Zones
Zones
List zones
Create zone
Update zone
ModelsExpand Collapse
EncryptionKeyAwsKmsConfig { arn, type } AWS KMS configuration for zone encryption. When not specified, the default Keycard Cloud encryption key will be used.
AWS KMS configuration for zone encryption. When not specified, the default Keycard Cloud encryption key will be used.
AWS KMS Key ARN for encrypting the zone's data
PageInfoPagination { has_next_page, has_previous_page, end_cursor, start_cursor } Pagination information
Pagination information
Whether there are more items after the current page
Whether there are items before the current page
Cursor pointing to the last item in the current page
Cursor pointing to the first item in the current page
Zone { id, created_at, name, 12 more } A zone for organizing resources within an organization
A zone for organizing resources within an organization
Unique identifier of the zone
Entity creation timestamp
Human-readable name
Organization that owns this zone
owner_type: "platform" | "customer"Who owns this zone. Platform-owned zones cannot be modified via API.
Who owns this zone. Platform-owned zones cannot be modified via API.
protocols: Protocols { oauth2, openid } Protocol configuration for a zone
Protocol configuration for a zone
oauth2: Oauth2 { authorization_endpoint, authorization_server_metadata, cimd, 7 more } OAuth 2.0 protocol configuration for a zone
OAuth 2.0 protocol configuration for a zone
OAuth 2.0 authorization endpoint
OAuth 2.0 Authorization Server Metadata endpoint (.well-known/oauth-authorization-server)
cimd: Cimd { allowed_client_ids, enabled } Client ID Metadata Document auto-provisioning configuration
Client ID Metadata Document auto-provisioning configuration
Allowlist for CIMD client_id URLs. Each entry is an exact URL, a wildcard origin with a single * replacing one subdomain label (e.g. https://*.example.com matches https://app.example.com but not https://a.b.example.com), or the literal * to allow any client. Only one * is permitted per entry.
Whether CIMD auto-provisioning is enabled for unregistered URL-based clients
Whether Dynamic Client Registration is enabled
OAuth 2.0 issuer identifier
JSON Web Key Set endpoint
Whether PKCE is required for authorization code flows
OAuth 2.0 redirect URI for this zone
OAuth 2.0 Dynamic Client Registration endpoint
OAuth 2.0 token endpoint
openid: Openid { provider_configuration, userinfo_endpoint } OpenID Connect protocol configuration for a zone
OpenID Connect protocol configuration for a zone
OpenID Connect Provider Configuration endpoint (.well-known/openid-configuration)
OpenID Connect UserInfo endpoint
URL-safe identifier, unique within the zone
Entity update timestamp
Application ID configured as the default MCP Gateway for the zone
Resource ID configured as the default resource for the zone
Human-readable description
AWS KMS configuration for zone encryption. When not specified, the default Keycard Cloud encryption key will be used.
AWS KMS configuration for zone encryption. When not specified, the default Keycard Cloud encryption key will be used.
AWS KMS Key ARN for encrypting the zone's data
Permissions granted to the authenticated principal. Only populated when expand[]=permissions query parameter is provided. Keys are resource types, values are objects mapping action names to boolean values.
Whether the zone requires an invitation for email/password registration, only applies when user_identity_provider_id is not set
Provider ID configured for user login
ZonesApplications
List applications
Create application
Get application
Update application
Delete application
List application credentials
List application resources
ModelsExpand Collapse
Application { id, consent, created_at, 11 more } An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
ApplicationTrait = "gateway" | "mcp-provider"Traits ascribe behaviors and characteristics to an application, which may activate trait-specific user experiences, workflows, or other system behaviors
Traits ascribe behaviors and characteristics to an application, which may activate trait-specific user experiences, workflows, or other system behaviors
Metadata { docs_url } Entity metadata
Entity metadata
Documentation URL
MetadataUpdate { docs_url } Entity metadata (set to null or {} to remove metadata)
Entity metadata (set to null or {} to remove metadata)
Documentation URL (set to null to unset)
ZonesApplicationsDependencies
List application dependencies
Add application dependency
Remove application dependency
Get application dependency
ModelsExpand Collapse
Resource { id, application_type, created_at, 17 more } A Resource is a system that exposes protected information or functionality. It requires authentication of the requesting actor, which may be a user or application, before allowing access.
A Resource is a system that exposes protected information or functionality. It requires authentication of the requesting actor, which may be a user or application, before allowing access.
Unique identifier of the resource
application_type: "native" | "web"The expected type of client for this credential. Native clients must use localhost URLs for redirect_uris or URIs with custom schemes. Web clients must use https URLs and must not use localhost as the hostname.
