API reference
Reviewed project clients
8 management API operations for Reviewed project clients.
/v1/projects/{project_id}/permission-catalogsList reviewed permission catalogs
POST/v1/projects/{project_id}/permission-catalogsPropose an immutable permission catalog
POST/v1/projects/{project_id}/permission-catalogs/{catalog_id}/approveIndependently approve a catalog
POST/v1/projects/{project_id}/permission-catalogs/{catalog_id}/revokeRevoke an approved catalog
GET/v1/projects/{project_id}/owned-clientsList reviewed owned-client proposals
POST/v1/projects/{project_id}/owned-clientsPropose an exact owned-client registration policy
POST/v1/projects/{project_id}/owned-clients/{policy_id}/approveIndependently approve an owned-client proposal
POST/v1/projects/{project_id}/owned-clients/{policy_id}/revokeRevoke an owned-client proposal
GET/v1/projects/{project_id}/permission-catalogs
List reviewed permission catalogs
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes |
Request body
This operation has no request body.
Responses
200Successful Response
Content type: application/jsonCatalogList
| Field | Type | Required | Description |
|---|---|---|---|
catalogs | CatalogRead[] | Yes | |
_actions | catalog-propose[] | Yes |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/permission-catalogs
Propose an immutable permission catalog
Current project owner proposes a versioned catalog. A separate current platform project approver must approve it. Idempotency-Key replays the exact actor and body.
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredCatalogProposal
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
permissions | Permission[] | Yes | Validation: min items 1; max items 32 |
Responses
201Successful Response
Content type: application/jsonCatalogRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
revision | integer | Yes | |
permissions | Permission[] | Yes | |
digest | string | Yes | |
status | pending_review | approved | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocations | RevocationRead[] | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/permission-catalogs/{catalog_id}/approve
Independently approve a catalog
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
catalog_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredidentity__owned_client_router__Reason
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
Responses
200Successful Response
Content type: application/jsonCatalogRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
revision | integer | Yes | |
permissions | Permission[] | Yes | |
digest | string | Yes | |
status | pending_review | approved | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocations | RevocationRead[] | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/permission-catalogs/{catalog_id}/revoke
Revoke an approved catalog
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
catalog_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredidentity__owned_client_router__Reason
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
Responses
200Successful Response
Content type: application/jsonCatalogRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
revision | integer | Yes | |
permissions | Permission[] | Yes | |
digest | string | Yes | |
status | pending_review | approved | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocations | RevocationRead[] | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
GET/v1/projects/{project_id}/owned-clients
List reviewed owned-client proposals
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes |
Request body
This operation has no request body.
Responses
200Successful Response
Content type: application/jsonClientList
| Field | Type | Required | Description |
|---|---|---|---|
clients | ClientRead[] | Yes | |
_actions | client-propose[] | Yes |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/owned-clients
Propose an exact owned-client registration policy
Requires a controlled credential preparation and fresh private issuer custody readback. Stores the full immutable registration and versioned digest with exact accepted owner and catalog evidence for independent review. Approval does not install a client or authorize an assignment. Idempotency-Key replays the exact actor and body after current authority and fresh custody checks.
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredClientProposal
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
target_issuer | string | Yes | Validation: min length 1; max length 2048 |
client_id | string | Yes | Validation: min length 1; max length 128 |
client_version | integer | Yes | Validation: minimum 1; maximum 9223372036854775807 |
display_name | string | Yes | Validation: min length 3; max length 120 |
catalog_id | string | Yes | Validation: min length 1; max length 200 |
credential_preparation_id | string | Yes | Canonical preparation UUID from controlled credential delivery. Management verifies fresh private issuer readback; browser proof is reference metadata only. Validation: min length 36; max length 36 |
permission_ids | string[] | Yes | Validation: min items 1; max items 32 |
registration | RegistrationProposal | Yes |
Responses
201Successful Response
Content type: application/jsonClientRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
target_issuer | string | Yes | |
client_id | string | Yes | |
client_version | integer | Yes | |
generation | integer | Yes | |
display_name | string | Yes | |
catalog_id | string | Yes | |
catalog_digest | string | Yes | |
permission_ids | string[] | Yes | |
registration | RegistrationRead | Yes | |
registration_digest | string | Yes | |
policy_digest | string | Yes | |
credential_preparation_id | string | null | No | |
custody_binding_digest | string | null | No | |
status | pending_review | approved_pending_readback | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocation | RevocationRead | null | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/owned-clients/{policy_id}/approve
Independently approve an owned-client proposal
Obtains fresh private custody readback before source locks and records an independent current approver with the exact proposal and approved catalog evidence. The approved_pending_readback state still requires separate reviewed installation and product acknowledgement.
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
policy_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredidentity__owned_client_router__Reason
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
Responses
200Successful Response
Content type: application/jsonClientRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
target_issuer | string | Yes | |
client_id | string | Yes | |
client_version | integer | Yes | |
generation | integer | Yes | |
display_name | string | Yes | |
catalog_id | string | Yes | |
catalog_digest | string | Yes | |
permission_ids | string[] | Yes | |
registration | RegistrationRead | Yes | |
registration_digest | string | Yes | |
policy_digest | string | Yes | |
credential_preparation_id | string | null | No | |
custody_binding_digest | string | null | No | |
status | pending_review | approved_pending_readback | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocation | RevocationRead | null | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |
POST/v1/projects/{project_id}/owned-clients/{policy_id}/revoke
Revoke an owned-client proposal
Authentication Bearer access token with audience taifa-management. Roles and local eligibility are reviewed separately from the OpenAPI bearer scheme.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
project_id | path | string | Yes | |
policy_id | path | string | Yes | |
idempotency-key | header | string | Yes |
Request body
application/jsonRequiredidentity__owned_client_router__Reason
| Field | Type | Required | Description |
|---|---|---|---|
reason | string | Yes | Validation: min length 8; max length 500 |
Responses
200Successful Response
Content type: application/jsonClientRead
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | |
project_id | string | Yes | |
target_issuer | string | Yes | |
client_id | string | Yes | |
client_version | integer | Yes | |
generation | integer | Yes | |
display_name | string | Yes | |
catalog_id | string | Yes | |
catalog_digest | string | Yes | |
permission_ids | string[] | Yes | |
registration | RegistrationRead | Yes | |
registration_digest | string | Yes | |
policy_digest | string | Yes | |
credential_preparation_id | string | null | No | |
custody_binding_digest | string | null | No | |
status | pending_review | approved_pending_readback | superseded | revoked | Yes | |
proposer | string | Yes | |
approver | string | null | Yes | |
created_at | string | Yes | |
expires_at | string | Yes | |
actions | (approve | revoke)[] | Yes | |
revocation | RevocationRead | null | No |
Other responses
| Status | Description | Schema |
|---|---|---|
| 403 | Current project authority or independent review required | |
| 409 | Current exact proposal, catalog, version or idempotency conflict | |
| 413 | Exact JSON request exceeds 64 KiB | |
| 422 | Invalid exact reviewed policy or registration | |
| 503 | Configured owned issuer authority unavailable |