1"use strict";(self.webpackChunkthinkfree_developers_docs=self.webpackChunkthinkfree_developers_docs||[]).push([[7145],{7694(e,n,s){s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>c,default:()=>o,frontMatter:()=>t,metadata:()=>d,toc:()=>a});const d=JSON.parse('{"id":"management/api/super-admin","title":"Super Admin API","description":"Provision tenants, set the base domain, and enforce sign-in and sharing policy across every tenant.","source":"@site/docs/management/api/super-admin.md","sourceDirName":"management/api","slug":"/management/api/super-admin","permalink":"/docs/management/api/super-admin","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":19,"frontMatter":{"title":"Super Admin API","sidebar_label":"Super Admin","sidebar_position":19,"description":"Provision tenants, set the base domain, and enforce sign-in and sharing policy across every tenant.","keywords":["Document Management SDK","super admin API","tenant","base domain","enforcement"]},"sidebar":"managementSidebar","previous":{"title":"Audit logs","permalink":"/docs/management/api/audit-logs"},"next":{"title":"Errors","permalink":"/docs/management/api/errors"}}');var r=s(4848),i=s(8453);const t={title:"Super Admin API",sidebar_label:"Super Admin",sidebar_position:19,description:"Provision tenants, set the base domain, and enforce sign-in and sharing policy across every tenant.",keywords:["Document Management SDK","super admin API","tenant","base domain","enforcement"]},c="Super Admin API",l={},a=[{value:"Base URL and authorization",id:"base-url-and-authorization",level:2},{value:"Base domain",id:"base-domain",level:2},{value:"Read the base domain",id:"read-the-base-domain",level:3},{value:"Set the base domain",id:"set-the-base-domain",level:3},{value:"Tenants",id:"tenants",level:2},{value:"List tenants",id:"list-tenants",level:3},{value:"Read a tenant",id:"read-a-tenant",level:3},{value:"Create a tenant",id:"create-a-tenant",level:3},{value:"Update a tenant",id:"update-a-tenant",level:3},{value:"Search a tenant's accounts",id:"search-a-tenants-accounts",level:3},{value:"Tenant errors",id:"tenant-errors",level:3},{value:"Sign-in policy",id:"sign-in-policy",level:2},{value:"Read the sign-in policy",id:"read-the-sign-in-policy",level:3},{value:"Set the sign-in policy",id:"set-the-sign-in-policy",level:3},{value:"Sign-in policy errors",id:"sign-in-policy-errors",level:3},{value:"Sharing policy",id:"sharing-policy",level:2},{value:"Read the sharing policy",id:"read-the-sharing-policy",level:3},{value:"Set the sharing policy",id:"set-the-sharing-policy",level:3},{value:"Sharing policy errors",id:"sharing-policy-errors",level:3},{value:"Errors",id:"errors",level:2}];function h(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"super-admin-api",children:"Super Admin API"})}),"\n",(0,r.jsxs)(n.p,{children:["Platform-wide operations that cross tenant boundaries: creating tenants, defining the base domain they sit under, and\nimposing one sign-in or sharing policy on all of them. For operations inside a single tenant, see ",(0,r.jsx)(n.a,{href:"/docs/management/api/admin",children:"Admin"}),".\nIssuing and managing API Keys for any tenant, including on the super admin surface, is covered in\n",(0,r.jsx)(n.a,{href:"/docs/management/api/authentication",children:"Authentication"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"base-url-and-authorization",children:"Base URL and authorization"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"/api/external/v1/super-admin\n"})}),"\n",(0,r.jsxs)(n.p,{children:["These endpoints require an API Key issued to an account holding the ",(0,r.jsx)(n.code,{children:"SUPER_ADMIN"})," role. An ordinary administrator's key\ndoes not pass."]}),"\n",(0,r.jsx)(n.admonition,{title:"Scope is not checked here either",type:"warning",children:(0,r.jsxs)(n.p,{children:["Like the admin endpoints, authorization is by role alone. A key holding only ",(0,r.jsx)(n.code,{children:"api:read"})," can create tenants, change the\nbase domain, and enforce policy across every tenant. A super administrator key is the most privileged credential in the\nsystem regardless of the scope it was issued with."]})}),"\n",(0,r.jsx)(n.p,{children:"Tenant entry-key issuance is not available through the external API."}),"\n",(0,r.jsx)(n.p,{children:"Failures use the common envelope. Each section below lists the codes its endpoints return."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Failure"',children:'{\n "result": false,\n "code": 404,\n "errorCode": "TENANT_001",\n "message": "..."\n}\n'})}),"\n",(0,r.jsx)(n.h2,{id:"base-domain",children:"Base domain"}),"\n",(0,r.jsx)(n.p,{children:"Tenants are addressed as a subdomain of one shared base domain."