An authenticated identity session. Sessions can be user sessions (representing end-user authentication) or application sessions (representing service-to-service authentication). User sessions support hierarchical relationships via parent_id, while application sessions are always standalone.

Accepts one of the following:

IamUserSessionType { session_type, user_id, id, 19 more }

User session type-specific fields

session_type: "user"

user_id: string

User ID

id?: string

Session ID

Deprecatedactive?: boolean

Whether the session is currently active (deprecated - use status instead)

Deprecatedapplication?: Application { id, consent, created_at, 11 more }

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

id: string

Unique identifier of the application

Accepts one of the following:

created_at: string

Entity creation timestamp

formatdate-time

dependencies_count: number

Number of resource dependencies

identifier: string

User specified identifier, unique within the zone

minLength1

maxLength2048

Human-readable name

minLength1

maxLength255

organization_id: string

Organization that owns this application

owner_type: "platform" | "customer"

Who owns this application. Platform-owned applications cannot be modified via API.

Accepts one of the following:

"platform"

"customer"

slug: string

URL-safe identifier, unique within the zone

minLength1

maxLength63

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this application belongs to

description?: string | null

Human-readable description

maxLength2048

metadata?: Metadata { docs_url, icon_url }

Entity metadata

docs_url?: string

Documentation URL

formaturi

maxLength2048

icon_url?: string

Icon URL

formaturi

maxLength2048

protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

post_logout_redirect_uris?: Array<string> | null

OAuth 2.0 post-logout redirect URIs for this application

redirect_uris?: Array<string> | null

OAuth 2.0 redirect URIs for this application

application_id?: string

Application ID that initiated this session

authenticated_at?: string

Date when the session was authenticated

formatdate-time

created_at?: string

Entity creation timestamp

formatdate-time

expires_at?: string

Date when session expires

formatdate-time

issuer?: string

Issuer URL from IdP

formaturi

metadata?: Metadata { name }

Session metadata

Name of the initiating application or user agent

organization_id?: string

Organization that owns this session

parent_id?: string

Parent session ID for hierarchical sessions (user sessions only). When null, this is a web session - a top-level session initiated directly by a user. When set, this is a child session derived from the parent, used for token refresh or delegation. Application sessions cannot have parents.

provider_id?: string

Provider ID

session_data?: Record<string, unknown>

Session claims data (ID token claims for users, application claims for applications)

status?: "active" | "expired" | "revoked"

Accepts one of the following:

"active"

"expired"

"revoked"

subject?: string

Subject claim from IdP

updated_at?: string

Entity update timestamp

formatdate-time

Deprecateduser?: User { id, created_at, email, 14 more }

An authenticated user entity

id: string

Unique identifier of the user

created_at: string

Entity creation timestamp

formatdate-time

email: string

Email address of the user

formatemail

email_verified: boolean

Whether the email address has been verified

identifier: string

Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.

organization_id: string

Organization that owns this user

status: "active" | "disabled"

Status of the user. Disabled users cannot authenticate.

Accepts one of the following:

"active"

"disabled"

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this user belongs to

authenticated_at?: string

Date when the user was last authenticated

credentials?: Array<IamUserCredentialFederation { created_at, provider_id, type, 4 more } | IamUserCredentialPassword { created_at, type, updated_at } >

Authentication credentials for this user, each carrying its identity provider for federation credentials. Populated only when expand[]=credentials is set on the listing endpoint.

Accepts one of the following:

IamUserCredentialFederation { created_at, provider_id, type, 4 more }

Federation credential: the user authenticates through an identity provider.

created_at: string

Entity creation timestamp

formatdate-time

provider_id: string | null

ID of the identity provider backing this credential. null when the source provider has been deleted.

type: "federation"

updated_at: string

Entity update timestamp

formatdate-time

issuer?: string

Issuer identifier of the identity provider.

provider?: Provider { id, created_at, identifier, 12 more }

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

id: string

Unique identifier of the provider

created_at: string

Entity creation timestamp

formatdate-time

identifier: string

User specified identifier, unique within the zone

minLength1

maxLength2048

Human-readable name

minLength1

maxLength255

organization_id: string

Organization that owns this provider

owner_type: "platform" | "customer"

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:

"platform"

"customer"

slug: string

URL-safe identifier, unique within the zone

minLength1

maxLength63

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this provider belongs to

client_id?: string | null

OAuth 2.0 client identifier

client_secret_set?: boolean

Indicates whether a client secret is configured

description?: string | null

Human-readable description

maxLength2048

metadata?: Metadata | null

Provider metadata

icon_url?: string

Icon URL

formaturi

maxLength2048

protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

issuer: string

OIDC issuer URL used for discovery and token validation.

formaturi

authorization_endpoint?: string | null

formaturi

authorization_parameters?: Record<string, string> | null

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

authorization_resource_enabled?: boolean | null

Whether to include the resource parameter in authorization requests.

authorization_resource_parameter?: string | null

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

code_challenge_methods_supported?: Array<string> | null

jwks_uri?: string | null

formaturi

registration_endpoint?: string | null

formaturi

scope_parameter?: string | null

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

scope_separator?: string | null

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

scopes_supported?: Array<string> | null

token_endpoint?: string | null

formaturi

token_response_access_token_pointer?: string | null

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

openid?: Openid | null

OpenID Connect protocol configuration

scopes?: Array<string> | null

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

single_logout_enabled?: boolean | null

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

user_identifier_claim?: string | null

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

userinfo_endpoint?: string | null

formaturi

type?: "external" | "keycard-vault" | "keycard-sts"

Accepts one of the following:

"external"

"keycard-vault"

"keycard-sts"

subject?: string

Subject identifier from the identity provider.

