": {
"description": "Unknown resource/action or unsupported method.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED80019"
}
}
}
},
"409": {
"description": "The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.",
"content": {
"application/json": {
"schema": {
"type": "object",
"additionalProperties": true
},
"example": {
"error": "ED40901",
"error_code": "mutation_revision_conflict"
}
}
}
},
"422": {
"description": "Validation failed.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED80020"
}
}
}
},
"429": {
"description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED42902"
}
}
},
"headers": {
"Retry-After": {
"description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
"schema": {
"type": "string",
"examples": [
"30"
]
}
}
}
},
"502": {
"description": "Server-side operation failed.",
"content": {
"application/json": {
"example": {
"success": false,
"error": "ED50201"
}
}
}
},
"503": {
"description": "The account mutation lock or revision store is unavailable. No unprotected fallback is executed.",
"headers": {
"Retry-After": {
"schema": {
"type": "integer",
"const": 1
}
}
},
"content": {
"application/json": {
"schema": {
"type": "object",
"additionalProperties": true
},
"example": {
"error": "ED50301",
"error_code": "mutation_revision_busy"
}
}
}
}
},
"x-edoobox-mutates-state": true,
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"data": {
"type": "object",
"properties": {
"id": false,
"status": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.",
"description": "Only literal JSON false immediately disables. Every other JSON value attempts activation, which validates provider settings, a generated login redirect URL and required field mappings.",
"examples": [
false
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 40,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 224,
"reason": "Create forbids activating before setup and forces initial disabled status.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1274,
"reason": "Actual activation hook: strict false short circuit, settings/URL and required mapping checks.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Provider config depends on stored certificate/mapping and may refresh metadata XML in real runtime.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1357,
"reason": "Metadata refresh delegates parsing and may fetch XML during real runtime; not invoked by this source review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 85,
"reason": "Login URL wrapper delegates to OneLogin auth login with stay=true.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Required mapping keys are explicit.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 246,
"reason": "Followed injectSettings/getSettings: build SP/IdP settings and instantiate OneLogin Auth, with signing and stored certificate settings.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 115,
"reason": "Followed service-provider settings construction used for activation.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 174,
"reason": "Installed OneLogin Auth delegates validation to its Settings constructor.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Auth.php",
"line": 542,
"reason": "Installed OneLogin login builds the SAML request and a redirect URL; this is not a completed external provider handshake.",
"sha256": "d4a3737528426ace71044fbc90e1a06273a76149c55ee1410dc21ae225ed4a8a"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"permission": {
"type": "string",
"pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
"description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
"examples": [
"permission_012345abcdef_123456"
],
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 50
},
"provider_name": {
"x-edoobox-canonicalType": "string",
"x-edoobox-maxStoredLength": 150,
"x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
"examples": [
"Example"
],
"x-edoobox-requiredOnCreate": true,
"x-edoobox-sourceLine": 63
},
"remote_xml_url": false,
"remote_xml_content": {
"not": {},
"description": "PUT getter returns strict false; generic update throws ED80100 for remote_xml_content. This is not a metadata upload field.",
"x-edoobox-schemaStatus": "reviewed-not-writable",
"x-edoobox-clientRestriction": "Omit this field from client writes; the runtime behavior is described separately.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 90,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 236,
"reason": "Creation reads remote_xml_file or remote_xml_url, validates/parses XML and assigns escaped metadata content.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 232,
"reason": "Followed XML parsing wrapper to the installed OneLogin metadata parser.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/IdPMetadataParser.php",
"line": 115,
"reason": "Installed parser loads XML, selects entity descriptor and extracts SSO/SLO locations and bindings.",
"sha256": "4df0c1b7bf79d2df3d1903099fde2edaefe07b7d690f427958a0746f3daf6e9e"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"login_service_url": false,
"logout_service_url": false,
"field_maping": {
"description": "Replaces field mappings while keeping provider idp metadata. Empty/false-like mapping is rejected. Duplicate first_name,last_name,email or acl targets are rejected; additional user-field duplicates are not checked by this loop.",
"examples": [
[
{
"name": "Synthetic given name",
"description": "Synthetic field",
"attr": "givenName",
"field": "first_name",
"only_user": false
}
]
],
"x-edoobox-schemaStatus": "source-reviewed",
"anyOf": [
{
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"properties": {
"name": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"description": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"attr": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"field": {
"type": [
"string",
"number",
"boolean",
"null"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"description": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
},
"only_user": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.",
"description": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}
},
"additionalProperties": true,
"description": "Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false."
}
},
{
"type": "object",
"minProperties": 1,
"additionalProperties": {
"type": "object",
"properties": {
"name": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"description": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"attr": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "aP normalizes strings and replaces every non-string JSON value with empty string.",
"description": "aP normalizes strings and replaces every non-string JSON value with empty string."