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/base-domain\nPUT /api/external/v1/super-admin/base-domain\n"})}),"\n",(0,r.jsx)(n.h3,{id:"read-the-base-domain",children:"Read the base domain"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Read base domain"',children:'curl "https://drive.example.com/api/external/v1/super-admin/base-domain" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"baseDomainSeq"})}),(0,r.jsx)(n.td,{children:"integer"}),(0,r.jsxs)(n.td,{children:["Always ",(0,r.jsx)(n.code,{children:"1"})," once configured; ",(0,r.jsx)(n.code,{children:"null"})," when not configured"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"baseDomain"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsxs)(n.td,{children:["The base domain; ",(0,r.jsx)(n.code,{children:"null"})," when not configured"]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:["Reading before a base domain is configured is not an error. It returns ",(0,r.jsx)(n.code,{children:"200"})," with both fields ",(0,r.jsx)(n.code,{children:"null"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Configured"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "baseDomainSeq": 1,\n "baseDomain": "drive.example.com"\n }\n}\n'})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Not configured"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "baseDomainSeq": null,\n "baseDomain": null\n }\n}\n'})}),"\n",(0,r.jsx)(n.h3,{id:"set-the-base-domain",children:"Set the base domain"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsx)(n.tbody,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"bd"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Base domain as a full domain name, up to 253 characters"})]})})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"bd"})," accepts lowercase letters, digits, and hyphens only - uppercase is rejected. Each dot-separated label is 1-63\ncharacters and starts and ends with a lowercase letter or digit, and the last label (the TLD) is at least two letters.\nAnything else returns ",(0,r.jsx)(n.code,{children:"BASE_DOMAIN_002"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Set base domain"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/base-domain" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"bd": "drive.example.com"}\'\n'})}),"\n",(0,r.jsxs)(n.p,{children:["The call registers the base domain if none exists and changes it otherwise. It returns ",(0,r.jsx)(n.code,{children:"200 OK"})," with no ",(0,r.jsx)(n.code,{children:"data"}),".\nSending the current value again also succeeds and repeats the recalculation below."]}),"\n",(0,r.jsxs)(n.admonition,{title:"Changing it rewrites tenant addresses",type:"warning",children:[(0,r.jsx)(n.p,{children:"Setting the base domain recalculates tenant domains:"}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"First setting"})," - organization tenants that already have a domain are rewritten. The first label of the existing\ndomain becomes the subdomain, giving ",(0,r.jsx)(n.code,{children:"{subdomain}.{new base domain}"}
1),". A domain with no dot becomes the base domain\nitself."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Change"})," - only tenants linked to this base domain are rewritten, each keeping its own subdomain."]}),"\n"]}),(0,r.jsx)(n.p,{children:"Tenants with no domain, or not linked to the base domain, are unchanged. If any recalculation fails, nothing is\napplied. Rewritten tenant URLs stop resolving at their old addresses, so plan for DNS, certificates, and any\nhard-coded client URLs before changing it."})]}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Code"}),(0,r.jsx)(n.th,{children:"Status"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"REQUEST_001"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"bd"})," is missing or longer than 253 characters"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"BASE_DOMAIN_002"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"bd"})," is not a valid domain"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"RESPONSE_001"})}),(0,r.jsx)(n.td,{children:"500"}),(0,r.jsx)(n.td,{children:"Unexpected server error"})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"BASE_DOMAIN_001"})," is not returned here. It is returned by tenant create and update when ",(0,r.jsx)(n.code,{children:"bs"})," names a base domain that\ndoes not exist."]}),"\n",(0,r.jsx)(n.h2,{id:"tenants",children:"Tenants"}),"\n",(0,r.jsx)(n.h3,{id:"list-tenants",children:"List tenants"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/tenants\n"})}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ps"})}),(0,r.jsx)(n.td,{children:"integer"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsxs)(n.td,{children:["Page size, minimum ",(0,r.jsx)(n.code,{children:"1"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ci"})}),(0,r.jsx)(n.td,{children:"long"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsxs)(n.td,{children:["Cursor - the last ",(0,r.jsx)(n.code,{children:"tenantSeq"})," of the previous page"]})]})]})]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="List tenants"',children:'curl "https://drive.example.com/api/external/v1/super-admin/tenants?ps=20" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["Results are ordered by ",(0,r.jsx)(n.code,{children:"tenantSeq"})," descending. When the page comes back full, the response carries ",(0,r.jsx)(n.code,{children:"hasNext: true"})," and\n",(0,r.jsx)(n.code,{children:"nextCursor"}),", the last ",(0,r.jsx)(n.code,{children:"tenantSeq"}),"; pass it as ",(0,r.jsx)(n.code,{children:"ci"})," for the next page."]}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"tenantSeq"})}),(0,r.jsx)(n.td,{children:"long"}),(0,r.jsx)(n.td,{children:"Tenant identifier"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"tenantName"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Tenant name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"domain"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"{subdomain}.