The expected type of client for this credential. Native clients must use localhost URLs for redirect_uris or URIs with custom schemes. Web clients must use https URLs and must not use localhost as the hostname.
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this resource
owner_type: "platform" | "customer"Who owns this resource. Platform-owned resources cannot be modified via API.
Who owns this resource. Platform-owned resources cannot be modified via API.
When true, the resource identifier is treated as a URI prefix, protecting all URLs that share the identifier as a prefix at path/query/fragment boundaries. Protocol and hostname must match exactly. When multiple prefix resources satisfy an identifier query, the resource with the longest prefix is matched.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this resource belongs to
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
ID of the application that provides this resource
Credential lifetime override in seconds. When set, overrides the default credential lifetime for this resource. When absent, the default from the provider or zone is used.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
ID of the credential provider for this resource
Human-readable description
Entity metadata
Entity metadata
Documentation URL
Scopes supported by the resource
List of resource IDs that, when accessed, make this dependency available. Only present when this resource is returned as a dependency.
ZonesApplication Credentials
List application credentials
Create application credential
Get application credential
Update application credential
Delete application credential
ModelsExpand Collapse
BaseFields { id, application_id, created_at, 5 more } Common fields shared by all application credential types
Common fields shared by all application credential types
Unique identifier of the credential
ID of the application this credential belongs to
Entity creation timestamp
Organization that owns this credential
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this credential belongs to
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
Token extends BaseFields { id, application_id, created_at, 5 more } { identifier, provider_id, type, 2 more } Token-based application credential
Token-based application credential
Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.
ID of the provider issuing tokens verified by this credential
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.
Password extends BaseFields { id, application_id, created_at, 5 more } { identifier, type, password } Password-based application credential
Password-based application credential
Username for password credential, also used as OAuth 2.0 client ID
Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret
PublicKey extends BaseFields { id, application_id, created_at, 5 more } { identifier, jwks_uri, type } Public key-based application credential
Public key-based application credential
Client ID for public key credential, also used as OAuth 2.0 client ID
JWKS URI to retrieve public keys from
URL-based application credential
URL-based application credential
URL of the credential (must be a valid URL)
Public credential (no secret storage)
Public credential (no secret storage)
Identifier for public credential, also used as OAuth 2.0 client ID
Password extends BaseFields { id, application_id, created_at, 5 more } { identifier, type, password } Password-based application credential
Password-based application credential
Username for password credential, also used as OAuth 2.0 client ID
Password for credential (only returned on creation, store securely), also used as OAuth 2.0 client secret
Public credential (no secret storage)
Public credential (no secret storage)
Identifier for public credential, also used as OAuth 2.0 client ID
PublicKey extends BaseFields { id, application_id, created_at, 5 more } { identifier, jwks_uri, type } Public key-based application credential
Public key-based application credential
Client ID for public key credential, also used as OAuth 2.0 client ID
JWKS URI to retrieve public keys from
Token extends BaseFields { id, application_id, created_at, 5 more } { identifier, provider_id, type, 2 more } Token-based application credential
Token-based application credential
Identifier for this credential. For token type, this equals the subject value, or '*' when subject is not specified.
ID of the provider issuing tokens verified by this credential
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
Subject identifier for the token. When null or omitted, any token from the provider is accepted without checking application-specific claims.
URL-based application credential
URL-based application credential
URL of the credential (must be a valid URL)
ZonesDelegated Grants
List delegated grants
Get delegated grant
Update delegated grant
Delete delegated grant
ModelsExpand Collapse
Grant { id, created_at, expires_at, 14 more } User authorization for a resource to be accessed on their behalf. The grant links the user, resource, and the provider that issued the grant.
User authorization for a resource to be accessed on their behalf. The grant links the user, resource, and the provider that issued the grant.
Unique identifier of the delegated grant
Entity creation timestamp
Date when grant expires
Organization that owns this grant
ID of the provider that issued this grant
Indicates whether a refresh token is stored for this grant. Grants with refresh tokens can be refreshed even after access token expiration.
ID of resource receiving grant
Granted OAuth scopes
status: "active" | "expired" | "revoked"
Entity update timestamp
Reference to the user granting permission
Zone this grant belongs to
Whether the grant is currently active (deprecated - use status instead)
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
Timestamp when this grant's tokens were last refreshed. Omitted if grant was never refreshed.
A Resource is a system that exposes protected information or functionality. It requires authentication of the requesting actor, which may be a user or application, before allowing access.
A Resource is a system that exposes protected information or functionality. It requires authentication of the requesting actor, which may be a user or application, before allowing access.