},
"field": {
"type": [
"string",
"number",
"boolean",
"null"
],
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"description": "Known base fields first_name,last_name,email,acl and data_1 through data_30 are retained; unknown scalar targets normalize to false. No rejecting target enum is implemented.",
"x-edoobox-recognizedValues": [
"first_name",
"last_name",
"email",
"acl",
"data_1..data_30"
]
},
"only_user": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false.",
"description": "PHP loose == true normalization; data_1..data_30 force true and an unmapped target forces false."
}
},
"additionalProperties": true,
"description": "Canonical entries carry name, description, attr and field, plus optional only_user. Direct offset reads do not establish a deliberate missing-key validator; omitted keys can warn and normalize to empty text or false."
}
}
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 123,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2861,
"reason": "Actual PUT mapping loop, truthiness requirement, duplicate detection and full replacement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 480,
"reason": "Followed target normalizer and additional-user-field classifier.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2925,
"reason": "Followed base required mapping keys.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 319,
"reason": "Create mapping starts with idp metadata and empty field list.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 389,
"reason": "Create mapping is derived from offered/default claims and stored, overwriting submitted batch value.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1399,
"reason": "Followed getProviderData: existing provider/certificate lookup and mapping metadata; refresh may load remote XML in actual runtime, never during this review.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"allow_migration_user": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 135,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"allow_permission_acl": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 144,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"login_scope": {
"x-edoobox-canonicalType": "string",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
"description": "Strings are trimmed and lowercased. Nonempty unknown strings are rejected with ED80100/invalid_login_scope. Empty/whitespace-only strings and non-string JSON values normalize to both. This is not an exact case-sensitive input enum.",
"x-edoobox-recognizedValues": [
"both",
"admin",
"user"
],
"anyOf": [
{
"type": "string",
"pattern": "^[ \\t\\n\\r\\x00\\x0B]*(?:[bB][oO][tT][hH]|[aA][dD][mM][iI][nN]|[uU][sS][eE][rR])?[ \\t\\n\\r\\x00\\x0B]*$"
},
{
"type": [
"number",
"boolean",
"null",
"array",
"object"
]
}
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 153,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 22,
"reason": "Followed validateProvidedLoginScope and provider normalizer.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 197,
"reason": "Before-insert sets scope and applies dependent permission requirement.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2840,
"reason": "Actual PUT hook delegates to scope validator.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 42,
"reason": "Allowed normalized scopes and default both; output normalizer.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"name_id_format": {
"type": "string",
"enum": [
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
],
"description": "Exact OneLogin NameID format; input validator strictly rejects every other value. No trimming/case folding precedes validation.",
"examples": [
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
],
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 172,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2770,
"reason": "PUT checks exact NameID allowed values before aP storage.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/libraries/edoobox/integrations/auth/Saml.php",
"line": 14,
"reason": "Strict allowed formats and separate response fallback.",
"sha256": "cb122e325068b8432675dd52856fd095233782d10652ee3a56ee8161ff3acb57"
},
{
"file": "vendor/onelogin/php-saml/src/Saml2/Constants.php",
"line": 26,
"reason": "Followed installed dependency constants to actual standard URI strings.",
"sha256": "a7f6ab35d1209e34d499662ae1f8f5bedf0ae6f08325388e8b186ea85f6c236d"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"auth_request_signed": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"description": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"examples": [
true
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 190,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2801,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"disable_third_party_cookie": {
"type": [
"string",
"number",
"boolean",
"null",
"array",
"object"
],
"x-edoobox-canonicalType": "boolean",
"x-edoobox-schemaStatus": "reviewed-normalizing",
"x-edoobox-normalization": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"description": "PUT hook enables only literal JSON true; all other JSON values disable. It uses edisset followed by === true, not a general boolean parser.",
"examples": [
true
],
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 200,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2810,
"reason": "Actual flag hook clears provider cache and compares edisset value strictly with true.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"regenerate_certificate": {
"enum": [
true,
1,
"1"
],
"description": "PUT command accepts only true, integer 1 or string 1 by strict in_array. Rotates service-provider certificate; false is rejected.",
"writeOnly": true,
"x-edoobox-validation": "PHP strict in_array(value, [true, 1, string 1], true); numeric token 1.0 decodes to float and is rejected.",
"examples": [
true
],
"x-edoobox-schemaStatus": "source-reviewed",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Saml.php",
"line": 210,
"reason": "Structure declaration: input get, output set, persistence flags and field hooks.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2819,
"reason": "Strict command allowlist and generation/storage delegation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1087,
"reason": "Followed certificate payload generation and replace-active storage behavior.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 349,
"reason": "Resource POST/PUT dispatch reachability and preconditions; field contracts apply to parent resource, not sub-resource actions.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 1077,
"reason": "Followed certificate host resolution: base URL host is required; a bad host throws RuntimeException.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "docs/openapi/reviews/identity-fields.json",
"line": 1,
"reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
"sha256": "ccb043758defa22ad8cf879c4c81b317fd537f8fd0cfb125a4c1c7ffc7cdf8bf"
}
]
},
"enforce_offer_tags": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 222,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"offer_tags_additive": {
"x-edoobox-schemaStatus": "source-inferred",
"x-edoobox-sourceLine": 231,
"x-edoobox-canonicalType": "boolean",
"x-edoobox-normalization": "PHP coercion/normalization is applied by the Structure getter; its return type is not a rejecting wire-input type restriction.",
"examples": [
false
]
},
"tags": {
"anyOf": [
{
"type": "array",
"items": {
"type": "object",
"properties": {
"tag": {
"type": "string",
"pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
"description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
},
"type": {
"type": "string",
"pattern": "^[nN][oO][rR][mM][aA][lL]$",
"description": "Optional; missing type defaults to normal. ASCII case is normalized before validation."