{base domain}"}),", or ",(0,r.jsx)(n.code,{children:"null"})," when there is none"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"clientUrl"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"https://"})," followed by ",(0,r.jsx)(n.code,{children:"domain"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"registerDate"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"YYYY-MM-DD HH:mm:ss.SSS"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"license"})}),(0,r.jsx)(n.td,{children:"object"}),(0,r.jsxs)(n.td,{children:["Licence summary, or ",(0,r.jsx)(n.code,{children:"null"})]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"license"})," is ",(0,r.jsx)(n.code,{children:"null"})," for a tenant with no licence and also when its licence fails verification. Otherwise it carries\n",(0,r.jsx)(n.code,{children:"state"}),", ",(0,r.jsx)(n.code,{children:"expiresOn"})," (",(0,r.jsx)(n.code,{children:"YYYY-MM-DD"}),"), and ",(0,r.jsx)(n.code,{children:"seat"}),". ",(0,r.jsx)(n.code,{children:"seat"})," holds ",(0,r.jsx)(n.code,{children:"current"})," and ",(0,r.jsx)(n.code,{children:"max"})," only for a seat-limited licence and\nis ",(0,r.jsx)(n.code,{children:"null"})," for any other, so you can spot over-subscribed tenants only among seat-limited licences."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="List response"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "list": [\n {\n "tenantSeq": 12,\n "tenantName": "Example",\n "domain": "example.drive.example.com",\n "clientUrl": "https://example.drive.example.com",\n "registerDate": "2026-09-01 10:15:30.123",\n "license": null\n }\n ],\n "pageSize": 20,\n "hasNext": false\n }\n}\n'})}),"\n",(0,r.jsx)(n.h3,{id:"read-a-tenant",children:"Read a tenant"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/tenants/{tenantSeq}\n"})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Read tenant"',children:'curl "https://drive.example.com/api/external/v1/super-admin/tenants/12" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["Returns ",(0,r.jsx)(n.code,{children:"tenantSeq"}),", ",(0,r.jsx)(n.code,{children:"tenantName"}),", ",(0,r.jsx)(n.code,{children:"subdomain"}),", ",(0,r.jsx)(n.code,{children:"baseDomainSeq"}),", and ",(0,r.jsx)(n.code,{children:"allowedIps"}),". ",(0,r.jsx)(n.code,{children:"allowedIps"})," is always in\n",(0,r.jsx)(n.code,{children:"{IP}/{prefix}"})," form - a single address is reported as ",(0,r.jsx)(n.code,{children:"/32"}),". An unknown tenant returns ",(0,r.jsx)(n.code,{children:"TENANT_001"}),"."]}),"\n",(0,r.jsxs)(n.p,{children:["Note that the listing returns the assembled ",(0,r.jsx)(n.code,{children:"domain"})," while this endpoint returns the ",(0,r.jsx)(n.code,{children:"subdomain"})," it was built from."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Read response"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "tenantSeq": 12,\n "tenantName": "Example",\n "subdomain": "example",\n "baseDomainSeq": 1,\n "allowedIps": ["192.168.0.12/32", "192.168.0.0/24"]\n }\n}\n'})}),"\n",(0,r.jsx)(n.h3,{id:"create-a-tenant",children:"Create a tenant"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"POST /api/external/v1/super-admin/tenants\n"})}),"\n",(0,r.jsx)(n.p,{children:"Creates the tenant, its first administrator, and its IP allowlist in one call."}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"tn"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Tenant name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"sd"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Subdomain, up to 253 characters"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"bs"})}),(0,r.jsx)(n.td,{children:"integer"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Base domain seq"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"e"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Administrator account id, an email address; unique across all tenants"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"n"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Administrator display name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"p"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Administrator password"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ips"})}),(0,r.jsx)(n.td,{children:"array"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsx)(n.td,{children:"IPv4 addresses or CIDR ranges allowed to reach the administrator"})]})]})]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"sd"})," accepts lowercase letters, digits, and hyphens only; uppercase returns ",(0,r.jsx)(n.code,{children:"TENANT_007"}),". Each dot-separated label is\n1-63 characters and starts and ends with a lowercase letter or digit. The full domain is ",(0,r.jsx)(n.code,{children:"{sd}.{base domain}"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"e"})," must not match an account id already used in any tenant, or it returns ",(0,r.jsx)(n.code,{children:"USER_004"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"p"})," is 8-64 characters and contains at least one uppercase letter, lowercase letter, digit, and special character,\nor it returns ",(0,r.jsx)(n.code,{children:"USER_001"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"ips"})," supports IPv4 only, and a single address is stored as ",(0,r.jsx)(n.code,{children:"/32"}),". A CIDR range must be a network address -\n",(0,r.jsx)(n.code,{children:"192.168.0.0/24"})," is accepted, ",(0,r.jsx)(n.code,{children:"192.168.0.12/24"})," returns ",(0,r.jsx)(n.code,{children:"ACCESS_004"}),"."]}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Create tenant"',children:'curl -X POST "https://drive.example.com/api/external/v1/super-admin/tenants" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"tn": "Example", "sd": "example", "bs": 1, "e": "[email protected]", "n": "Administrator", "p": "Test1234!", "ips": ["192.168.0.12", "192.168.0.0/24"]}\'\n'})}