Unique identifier of the resource
application_type: "native" | "web"The expected type of client for this credential. Native clients must use localhost URLs for redirect_uris or URIs with custom schemes. Web clients must use https URLs and must not use localhost as the hostname.
The expected type of client for this credential. Native clients must use localhost URLs for redirect_uris or URIs with custom schemes. Web clients must use https URLs and must not use localhost as the hostname.
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this resource
owner_type: "platform" | "customer"Who owns this resource. Platform-owned resources cannot be modified via API.
Who owns this resource. Platform-owned resources cannot be modified via API.
When true, the resource identifier is treated as a URI prefix, protecting all URLs that share the identifier as a prefix at path/query/fragment boundaries. Protocol and hostname must match exactly. When multiple prefix resources satisfy an identifier query, the resource with the longest prefix is matched.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this resource belongs to
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
ID of the application that provides this resource
Credential lifetime override in seconds. When set, overrides the default credential lifetime for this resource. When absent, the default from the provider or zone is used.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
ID of the credential provider for this resource
Human-readable description
Entity metadata
Entity metadata
Documentation URL
Scopes supported by the resource
List of resource IDs that, when accessed, make this dependency available. Only present when this resource is returned as a dependency.
An authenticated user entity
An authenticated user entity
Unique identifier of the user
Entity creation timestamp
Email address of the user
Whether the email address has been verified
Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.
Organization that owns this user
status: "active" | "disabled"Status of the user. Disabled users cannot authenticate.
Status of the user. Disabled users cannot authenticate.
Entity update timestamp
Zone this user belongs to
Date when the user was last authenticated
Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.
Issuer identifier of the identity provider
Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.
role_assignments?: Array<RoleAssignment>Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
ID of the assigned role
Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
scope: Scope | nullThe resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The ID of the scoped resource.
The kind of resource this grant is scoped to (e.g. zone).
Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.
Subject identifier from the identity provider
ZonesProviders
List providers
Create provider
Get provider
Update provider
Delete provider
ModelsExpand Collapse
Provider { id, created_at, identifier, 12 more } A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.
Unique identifier of the provider
Entity creation timestamp
User specified identifier, unique within the zone
Human-readable name
Organization that owns this provider
owner_type: "platform" | "customer"Who owns this provider. Platform-owned providers cannot be modified via API.
Who owns this provider. Platform-owned providers cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this provider belongs to
OAuth 2.0 client identifier
Indicates whether a client secret is configured
Human-readable description
Provider metadata
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OIDC issuer URL used for discovery and token validation.
Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).
Whether to include the resource parameter in authorization requests.
The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.
The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".
The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".
Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".
openid?: Openid | nullOpenID Connect protocol configuration
OpenID Connect protocol configuration
Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).
Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.
type?: "external" | "keycard-vault" | "keycard-sts"
ZonesResources
List resources
Create resource
Get resource
Update resource
Delete resource
ZonesSessions
List sessions
Get session
Update session
Delete session
ModelsExpand Collapse
Session = IamUserSessionType { session_type, user_id, id, 19 more } | IamApplicationSessionType { application_id, issuer, provider_id, 14 more } An authenticated identity session. Sessions can be user sessions (representing end-user authentication) or application sessions (representing service-to-service authentication). User sessions support hierarchical relationships via parent_id, while application sessions are always standalone.
An authenticated identity session. Sessions can be user sessions (representing end-user authentication) or application sessions (representing service-to-service authentication). User sessions support hierarchical relationships via parent_id, while application sessions are always standalone.
IamUserSessionType { session_type, user_id, id, 19 more } User session type-specific fields
User session type-specific fields
User ID
Session ID
Whether the session is currently active (deprecated - use status instead)
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
Application ID that initiated this session
Date when the session was authenticated
Entity creation timestamp
Date when session expires
Issuer URL from IdP
metadata?: Metadata { name } Session metadata
Session metadata
Name of the initiating application or user agent
Organization that owns this session
Parent session ID for hierarchical sessions (user sessions only). When null, this is a web session - a top-level session initiated directly by a user. When set, this is a child session derived from the parent, used for token refresh or delegation. Application sessions cannot have parents.
Provider ID
Session claims data (ID token claims for users, application claims for applications)
status?: "active" | "expired" | "revoked"
Subject claim from IdP
Entity update timestamp
An authenticated user entity
An authenticated user entity
Unique identifier of the user
Entity creation timestamp
Email address of the user
Whether the email address has been verified
Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.
Organization that owns this user
status: "active" | "disabled"Status of the user. Disabled users cannot authenticate.
Status of the user. Disabled users cannot authenticate.
Entity update timestamp
Zone this user belongs to
Date when the user was last authenticated
Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.