}
},
"additionalProperties": true,
"required": [
"tag"
]
}
},
{
"type": "null"
}
],
"description": "Null or [] clears provider tags. Only participant/normal tags are supported. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2610,
"reason": "Array or null accepted; each item must contain a public tag ID.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2630,
"reason": "Missing type defaults to normal; supplied type is lowercased before validation.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 256,
"reason": "Response is an array of {tag,type:normal}.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
},
"offer_filter_tags": {
"anyOf": [
{
"type": "array",
"items": {
"type": "string",
"pattern": "^tag_[a-f0-9]{12}_-?[0-9]+$",
"description": "Public tag v2 ID returned for a currently existing record in the selected account; signature, resource type and account ownership are checked by the native hook."
}
},
{
"type": "null"
}
],
"description": "Null or [] clears offer-filter tags. Every filter tag must also be a provider tag. All final provider tags, including retained tags during an offer_filter_tags-only update, must exist in the selected account before tag/filter writes.",
"x-edoobox-contractSource": [
{
"file": "application/models/v2/Samlfunc.php",
"line": 2653,
"reason": "Array or null accepted; items decode as public tag IDs.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2678,
"reason": "Filter tags must be contained in provider tags.",
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8"
},
{
"file": "application/models/v2/Saml.php",
"line": 298,
"reason": "Response is an array of public tag IDs.",
"sha256": "d96a3b34fc395f517b58f0fe921ceffba9dd675c237f546d91cebc600ea783fc"
},
{
"file": "application/models/v2/Samlfunc.php",
"line": 2686,
"lineEnd": 2697,
"sha256": "60b2704bbe30a36725ed0a56f351e4ba6f6243b3c55393b51140fbd18ae3f0d8",
"reason": "The final provider tag set, including retained tags on filter-only updates, must exist in this account before any tag/filter persistence."
}
]
},
"date_valid": false,
"date_create": false
},
"additionalProperties": true,
"description": "Source-declared fields; action-specific and account validation still apply.",
"minProperties": 1,
"x-edoobox-readOnlyFields": [
"remote_xml_url",
"login_service_url",
"logout_service_url",
"date_valid",
"date_create"
],
"x-edoobox-clientRestriction": "Read-only fields are forbidden by this client contract to prevent silently ignored writes; the legacy API itself skips them. Explicit source-marked update context fields remain accepted for hook validation without changing their immutable database columns."
},
"id": {
"type": "string",
"pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
"description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
"examples": [
"saml_012345abcdef_123456"
]
}
},
"additionalProperties": true,
"required": [
"data",
"id"
]
},
"examples": {
"request": {
"summary": "SAML-Provider ändern",
"value": {
"id": "saml_012345abcdef_123456",
"data": {
"provider_name": "Beispiel-IDP"
}
}
}
}
}
}
},
"x-edoobox-runtimeMutationGuard": true,
"x-edoobox-documentationReview": {
"file": "docs/openapi/operation-contracts/05-auth.json",
"notes": []
},
"x-edoobox-source": {
"file": "application/models/v2/Saml.php",
"method": "updateSaml",
"line": 373
},
"x-edoobox-documentationStatus": "reviewed",
"x-edoobox-readOnly": false,
"x-edoobox-safeForAutomation": false,
"x-edoobox-permission": {
"resource": "saml",
"short": "saml",
"checkedByDispatcher": true,
"levels": [
3,
4
],
"description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
}
}