1),"\n",(0,r.jsxs)(n.p,{children:["A successful call returns ",(0,r.jsx)(n.code,{children:"201 Created"})," with no ",(0,r.jsx)(n.code,{children:"data"}),". Find the new ",(0,r.jsx)(n.code,{children:"tenantSeq"})," through the listing."]}),"\n",(0,r.jsxs)(n.p,{children:["The administrator is created with the ",(0,r.jsx)(n.code,{children:"ADMIN"})," role and zero storage quota, and the tenant's login type is local. If any\npart - tenant, administrator, allowlist, or default settings - fails, nothing is created."]}),"\n",(0,r.jsxs)(n.p,{children:["The new tenant starts with a default configuration. The office domain and adapter name are ",(0,r.jsx)(n.strong,{children:"empty"})," and must be set\nbefore the tenant can open documents. Default share settings are created as well: per-tenant, external sharing off,\n",(0,r.jsx)(n.code,{children:"SPECIFIC_USERS"})," on, ",(0,r.jsx)(n.code,{children:"ORG_LINK"})," on, and ",(0,r.jsx)(n.code,{children:"PUBLIC_LINK"})," off. Change these through the tenant's own ",(0,r.jsx)(n.a,{href:"/docs/management/api/admin",children:"Admin"}),"\nendpoints."]}),"\n",(0,r.jsx)(n.h3,{id:"update-a-tenant",children:"Update a tenant"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"PATCH /api/external/v1/super-admin/tenants/{tenantSeq}\n"})}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"tn"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Tenant name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"sd"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Subdomain, up to 253 characters"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"bs"})}),(0,r.jsx)(n.td,{children:"integer"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Base domain seq"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ips"})}),(0,r.jsx)(n.td,{children:"array"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsx)(n.td,{children:"Allowed IPv4 addresses or CIDR ranges; replaces the whole list"})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"sd"})," and ",(0,r.jsx)(n.code,{children:"ips"})," follow the same format rules as create. The tenant's own current domain does not count as a duplicate.\nChanging ",(0,r.jsx)(n.code,{children:"sd"})," changes the tenant's address."]}),"\n",(0,r.jsxs)(n.admonition,{type:"warning",children:[(0,r.jsxs)(n.mdxAdmonitionTitle,{children:[(0,r.jsx)(n.code,{children:"ips"})," replaces the allowlist"]}),(0,r.jsxs)(n.p,{children:["The list you send replaces the existing allowed IPs, and an empty array removes them all. All three of ",(0,r.jsx)(n.code,{children:"tn"}),", ",(0,r.jsx)(n.code,{children:"sd"}),", and\n",(0,r.jsx)(n.code,{children:"bs"})," are required too, so read the tenant first and resend its current values - including ",(0,r.jsx)(n.code,{children:"allowedIps"})," - for anything\nyou are not changing."]})]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Update tenant"',children:'curl -X PATCH "https://drive.example.com/api/external/v1/super-admin/tenants/12" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"tn": "Example Inc.", "sd": "example", "bs": 1, "ips": ["192.168.0.12/32", "192.168.0.0/24"]}\'\n'})}),"\n",(0,r.jsx)(n.h3,{id:"search-a-tenants-accounts",children:"Search a tenant's accounts"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/tenants/{tenantSeq}/users/search\n"})}),"\n",(0,r.jsx)(n.p,{children:"Finds accounts in a tenant, for choosing the target of an API Key on the super admin surface."}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"sk"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsx)(n.td,{children:"Partial match on account id or name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"rt"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"ADMIN"})," or ",(0,r.jsx)(n.code,{children:"USER"}),"; both when omitted. Any other role returns ",(0,r.jsx)(n.code,{children:"USER_028"})]})]})]})]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Search tenant accounts"',children:'curl "https://drive.example.com/api/external/v1/super-admin/tenants/12/users/search?sk=admin&rt=ADMIN" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["Only active accounts are returned, ordered by name ascending, with no paging. Each entry has ",(0,r.jsx)(n.code,{children:"userSeq"}),", ",(0,r.jsx)(n.code,{children:"userId"}),",\n",(0,r.jsx)(n.code,{children:"userName"}),", ",(0,r.jsx)(n.code,{children:"status"}),", and ",(0,r.jsx)(n.code,{children:"roleType"}),". An unknown tenant returns ",(0,r.jsx)(n.code,{children:"TENANT_001"}),"."]}),"\n",(0,r.jsx)(n.h3,{id:"tenant-errors",children:"Tenant errors"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Code"}),(0,r.jsx)(n.th,{children:"Status"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"REQUEST_001"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsx)(n.td,{children:"A required value is missing or too long"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"TENANT_001"})}),(0,r.jsx)(n.td,{children:"404"}),(0,r.jsx)(n.td,{children:"The tenant was not found"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"TENANT_006"})}),(0,r.jsx)(n.td,{children:"409"}),(0,r.jsx)(n.td,{children:"The domain is already in use"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"TENANT_007"})}),(0,r.jsx)(n.td,{children:"400"}