Issuer identifier of the identity provider
Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.
role_assignments?: Array<RoleAssignment>Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
ID of the assigned role
Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
scope: Scope | nullThe resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The ID of the scoped resource.
The kind of resource this grant is scoped to (e.g. zone).
Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.
Subject identifier from the identity provider
A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.
A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.
Unique identifier of the user agent
Entity creation timestamp
User agent identifier (serves as OAuth client_id). Format: ua:{sha256_hash}
Human-readable name
Organization that owns this user agent
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this user agent belongs to
User agent ID (browser/client) that initiated this session
Zone this session belongs to
IamApplicationSessionType { application_id, issuer, provider_id, 14 more } Application session type-specific fields
Application session type-specific fields
Application ID that initiated this session
Issuer URL from IdP
Provider ID
Subject claim from IdP
Session ID
Whether the session is currently active (deprecated - use status instead)
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
Unique identifier of the application
consent: "implicit" | "required"Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
Entity creation timestamp
Number of resource dependencies
User specified identifier, unique within the zone
Human-readable name
Organization that owns this application
owner_type: "platform" | "customer"Who owns this application. Platform-owned applications cannot be modified via API.
Who owns this application. Platform-owned applications cannot be modified via API.
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this application belongs to
Human-readable description
Entity metadata
Entity metadata
Documentation URL
protocols?: Protocols | nullProtocol-specific configuration
Protocol-specific configuration
oauth2?: Oauth2 | nullOAuth 2.0 protocol configuration
OAuth 2.0 protocol configuration
OAuth 2.0 post-logout redirect URIs for this application
OAuth 2.0 redirect URIs for this application
Date when the session was authenticated
Entity creation timestamp
Date when session expires
metadata?: Metadata { name } Session metadata
Session metadata
Name of the initiating application or user agent
Organization that owns this session
Session claims data (ID token claims for users, application claims for applications)
status?: "active" | "expired" | "revoked"
Entity update timestamp
Zone this session belongs to
ZonesUser Agents
List user agents
Get user agent
ModelsExpand Collapse
UserAgent { id, created_at, identifier, 5 more } A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.
A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.
Unique identifier of the user agent
Entity creation timestamp
User agent identifier (serves as OAuth client_id). Format: ua:{sha256_hash}
Human-readable name
Organization that owns this user agent
URL-safe identifier, unique within the zone
Entity update timestamp
Zone this user agent belongs to
ZonesUsers
List users
ModelsExpand Collapse
User { id, created_at, email, 13 more } An authenticated user entity
An authenticated user entity
Unique identifier of the user
Entity creation timestamp
Email address of the user
Whether the email address has been verified
Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.
Organization that owns this user
status: "active" | "disabled"Status of the user. Disabled users cannot authenticate.
Status of the user. Disabled users cannot authenticate.
Entity update timestamp
Zone this user belongs to
Date when the user was last authenticated
Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.
Issuer identifier of the identity provider
Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.
role_assignments?: Array<RoleAssignment>Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.
ID of the assigned role
Opaque role identifier. Treated as an opaque identifier by the API and unique within a zone.
scope: Scope | nullThe resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).
The ID of the scoped resource.
The kind of resource this grant is scoped to (e.g. zone).
Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.
Subject identifier from the identity provider
ZonesMembers
Add organization user to zone
List organization users in a zone
Get organization user in a zone
Update organization user role in a zone
Remove member from zone
ModelsExpand Collapse
ZoneMember { id, _links, created_at, 5 more } Represents an organization user's membership in a zone with an assigned role
Represents an organization user's membership in a zone with an assigned role
Unique identifier of the zone member
_links: _Links { organization_user, self } HAL-format hypermedia links for zone member resources
HAL-format hypermedia links for zone member resources
organization_user: OrganizationUser { href }
Link to the user resource
self: Self { href }
Link to this zone member resource
Entity creation timestamp
Organization ID that owns the zone
Organization user ID of the zone member
Zone role type. zone_manager has full management access, zone_viewer has read-only access.
Zone role type. zone_manager has full management access, zone_viewer has read-only access.
Entity update timestamp
Zone ID the organization user is a member of
ZoneRole = "zone_manager" | "zone_viewer"Zone role type. zone_manager has full management access, zone_viewer has read-only access.
Zone role type. zone_manager has full management access, zone_viewer has read-only access.
ZonesSecrets
List
Delete
Retrieve
ModelsExpand Collapse
Secret { id, created_at, entity_id, 7 more }
A globally unique opaque identifier
A globally unique opaque identifier
A name for the entity to be displayed in UI
type: "token" | "password"
A globally unique opaque identifier
A description of the entity
A JSON object containing arbitrary metadata. Metadata will not be encrypted.