IamUserCredentialPassword { created_at, type, updated_at }

Password credential: the user authenticates with email and password. The email lives on the user.

created_at: string

Entity creation timestamp

formatdate-time

type: "password"

updated_at: string

Entity update timestamp

formatdate-time

grant_count?: number

Delegated-grant count for this user. Populated only when expand[]=grant_count is set on the listing endpoint.

minimum0

issuer?: string

Issuer identifier of the identity provider

provider_id?: string

Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.

role_assignments?: Array<RoleAssignment>

Role grants for this user within the zone. Populated only when expand[]=role-assignments is set on the listing endpoint.

role_id: string

ID of the assigned role

role_identifier: string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1

maxLength255

role_owner_type: "platform" | "customer"

Owner type of the granted role. Disambiguates roles that share an identifier across owner types.

Accepts one of the following:

"platform"

"customer"

scope: Scope | null

The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).

id: string

The ID of the scoped resource.

type: string

The kind of resource this grant is scoped to (e.g. zone).

session_count?: number

Session count for this user. Populated only when expand[]=session_count is set on the listing endpoint.

minimum0

subject?: string

Subject identifier from the identity provider

Deprecateduser_agent?: UserAgent { id, created_at, identifier, 5 more }

A User Agent represents a user agent (browser, desktop app, CLI tool) that can initiate user sessions via OAuth 2.0 Dynamic Client Registration.

id: string

Unique identifier of the user agent

created_at: string

Entity creation timestamp

formatdate-time

identifier: string

User agent identifier (serves as OAuth client_id). Format: ua:{sha256_hash}

Human-readable name

minLength1

maxLength255

organization_id: string

Organization that owns this user agent

slug: string

URL-safe identifier, unique within the zone

minLength1

maxLength63

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this user agent belongs to

user_agent_id?: string

User agent ID (browser/client) that initiated this session

zone_id?: string

Zone this session belongs to

IamApplicationSessionType { application_id, issuer, provider_id, 14 more }

Application session type-specific fields

application_id: string

Application ID that initiated this session

issuer: string

Issuer URL from IdP

formaturi

provider_id: string

Provider ID

session_type: "application"

subject: string

Subject claim from IdP

id?: string

Session ID

Deprecatedactive?: boolean

Whether the session is currently active (deprecated - use status instead)

Deprecatedapplication?: Application { id, consent, created_at, 11 more }

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

id: string

Unique identifier of the application

Accepts one of the following:

created_at: string

Entity creation timestamp

formatdate-time

dependencies_count: number

Number of resource dependencies

identifier: string

User specified identifier, unique within the zone

minLength1

maxLength2048

Human-readable name

minLength1

maxLength255

organization_id: string

Organization that owns this application

owner_type: "platform" | "customer"

Who owns this application. Platform-owned applications cannot be modified via API.

Accepts one of the following:

"platform"

"customer"

slug: string

URL-safe identifier, unique within the zone

minLength1

maxLength63

updated_at: string

Entity update timestamp

formatdate-time

zone_id: string

Zone this application belongs to

description?: string | null

Human-readable description

maxLength2048

metadata?: Metadata { docs_url, icon_url }

Entity metadata

docs_url?: string

Documentation URL

formaturi

maxLength2048

icon_url?: string

Icon URL

formaturi

maxLength2048

protocols?: Protocols | null

Protocol-specific configuration

oauth2?: Oauth2 | null

OAuth 2.0 protocol configuration

post_logout_redirect_uris?: Array<string> | null

OAuth 2.0 post-logout redirect URIs for this application

redirect_uris?: Array<string> | null

OAuth 2.0 redirect URIs for this application

authenticated_at?: string

Date when the session was authenticated

formatdate-time

created_at?: string

Entity creation timestamp

formatdate-time

expires_at?: string

Date when session expires

formatdate-time

metadata?: Metadata { name }

Session metadata

Name of the initiating application or user agent

organization_id?: string

Organization that owns this session

session_data?: Record<string, unknown>

Session claims data (ID token claims for users, application claims for applications)

status?: "active" | "expired" | "revoked"

Accepts one of the following:

"active"

"expired"

"revoked"

updated_at?: string

Entity update timestamp

formatdate-time

zone_id?: string

Zone this session belongs to