1),(0,r.jsx)(n.td,{children:"The subdomain is not valid"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"BASE_DOMAIN_001"})}),(0,r.jsx)(n.td,{children:"404"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"bs"})," names a base domain that does not exist"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"USER_001"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsx)(n.td,{children:"The administrator password does not meet the rules"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"USER_002"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsx)(n.td,{children:"The administrator id is not a valid email address"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"USER_004"})}),(0,r.jsx)(n.td,{children:"409"}),(0,r.jsx)(n.td,{children:"The administrator id is already in use"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"USER_013"})}),(0,r.jsx)(n.td,{children:"500"}),(0,r.jsx)(n.td,{children:"The administrator account could not be saved"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"USER_028"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsxs)(n.td,{children:["Account search ",(0,r.jsx)(n.code,{children:"rt"})," is not ",(0,r.jsx)(n.code,{children:"ADMIN"})," or ",(0,r.jsx)(n.code,{children:"USER"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ACCESS_004"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsx)(n.td,{children:"An IP address or CIDR range is not valid"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"RESPONSE_001"})}),(0,r.jsx)(n.td,{children:"500"}),(0,r.jsx)(n.td,{children:"Unexpected server error"})]})]})]}),"\n",(0,r.jsx)(n.h2,{id:"sign-in-policy",children:"Sign-in policy"}),"\n",(0,r.jsx)(n.p,{children:"The same sign-in configuration as the tenant-level endpoint, with the addition that a super administrator can impose it\non every tenant at once."}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/login-settings\nPUT /api/external/v1/super-admin/login-settings\n"})}),"\n",(0,r.jsx)(n.h3,{id:"read-the-sign-in-policy",children:"Read the sign-in policy"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"s"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsxs)(n.td,{children:["Scope to build the response for - ",(0,r.jsx)(n.code,{children:"tenant"})," or ",(0,r.jsx)(n.code,{children:"global"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"l"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"No"}),(0,r.jsxs)(n.td,{children:["Login type to build the response for - ",(0,r.jsx)(n.code,{children:"local"}),", ",(0,r.jsx)(n.code,{children:"oidc"}),", or ",(0,r.jsx)(n.code,{children:"jwt"})]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"s"})," and ",(0,r.jsx)(n.code,{children:"l"})," do not filter stored values; they choose which view of the setting is returned. Precedence is ",(0,r.jsx)(n.code,{children:"s"}),", then\n",(0,r.jsx)(n.code,{children:"l"}),", then the stored enforcement flag:"]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"s=tenant"})," returns the per-tenant view: ",(0,r.jsx)(n.code,{children:"loginType"})," ",(0,r.jsx)(n.code,{children:"null"}),", ",(0,r.jsx)(n.code,{children:"isEnforced"})," ",(0,r.jsx)(n.code,{children:"false"}),", and an empty ",(0,r.jsx)(n.code,{children:"configs"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"s=global"}),", or ",(0,r.jsx)(n.code,{children:"l"})," given, returns the providers for that login type. ",(0,r.jsx)(n.code,{children:"l"})," takes the place of the stored login type."]}),"\n",(0,r.jsx)(n.li,{children:"With neither, the response follows the stored enforcement flag."}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Read sign-in policy"',children:'curl "https://drive.example.com/api/external/v1/super-admin/login-settings?s=global&l=oidc" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.p,{children:["The response carries ",(0,r.jsx)(n.code,{children:"superAdminLoginSettingSeq"}),", ",(0,r.jsx)(n.code,{children:"loginType"}),", ",(0,r.jsx)(n.code,{children:"isEnforced"}),", and ",(0,r.jsx)(n.code,{children:"configs"}),". ",(0,r.jsx)(n.code,{children:"configs"})," holds only\nproviders registered for global enforcement. For OIDC, ",(0,r.jsx)(n.code,{children:"scopes"})," is always ",(0,r.jsx)(n.code,{children:"null"})," and ",(0,r.jsx)(n.code,{children:"allowIdpInitiated"})," is always\n",(0,r.jsx)(n.code,{children:"false"}),"; ",(0,r.jsx)(n.code,{children:"registerDate"})," appears only on OIDC providers. With no setting saved, every value is ",(0,r.jsx)(n.code,{children:"null"})," and ",(0,r.jsx)(n.code,{children:"configs"})," is\nempty, whatever the parameters."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Enforced JWT"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "superAdminLoginSettingSeq": 1,\n "loginType": "jwt",\n "isEnforced": true,\n "configs": [\n {\n "ssoProviderSeq": 3,\n "displayName": "Example SSO",\n "status": "ACTIVE",\n "config": {\n "type": "jwt",\n "issuer": "https://sso.example.com",\n "keySourceType": "public_key",\n "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."\n }\n }\n ]\n }\n}\n'})}),"\n",(0,r.jsx)(n.admonition,{title:"The read endpoint returns secrets in clear text",type:"warning",children:(0,r.jsxs)(n.p,{children:["As at tenant level, ",(0,r.jsx)(n.code,{children:"clientSecret"})," and ",(0,r.jsx)(n.code,{children:"publicKey"})," come back unmasked. Keep the response server-side."]})}),"\n",(0,r.jsx)(n.h3,{id:"set-the-sign-in-policy",children:"Set the sign-in policy"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ie"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"true"}