SecretPasswordFields { password, type, username }
SecretTokenFields { token, type }
ZonesPolicy Schemas
List policy schemas
Get a policy schema by version
Set the default policy schema for a zone
ModelsExpand Collapse
SchemaVersion { created_at, status, updated_at, 5 more } A versioned Cedar schema that defines the entity model, actions, and
context shape used for policy evaluation. The schema contains the valid
entity types (User, Application, Resource), their attributes, and the
allowed attribute values. See the Credentials API spec for a full
reference of entity attributes and valid values.
A versioned Cedar schema that defines the entity model, actions, and context shape used for policy evaluation. The schema contains the valid entity types (User, Application, Resource), their attributes, and the allowed attribute values. See the Credentials API spec for a full reference of entity attributes and valid values.
status: "active" | "deprecated" | "archived"Controls what can be done with this schema version:
"active" - new policy versions can be created and validated against it."deprecated" - superseded by a newer version but still accepts new policy versions."archived" - closed to new policy versions. Existing policy set versions pinned to this schema still evaluate normally.
Controls what can be done with this schema version:
"active"- new policy versions can be created and validated against it."deprecated"- superseded by a newer version but still accepts new policy versions."archived"- closed to new policy versions. Existing policy set versions pinned to this schema still evaluate normally.
Cedar schema in human-readable syntax. Populated when format=cedar.
Cedar schema as JSON object. Populated when format=json (default).
SchemaVersionWithZoneInfo extends SchemaVersion { created_at, status, updated_at, 5 more } { is_default } A versioned Cedar schema that defines the entity model, actions, and
context shape used for policy evaluation. The schema contains the valid
entity types (User, Application, Resource), their attributes, and the
allowed attribute values. See the Credentials API spec for a full
reference of entity attributes and valid values.
A versioned Cedar schema that defines the entity model, actions, and context shape used for policy evaluation. The schema contains the valid entity types (User, Application, Resource), their attributes, and the allowed attribute values. See the Credentials API spec for a full reference of entity attributes and valid values.
Whether this is the zone's default schema. Clients use this to pre-select which schema to write policies against. Has no effect on evaluation.
ZonesPolicies
List policies in a zone
Create a new policy
Get a policy by ID
Update a policy
Archive a policy
ModelsExpand Collapse
Policy { id, created_at, created_by, 10 more }
owner_type: "platform" | "customer"Who manages this policy:
"platform" — managed by the Keycard platform (system policies)."customer" — managed by the tenant (custom policies).
Who manages this policy:
"platform"— managed by the Keycard platform (system policies)."customer"— managed by the tenant (custom policies).
Schema version the latest version was validated against (e.g.,
"2026-02-24"). Null when the policy has no published versions.
Denormalized from PolicyVersion.schema_version for the policy
referenced by latest_version_id.
Human-readable version number of the latest version (e.g., 1, 2, 3)
PolicyDraft { created_at, policy_id, schema_version, 5 more }
ID of the policy version this draft was hydrated from. Null when the draft was created without an existing version.
Cedar policy in JSON representation. Populated by default
and when format=json is passed; null when format=cedar
narrows the response to the text representation only.
Cedar policy in human-readable syntax. Populated by default
and when format=cedar is passed; null when format=json
narrows the response to the JSON representation only.
ZonesPoliciesVersions
List versions of a policy
Create a new immutable policy version
Get a specific policy version
Archive a policy version
ModelsExpand Collapse
PolicyVersion { id, created_at, created_by, 10 more }
owner_type: "platform" | "customer"Who manages this policy version:
"platform" — managed by the Keycard platform (system policy versions)."customer" — managed by the tenant (custom policy versions).
Who manages this policy version:
"platform"— managed by the Keycard platform (system policy versions)."customer"— managed by the tenant (custom policy versions).
Schema version this policy was validated against when created.
Hex-encoded content hash
Cedar policy in JSON representation. Populated by default
and when format=json is passed; null when format=cedar
narrows the response to the text representation only.
Cedar policy in human-readable syntax. Populated by default
and when format=cedar is passed; null when format=json
narrows the response to the JSON representation only.
ZonesPackages
ModelsExpand Collapse
InputState { effective_bindings, effective_schema } Computed input state for a package — derived at response time from the
package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
Computed input state for a package — derived at response time from the package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
effective_schema?: EffectiveSchema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Package { id, created_at, kind, 15 more }
Whether the package is published. Unpublished packages are excluded from
list endpoints by default; pass include_unpublished=true to include them.
Server-populated URL-friendly identifier.
owner_type: "platform" | "customer"
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Computed input state for a package — derived at response time from the
package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
Computed input state for a package — derived at response time from the package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
effective_schema?: EffectiveSchema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Provenance info for a package originating from an ancestor catalog.
Provenance info for a package originating from an ancestor catalog.
scope: "global" | "org" | "zone"Scope type of the catalog where the package is authored.
Scope type of the catalog where the package is authored.
PackageDraft { id, manifest_sha, name, 8 more }
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
PackageInputBinding { bindings, schema } Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
PackageList { items, pagination }
Whether the package is published. Unpublished packages are excluded from
list endpoints by default; pass include_unpublished=true to include them.
Server-populated URL-friendly identifier.
owner_type: "platform" | "customer"
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Computed input state for a package — derived at response time from the
package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
Computed input state for a package — derived at response time from the package kind's schema and the package's input binding. Not stored.
effective_schema is the full input schema (kind + binding required
constraints merged). effective_bindings resolves the CEL binding to
show actual static values and {"$input": "path"} references for
install-provided fields.
effective_schema?: EffectiveSchema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
Provenance info for a package originating from an ancestor catalog.
Provenance info for a package originating from an ancestor catalog.
scope: "global" | "org" | "zone"Scope type of the catalog where the package is authored.
Scope type of the catalog where the package is authored.
pagination: Pagination { after_cursor, before_cursor, total_count } Cursor-based pagination metadata returned alongside a list of results
Cursor-based pagination metadata returned alongside a list of results
An opaque cursor used for paginating through a list of results
An opaque cursor used for paginating through a list of results
Total number of items across all pages. Only present when the request includes ?expand[]=total_count.
PackageOutputBinding { bindings, schema } Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
PackageSource { scope } Provenance info for a package originating from an ancestor catalog.
Provenance info for a package originating from an ancestor catalog.
scope: "global" | "org" | "zone"Scope type of the catalog where the package is authored.
Scope type of the catalog where the package is authored.
ZonesPackagesVersions
ModelsExpand Collapse
PackageVersion { id, created_at, manifest_sha, 12 more }
owner_type: "platform" | "customer"
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
PackageVersionList { items, pagination }
owner_type: "platform" | "customer"
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
Input binding for a package.
schema constrains install-level inputs. bindings is a CEL expression
that assembles the flat input map — static values are CEL literals,
install-provided values are pkg.inputs.X references. Evaluated at
provisioning time to produce the entities.inputs map for entity bindings.
CEL expression assembling the flat input map from static values
and install-provided values (referenced via pkg.inputs.X).
Scope:
pkg.inputs— install-supplied values conforming toschema.
schema?: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
Output binding for a package.
schema describes the flat outputs surfaced on an install.
bindings is a CEL expression — a map literal whose keys match
schema.properties and whose values project fields out of the resolved
entity graph. Evaluated after the provisioner has resolved all entities.
CEL expression source. Must evaluate to a map whose fields match
schema.properties.
Scope: entities:
entities.inputs— the package's input values (merged with install inputs at provisioning time).entities.<name>— resolved entities in the graph, each withhref: stringandoutputs: map<string, dyn>.
schema: Schema { additionalProperties, const, default, 17 more } A subset of JSON Schema 2020-12 used to describe package input and output
shapes.
Supported keywords:
- Structural:
type, properties, required, items, additionalProperties
- Annotations:
title, description, default, readOnly, writeOnly
- Constraints:
pattern, minLength, maxLength, minimum, maximum,
minItems, maxItems, enum, const, format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf, anyOf, oneOf, not
- References:
$ref, $dynamicRef
patternProperties, propertyNames, unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
A subset of JSON Schema 2020-12 used to describe package input and output shapes.
Supported keywords:
- Structural:
type,properties,required,items,additionalProperties - Annotations:
title,description,default,readOnly,writeOnly - Constraints:
pattern,minLength,maxLength,minimum,maximum,minItems,maxItems,enum,const,format
Intentionally unsupported (reject at release time rather than silently ignore):
- Schema combinators:
allOf,anyOf,oneOf,not - References:
$ref,$dynamicRef patternProperties,propertyNames,unevaluatedProperties- Custom vocabularies and
$vocabulary
Dialect: JSON Schema 2020-12 (implied — authors do not include $schema).
Schema for properties not named in properties.
Constant allowed value.
Default value (annotation).
Human-readable description (annotation).
Enumerated allowed values.
Format hint (e.g., "uri", "uuid", "email", "date-time").
Schema for array items.
Property schemas, keyed by property name.
Read-only hint — server-populated, ignored on write.
Names of required properties.
Human-readable title (annotation).
type?: "object" | "array" | "string" | 4 moreThe type keyword in JSON Schema 2020-12.
The type keyword in JSON Schema 2020-12.