1)," applies this setting to every tenant; ",(0,r.jsx)(n.code,{children:"false"})," leaves each tenant to its own"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"l"})}),(0,r.jsx)(n.td,{children:"string"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Login type - ",(0,r.jsx)(n.code,{children:"local"}),", ",(0,r.jsx)(n.code,{children:"oidc"}),", or ",(0,r.jsx)(n.code,{children:"jwt"}),"; required when ",(0,r.jsx)(n.code,{children:"ie"})," is ",(0,r.jsx)(n.code,{children:"true"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ps"})}),(0,r.jsx)(n.td,{children:"array"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Identity providers; required when ",(0,r.jsx)(n.code,{children:"ie"})," is ",(0,r.jsx)(n.code,{children:"true"})," and ",(0,r.jsx)(n.code,{children:"l"})," is ",(0,r.jsx)(n.code,{children:"oidc"})," or ",(0,r.jsx)(n.code,{children:"jwt"})]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:["Providers and their ",(0,r.jsx)(n.code,{children:"config"})," objects take the same fields as the tenant-level endpoint described in\n",(0,r.jsx)(n.a,{href:"/docs/management/api/admin",children:"Admin"}),". A ",(0,r.jsx)(n.code,{children:"config.type"})," that differs from ",(0,r.jsx)(n.code,{children:"l"})," returns ",(0,r.jsx)(n.code,{children:"REQUEST_001"}),", and an ",(0,r.jsx)(n.code,{children:"l"})," value that is not defined,\nsuch as ",(0,r.jsx)(n.code,{children:"saml"}),", returns ",(0,r.jsx)(n.code,{children:"RESPONSE_001"}),". ",(0,r.jsx)(n.code,{children:"SSO_PROTOCOL_001"})," and ",(0,r.jsx)(n.code,{children:"SSO_PROTOCOL_002"})," are not returned by this endpoint."]}),"\n",(0,r.jsxs)(n.p,{children:["With ",(0,r.jsx)(n.code,{children:"ie=false"}),", ",(0,r.jsx)(n.code,{children:"l"})," and ",(0,r.jsx)(n.code,{children:"ps"})," are ignored and the stored global providers are kept, not deleted."]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"OIDC"})," - saving with ",(0,r.jsx)(n.code,{children:"l=oidc"})," replaces the provider list with ",(0,r.jsx)(n.code,{children:"ps"}),". Existing providers missing from the request are\n",(0,r.jsx)(n.strong,{children:"deleted"}),"; to keep one, send it back with its ",(0,r.jsx)(n.code,{children:"ssoProviderSeq"}),". Exactly one provider must have ",(0,r.jsx)(n.code,{children:"status"})," ",(0,r.jsx)(n.code,{children:"ACTIVE"}),",\nor the call returns ",(0,r.jsx)(n.code,{children:"REQUEST_001"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"JWT"})," - one provider only. If an active JWT provider already exists, send its ",(0,r.jsx)(n.code,{children:"ssoProviderSeq"})," to update it;\nsending none returns ",(0,r.jsx)(n.code,{children:"SSO_PROVIDER_005"}),". ",(0,r.jsx)(n.code,{children:"status"})," is always saved as ",(0,r.jsx)(n.code,{children:"ACTIVE"}),". An ",(0,r.jsx)(n.code,{children:"issuer"})," already used by another\nJWT provider returns ",(0,r.jsx)(n.code,{children:"SSO_PROTOCOL_JWT_002"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"displayName"})," must be unique within the request after trimming, or the call returns ",(0,r.jsx)(n.code,{children:"REQUEST_001"}),". An\n",(0,r.jsx)(n.code,{children:"ssoProviderSeq"})," that does not exist or is not a global provider returns ",(0,r.jsx)(n.code,{children:"SSO_PROVIDER_001"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"publicKey"})," is stored with the PEM header and footer and all whitespace removed, and is read back in that form."]}),"\n"]}),"\n",(0,r.jsxs)(n.p,{children:["A successful call returns ",(0,r.jsx)(n.code,{children:"200 OK"})," with no ",(0,r.jsx)(n.code,{children:"data"}),". While ",(0,r.jsx)(n.code,{children:"ie"})," is ",(0,r.jsx)(n.code,{children:"true"}),", a tenant administrator who tries to change the\ntenant's sign-in settings gets ",(0,r.jsx)(n.code,{children:"SSO_PROVIDER_006"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Enforce local sign-in"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/login-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"ie": true, "l": "local"}\'\n'})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Enforce OIDC"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/login-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"ie": true, "l": "oidc", "ps": [{"displayName": "Example SSO", "status": "ACTIVE", "config": {"type": "oidc", "issuerUrl": "https://sso.example.com", "clientId": "example-client", "clientSecret": "replace-with-your-client-secret"}}]}\'\n'})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Enforce JWT"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/login-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"ie": true, "l": "jwt", "ps": [{"ssoProviderSeq": 3, "displayName": "Example SSO", "config": {"type": "jwt", "issuer": "https://sso.example.com", "keySourceType": "public_key", "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."}}]}\'\n'})}),"\n",(0,r.jsx)(n.admonition,{title:"The field names differ from the tenant endpoint",type:"note",children:(0,r.jsxs)(n.p,{children:["This endpoint uses ",(0,r.jsx)(n.code,{children:"l"})," and ",(0,r.jsx)(n.code,{children:"ps"})," where the tenant endpoint uses ",(0,r.jsx)(n.code,{children:"loginType"})," and ",(0,r.jsx)(n.code,{children:"providers"}),", and adds ",(0,r.jsx)(n.code,{children:"ie"}),". The read\nresponse reports ",(0,r.jsx)(n.code,{children:"isEnforced"})," rather than ",(0,r.jsx)(n.code,{children:"superAdminEnforced"}),". The ",(0,r.jsx)(n.code,{children:"config"})," objects are identical."]})}),"\n",(0,r.jsx)(n.h3,{id:"sign-in-policy-errors",children:"Sign-in policy errors"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Code"}),(0,r.jsx)(n.th,{children:"Status"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"REQUEST_001"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsxs)(n.td,{children:["A required value is missing or a rule is broken;