Write-only hint (passwords, secrets) — never returned on read.
Vocabulary-defined metadata properties, keyed by property URN.
Known properties are declared with their schemas; additional
properties with custom URNs are permitted via Record<unknown>.
Each property carries x-subject-types indicating which entity types
it applies to. Properties with draft/ in the URN are experimental
and carry x-internal: true.
pagination: Pagination { after_cursor, before_cursor, total_count } Cursor-based pagination metadata returned alongside a list of results
Cursor-based pagination metadata returned alongside a list of results
An opaque cursor used for paginating through a list of results
An opaque cursor used for paginating through a list of results
Total number of items across all pages. Only present when the request includes ?expand[]=total_count.
ZonesInstalls
ModelsExpand Collapse
Install { id, created_at, package_id, 9 more }
Install-specific input values that supplement the package's inputs.
Merged with the package's input values to form the complete
entities.inputs for entity binding evaluation.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Resolved output values produced by the provisioner, conforming to the
package's Package.outputs.schema. Flat — the provisioner evaluates
Package.outputs.bindings against the resolved entity graph.
InstallList { items, pagination }
Install-specific input values that supplement the package's inputs.
Merged with the package's input values to form the complete
entities.inputs for entity binding evaluation.
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
Resolved output values produced by the provisioner, conforming to the
package's Package.outputs.schema. Flat — the provisioner evaluates
Package.outputs.bindings against the resolved entity graph.
pagination: Pagination { after_cursor, before_cursor, total_count } Cursor-based pagination metadata returned alongside a list of results
Cursor-based pagination metadata returned alongside a list of results
An opaque cursor used for paginating through a list of results
An opaque cursor used for paginating through a list of results
Total number of items across all pages. Only present when the request includes ?expand[]=total_count.
InstallStatus = "pending" | "active" | "deleting" | 2 more
ZonesCatalog Tasks
ModelsExpand Collapse
Task { id, created_at, operation, 9 more }
links?: Array<Link>
Target reference.
Fragment URIs (#name) reference other entities in the same graph by
their local name (the key in the entity map). Absolute paths and URLs reference
external resources outside the graph.
Link relation type.
Additional metadata keyed by property name.
Human-readable titles keyed by BCP 47 language tag.
Media type of the target resource (per RFC 7033 section 4.4.4.3).
Applies to external hrefs; typically omitted for intra-graph references.
warnings?: Array<Warning>Informational warnings about the task outcome. For delete tasks,
warns when adopted entities (pre-existing resources not created by
the catalog) will be preserved rather than deleted.
Informational warnings about the task outcome. For delete tasks, warns when adopted entities (pre-existing resources not created by the catalog) will be preserved rather than deleted.
code: "validation_error" | "bad_request" | "unauthorized" | 6 more
details: Array<Detail>
code: "validation_error" | "bad_request" | "unauthorized" | 6 more
valid json path for request body
error message for specific error
summary of the error
HTTP Status Code
TaskOperation = "create" | "delete"
TaskStatus = "pending" | "running" | "completed" | "failed"
ZonesPolicy Sets
List policy sets in a zone
Create a new policy set
Get a policy set by ID
Update a policy set
Archive a policy set
ModelsExpand Collapse
Attestation { payload, protected, signature } JWS Flattened JSON Serialization (RFC 7515 §7.2.2) of a policy set attestation. The protected header carries the signing algorithm and key identifier; the payload is a base64url-encoded AttestationStatement canonicalized per RFC 8785 (JCS). Verify using the zone JWKS endpoint (RFC 7517). Currently signed with RS256; future zone key types (e.g. EdDSA) will be indicated by the "alg" header — no envelope changes required.
JWS Flattened JSON Serialization (RFC 7515 §7.2.2) of a policy set attestation. The protected header carries the signing algorithm and key identifier; the payload is a base64url-encoded AttestationStatement canonicalized per RFC 8785 (JCS). Verify using the zone JWKS endpoint (RFC 7517). Currently signed with RS256; future zone key types (e.g. EdDSA) will be indicated by the "alg" header — no envelope changes required.
Base64url-encoded AttestationStatement (RFC 7515 §3). Decode to inspect attestation content. The RFC 8785 canonical form of the decoded JSON is the JWS Signing Input alongside the protected header.
Base64url-encoded JWS protected header (RFC 7515 §4). Contains at minimum "alg" (signing algorithm — currently RS256, will migrate to EdDSA) and "kid" (signing key identifier resolvable via the zone JWKS endpoint).
Base64url-encoded digital signature computed over the JWS Signing Input (ASCII(protected) || '.' || payload) per RFC 7515 §5.1.
AttestationStatement { attested_at, attested_by, key_id, 7 more } Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.
Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.
Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.
SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.
status: "created" | "re_signed"Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).
Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).
Statement type discriminator
Statement schema version
PolicySet { id, created_at, created_by, 10 more }
owner_type: "platform" | "customer"Who manages this policy set:
"platform" — managed by the Keycard platform (system policies)."customer" — managed by the tenant (custom policies).
Who manages this policy set:
"platform"— managed by the Keycard platform (system policies)."customer"— managed by the tenant (custom policies).
Deprecatedscope_type: "zone" | "resource" | "user" | "session"Deprecated. Use target_type instead. Carries the same value.
Deprecated. Use target_type instead. Carries the same value.
target_type: "zone" | "user"What this policy set targets:
"zone" — applies to all requests in the zone."user" — scoped to a specific user.
resource and session are reserved; legacy sets with those
scopes carry them in the deprecated scope_type field.
What this policy set targets:
"zone"— applies to all requests in the zone."user"— scoped to a specific user.
resource and session are reserved; legacy sets with those
scopes carry them in the deprecated scope_type field.
Human-readable version number of the latest version (e.g., 1, 2, 3)
PolicySetDraft { created_at, manifest, policy_set_id, 7 more }
SHA-256 of the policy version content, populated by the server
ID of the policy set version this draft was hydrated from. Null when the draft was created without an existing version.
warnings?: Array<Warning>Warnings about manifest entries that would prevent creating a version from this draft. Present only when there are warnings; omitted when empty.
Warnings about manifest entries that would prevent creating a version from this draft. Present only when there are warnings; omitted when empty.
Human-readable description of the warning, e.g. 'validated against schema "2026-02-24", draft targets "2026-03-16"' or 'policy version is archived'.
type: "policy_version_archived" | "schema_version_mismatch"
detail?: Detail { draft_schema_version, policy_schema_version } Structured detail payload. Present for warning types that carry additional context (e.g. schema_version_mismatch includes the two schema versions). Omitted when the type alone is sufficient (e.g. policy_version_archived).
Structured detail payload. Present for warning types that carry additional context (e.g. schema_version_mismatch includes the two schema versions). Omitted when the type alone is sufficient (e.g. policy_version_archived).
Schema version the draft targets. Present only for schema_version_mismatch warnings.
Schema version the policy version was validated against. Present only for schema_version_mismatch warnings.
PolicySetManifest { entries }
SHA-256 of the policy version content, populated by the server
PolicySetManifestEntry { policy_id, policy_version_id, sha }
SHA-256 of the policy version content, populated by the server
PolicySetWithBinding extends PolicySet { id, created_at, created_by, 10 more } { active, active_version, active_version_id, 5 more }
Whether this policy set is currently bound to a scope
Human-readable version number of the active version (e.g., 1, 2, 3)
Public ID of the currently active (bound) version
mode?: "active" | "shadow" | null
Deprecated. Use target_id instead. Carries the
active binding's target; null when unbound.
Human-readable version number of the shadow version
Public ID of the shadow (observed) version, if any
Target entity ID. Equals zone_id for zone-targeted sets;
the principal identifier for principal-scoped sets. Null
only for legacy non-zone sets that predate target tracking.
ZonesPolicy SetsVersions
List versions of a policy set
Create a new immutable policy set version
Get a specific policy set version
Activate a policy set version
Archive a policy set version
List policy versions in a policy set version
ModelsExpand Collapse
PolicySetVersion { id, created_at, created_by, 10 more }
SHA-256 of the policy version content, populated by the server
Hex-encoded SHA-256 of the canonicalized manifest
owner_type: "platform" | "customer"Who manages this policy set version:
"platform" — managed by the Keycard platform (system policy set versions)."customer" — managed by the tenant (custom policy set versions).
Who manages this policy set version:
"platform"— managed by the Keycard platform (system policy set versions)."customer"— managed by the tenant (custom policy set versions).
Schema version pinned to this policy set version. Determines the Cedar schema used for evaluation when activated.
Whether this policy set version is currently bound with mode='active'
Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.
Decoded content of an Attestation JWS payload. Describes the exact policy set version composition at attestation time. This schema defines what consumers see after base64url-decoding the Attestation.payload field.
Key ID of the signing key used to produce the attestation signature. Matches the "kid" in the JWS protected header.
SHA-256 of the policy set version manifest. Verifiers MUST check this matches the policy_set_version.manifest_sha to detect attestation/version mismatches.
status: "created" | "re_signed"Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).
Event that produced this attestation. "created" is the initial attestation at version creation; "re_signed" is a re-attestation after key rotation (same content, new signature).
Statement type discriminator
Statement schema version