1 also an invalid ",(0,r.jsx)(n.code,{children:"s"})," or ",(0,r.jsx)(n.code,{children:"l"})," on read"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"SSO_PROVIDER_001"})}),(0,r.jsx)(n.td,{children:"404"}),(0,r.jsxs)(n.td,{children:["The ",(0,r.jsx)(n.code,{children:"ssoProviderSeq"})," does not exist or is not a global provider"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"SSO_PROVIDER_005"})}),(0,r.jsx)(n.td,{children:"409"}),(0,r.jsxs)(n.td,{children:["An active JWT provider exists and no ",(0,r.jsx)(n.code,{children:"ssoProviderSeq"})," was sent"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"SSO_PROTOCOL_JWT_002"})}),(0,r.jsx)(n.td,{children:"409"}),(0,r.jsxs)(n.td,{children:["The JWT ",(0,r.jsx)(n.code,{children:"issuer"})," is already used by another provider"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"RESPONSE_001"})}),(0,r.jsx)(n.td,{children:"500"}),(0,r.jsxs)(n.td,{children:["Unexpected server error, including an undefined ",(0,r.jsx)(n.code,{children:"l"})," on save"]})]})]})]}),"\n",(0,r.jsx)(n.h2,{id:"sharing-policy",children:"Sharing policy"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-http",children:"GET /api/external/v1/super-admin/share-settings\nPUT /api/external/v1/super-admin/share-settings\n"})}),"\n",(0,r.jsx)(n.h3,{id:"read-the-sharing-policy",children:"Read the sharing policy"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Read sharing policy"',children:'curl "https://drive.example.com/api/external/v1/super-admin/share-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY"\n'})}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Field"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"shareSettingSeq"})}),(0,r.jsx)(n.td,{children:"long"}),(0,r.jsx)(n.td,{children:"Setting identifier"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"isEnforced"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Whether the policy is applied to every tenant"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"shareEnabled"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Whether sharing is available"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"externalShareAllowed"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Sharing outside the organization"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"allowSpecificUsers"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"SPECIFIC_USERS"})," share type"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"allowOrgLink"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"ORG_LINK"})," share type"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"allowPublic"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"PUBLIC_LINK"})," share type"]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:["Even when ",(0,r.jsx)(n.code,{children:"isEnforced"})," is ",(0,r.jsx)(n.code,{children:"false"}),", the stored values are returned - the values last enforced. With no setting saved,\nevery field is ",(0,r.jsx)(n.code,{children:"null"}),"."]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-json",metastring:'title="Enforced"',children:'{\n "result": true,\n "code": 200,\n "message": "OK",\n "data": {\n "shareSettingSeq": 1,\n "isEnforced": true,\n "shareEnabled": true,\n "externalShareAllowed": false,\n "allowSpecificUsers": true,\n "allowOrgLink": true,\n "allowPublic": false\n }\n}\n'})}),"\n",(0,r.jsx)(n.h3,{id:"set-the-sharing-policy",children:"Set the sharing policy"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter"}),(0,r.jsx)(n.th,{children:"Type"}),(0,r.jsx)(n.th,{children:"Required"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"e"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Yes"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"true"}
1)," applies this setting to every tenant; ",(0,r.jsx)(n.code,{children:"false"})," leaves each tenant to its own"]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"se"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Whether sharing is available; required when ",(0,r.jsx)(n.code,{children:"e"})," is ",(0,r.jsx)(n.code,{children:"true"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"esa"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Allow sharing outside the organization; required when ",(0,r.jsx)(n.code,{children:"e"})," and ",(0,r.jsx)(n.code,{children:"se"})," are ",(0,r.jsx)(n.code,{children:"true"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"sua"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Allow the ",(0,r.jsx)(n.code,{children:"SPECIFIC_USERS"})," share type; required when ",(0,r.jsx)(n.code,{children:"e"})," and ",(0,r.jsx)(n.code,{children:"se"})," are ",(0,r.jsx)(n.code,{children:"true"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ola"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Allow the ",(0,r.jsx)(n.code,{children:"ORG_LINK"})," share type; required when ",(0,r.jsx)(n.code,{children:"e"})," and ",(0,r.jsx)(n.code,{children:"se"})," are ",(0,r.jsx)(n.code,{children:"true"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"pa"})}),(0,r.jsx)(n.td,{children:"boolean"}),(0,r.jsx)(n.td,{children:"Conditional"}),(0,r.jsxs)(n.td,{children:["Allow the ",(0,r.jsx)(n.code,{children:"PUBLIC_LINK"})," share type; required when ",(0,r.jsx)(n.code,{children:"e"})," and ",(0,r.jsx)(n.code,{children:"se"})," are ",(0,r.jsx)(n.code,{children:"true"})]})]})]})]}),"\n",(0,r.jsxs)(n.p,{children:["When enforcing with sharing on, at least one of ",(0,r.jsx)(n.code,{children:"sua"}),", ",(0,r.jsx)(n.code,{children:"ola"}),", and ",(0,r.jsx)(n.code,{children:"pa"})," must be ",(0,r.jsx)(n.code,{children:"true"}),", and enabling ",(0,r.jsx)(n.code,{children:"pa"})," requires ",(0,r.jsx)(n.code,{children:"esa"}),"\nto be ",(0,r.jsx)(n.code,{children:"true"})," as well - the same rules as the tenant endpoint."]}),"\n",(0,r.jsxs)(n.p,{children:["Values that do not apply are ignored and the stored ones kept. With ",(0,r.jsx)(n.code,{children:"e=false"}),", ",(0,r.jsx)(n.code,{children:"se"}),", ",(0,r.jsx)(n.code,{children:"esa"}),", ",(0,r.jsx)(n.code,{children:"sua"}),", ",(0,r.jsx)(n.code,{children:"ola"}),", and ",(0,r.jsx)(n.code,{children:"pa"})," are\nignored and no shares are cleaned up. With ",(0,r.jsx)(n.code,{children:"e=true"})," and ",(0,r.jsx)(n.code,{children:"se=false"}),", ",(0,r.jsx)(n.code,{children:"esa"}),", ",(0,r.jsx)(n.code,{children:"sua"}),", ",(0,r.jsx)(n.code,{children:"ola"}),", and ",(0,r.jsx)(n.code,{children:"pa"})," are ignored."]}),"\n",(0,r.jsxs)(n.p,{children:["A successful call returns ",(0,r.jsx)(n.code,{children:"200 OK"})," with no ",(0,r.jsx)(n.code,{children:"data"}),". While ",(0,r.jsx)(n.code,{children:"e"})," is ",(0,r.jsx)(n.code,{children:"true"}),", every tenant's own share settings endpoint\nreports ",(0,r.jsx)(n.code,{children:"isEnforced"})," and returns these global values instead of its own."]}),"\n",(0,r.jsxs)(n.admonition,{title:"Enforcing can delete existing shares, and reverting does not restore them",type:"danger",children:[(0,r.jsxs)(n.p,{children:["Saving with ",(0,r.jsx)(n.code,{children:"e=true"})," compares each organization tenant's previous settings with the new ones, and deletes existing\nshares for every item that narrows from allowed to not allowed:"]}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Sharing turned off - every share in the tenant."}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"SPECIFIC_USERS"}),", ",(0,r.jsx)(n.code,{children:"ORG_LINK"}),", or ",(0,r.jsx)(n.code,{children:"PUBLIC_LINK"})," disallowed - shares of that type, with their targets and the recent,\nstarred, and pinned-folder entries that depend on them."]}
1),"\n",(0,r.jsx)(n.li,{children:"External sharing disallowed - share targets in other tenants, and those users' recent, starred, and pinned-folder\nentries."}),"\n"]}),(0,r.jsxs)(n.p,{children:["Setting ",(0,r.jsx)(n.code,{children:"e"})," back to ",(0,r.jsx)(n.code,{children:"false"})," returns each tenant to its own settings, but the deleted shares are not recovered."]})]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Leave each tenant to its own"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/share-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"e": false}\'\n'})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Enforce with sharing off"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/share-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"e": true, "se": false}\'\n'})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",metastring:'title="Enforce with sharing on"',children:'curl -X PUT "https://drive.example.com/api/external/v1/super-admin/share-settings" \\\n -H "Authorization: Bearer replace-with-your-SUPERADMIN-API-KEY" \\\n -H "Content-Type: application/json" \\\n -d \'{"e": true, "se": true, "esa": false, "sua": true, "ola": true, "pa": false}\'\n'})}),"\n",(0,r.jsx)(n.h3,{id:"sharing-policy-errors",children:"Sharing policy errors"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Code"}),(0,r.jsx)(n.th,{children:"Status"}),(0,r.jsx)(n.th,{children:"Meaning"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"REQUEST_001"})}),(0,r.jsx)(n.td,{children:"400"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"e"})," missing; ",(0,r.jsx)(n.code,{children:"se"})," missing when enforcing; ",(0,r.jsx)(n.code,{children:"esa"}),", ",(0,r.jsx)(n.code,{children:"sua"}),", ",(0,r.jsx)(n.code,{children:"ola"}),", or ",(0,r.jsx)(n.code,{children:"pa"})," missing when enforcing with sharing on; ",(0,r.jsx)(n.code,{children:"sua"}),", ",(0,r.jsx)(n.code,{children:"ola"}),", and ",(0,r.jsx)(n.code,{children:"pa"})," all ",(0,r.jsx)(n.code,{children:"false"}),"; or ",(0,r.jsx)(n.code,{children:"pa"})," ",(0,r.jsx)(n.code,{children:"true"})," with ",(0,r.jsx)(n.code,{children:"esa"})," ",(0,r.jsx)(n.code,{children:"false"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"RESPONSE_001"})}),(0,r.jsx)(n.td,{children:"500"}),(0,r.jsx)(n.td,{children:"Unexpected server error"})]})]})]}),"\n",(0,r.jsx)(n.h2,{id:"errors",children:"Errors"}),"\n",(0,r.jsxs)(n.p,{children:["See ",(0,r.jsx)(n.a,{href:"/docs/management/api/errors",children:"Errors"})," for the full list of codes across the API."]})]})}function o(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},8453(e,n,s){s.d(n,{R:()=>t,x:()=>c});var d=s(6540);const r={},i=d.createContext(r);function t(e){const n=d.useContext(i);return d.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:t(e.components),d.createElement(i.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.