# Standalone workforce admission

5 management API operations.

- [GET /v1/institutions/{institution_id}/auth-engine-enrollments](/docs/api/operations/inventory_v1_institutions__institution_id__auth_engine_enrollments_get): Inventory
- [POST /v1/institutions/{institution_id}/auth-engine-enrollments](/docs/api/operations/propose_v1_institutions__institution_id__auth_engine_enrollments_post): Propose
- [GET /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/review](/docs/api/operations/review_details_v1_institutions__institution_id__auth_engine_enrollments__identifier__review_get): Review Details
- [POST /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/approve](/docs/api/operations/approve_v1_institutions__institution_id__auth_engine_enrollments__identifier__approve_post): Approve
- [POST /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/cancel](/docs/api/operations/cancel_v1_institutions__institution_id__auth_engine_enrollments__identifier__cancel_post): Cancel

## GET /v1/institutions/{institution_id}/auth-engine-enrollments

Inventory

Inventory

Authentication: bearer access token with audience `taifa-management`. Endpoint roles and eligibility are reviewed separately from the OpenAPI bearer scheme.

No operation-specific scopes are declared in the OpenAPI document. Bearer authentication and endpoint authorization requirements still apply.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `institution_id` | path | string | Yes |  |

### Request body

This operation has no request body.

### Responses

#### 200

Successful Response

No fields declared in the current specification.

#### 422

Validation Error

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `detail` |  | ValidationError[] | No |  |

### Request examples

Illustrative only. Replace placeholders and keep management tokens on the server.

#### cURL

```sh
curl -X GET 'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

#### TypeScript (Node.js/server-side)

```typescript
const response = await fetch('https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.TAIFA_MANAGEMENT_TOKEN}`
  }
});

const result = await response.json();
```

#### Python

```python
import os
import requests

response = requests.request(
    'GET',
    'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments',
    headers={'Authorization': 'Bearer ' + os.environ['TAIFA_MANAGEMENT_TOKEN']}
)
response.raise_for_status()
```

### Response example

No response example in the current specification.


[Request and response examples](/docs/api/operations/inventory_v1_institutions__institution_id__auth_engine_enrollments_get)

## POST /v1/institutions/{institution_id}/auth-engine-enrollments

Propose

Propose

Authentication: bearer access token with audience `taifa-management`. Endpoint roles and eligibility are reviewed separately from the OpenAPI bearer scheme.

No operation-specific scopes are declared in the OpenAPI document. Bearer authentication and endpoint authorization requirements still apply.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `institution_id` | path | string | Yes |  |
| `idempotency-key` | header | string | Yes |  |

### Request body

#### application/json

Required; FreshEnrollmentCreate

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reason` |  | string | Yes | Validation: min length 8; max length 500 |
| `recipient` |  | string | Yes | Validation: min length 3; max length 254 |

### Responses

#### 201

Successful Response

No fields declared in the current specification.

#### 422

Validation Error

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `detail` |  | ValidationError[] | No |  |

### Request examples

Illustrative only. Replace placeholders and keep management tokens on the server.

#### cURL

```sh
curl -X POST 'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'idempotency-key: REPLACE_WITH_IDEMPOTENCY_KEY' \
  -H 'Content-Type: application/json' \
  --data '{
  "reason": "REPLACE_WITH_REASON",
  "recipient": "REPLACE_WITH_RECIPIENT"
}'
```

#### TypeScript (Node.js/server-side)

```typescript
const response = await fetch('https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.TAIFA_MANAGEMENT_TOKEN}`,
    'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
  "reason": "REPLACE_WITH_REASON",
  "recipient": "REPLACE_WITH_RECIPIENT"
})
});

const result = await response.json();
```

#### Python

```python
import os
import json
import requests

response = requests.request(
    'POST',
    'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments',
    headers={'Authorization': 'Bearer ' + os.environ['TAIFA_MANAGEMENT_TOKEN'], 'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY'},
    json=json.loads('{"reason":"REPLACE_WITH_REASON","recipient":"REPLACE_WITH_RECIPIENT"}')
)
response.raise_for_status()
```

### Response example

No response example in the current specification.


[Request and response examples](/docs/api/operations/propose_v1_institutions__institution_id__auth_engine_enrollments_post)

## GET /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/review

Review Details

Review Details

Authentication: bearer access token with audience `taifa-management`. Endpoint roles and eligibility are reviewed separately from the OpenAPI bearer scheme.

No operation-specific scopes are declared in the OpenAPI document. Bearer authentication and endpoint authorization requirements still apply.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `institution_id` | path | string | Yes |  |
| `identifier` | path | string | Yes |  |

### Request body

This operation has no request body.

### Responses

#### 200

Successful Response

No fields declared in the current specification.

#### 422

Validation Error

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `detail` |  | ValidationError[] | No |  |

### Request examples

Illustrative only. Replace placeholders and keep management tokens on the server.

#### cURL

```sh
curl -X GET 'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/review' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

#### TypeScript (Node.js/server-side)

```typescript
const response = await fetch('https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/review', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.TAIFA_MANAGEMENT_TOKEN}`
  }
});

const result = await response.json();
```

#### Python

```python
import os
import requests

response = requests.request(
    'GET',
    'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/review',
    headers={'Authorization': 'Bearer ' + os.environ['TAIFA_MANAGEMENT_TOKEN']}
)
response.raise_for_status()
```

### Response example

No response example in the current specification.


[Request and response examples](/docs/api/operations/review_details_v1_institutions__institution_id__auth_engine_enrollments__identifier__review_get)

## POST /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/approve

Approve

Approve

Authentication: bearer access token with audience `taifa-management`. Endpoint roles and eligibility are reviewed separately from the OpenAPI bearer scheme.

No operation-specific scopes are declared in the OpenAPI document. Bearer authentication and endpoint authorization requirements still apply.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `institution_id` | path | string | Yes |  |
| `identifier` | path | string | Yes |  |
| `idempotency-key` | header | string | Yes |  |

### Request body

#### application/json

Required; identity__auth_engine_enrollment_router__Reason

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reason` |  | string | Yes | Validation: min length 8; max length 500 |

### Responses

#### 200

Successful Response

No fields declared in the current specification.

#### 422

Validation Error

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `detail` |  | ValidationError[] | No |  |

### Request examples

Illustrative only. Replace placeholders and keep management tokens on the server.

#### cURL

```sh
curl -X POST 'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/approve' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'idempotency-key: REPLACE_WITH_IDEMPOTENCY_KEY' \
  -H 'Content-Type: application/json' \
  --data '{
  "reason": "REPLACE_WITH_REASON"
}'
```

#### TypeScript (Node.js/server-side)

```typescript
const response = await fetch('https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/approve', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.TAIFA_MANAGEMENT_TOKEN}`,
    'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
  "reason": "REPLACE_WITH_REASON"
})
});

const result = await response.json();
```

#### Python

```python
import os
import json
import requests

response = requests.request(
    'POST',
    'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/approve',
    headers={'Authorization': 'Bearer ' + os.environ['TAIFA_MANAGEMENT_TOKEN'], 'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY'},
    json=json.loads('{"reason":"REPLACE_WITH_REASON"}')
)
response.raise_for_status()
```

### Response example

No response example in the current specification.


[Request and response examples](/docs/api/operations/approve_v1_institutions__institution_id__auth_engine_enrollments__identifier__approve_post)

## POST /v1/institutions/{institution_id}/auth-engine-enrollments/{identifier}/cancel

Cancel

Cancel

Authentication: bearer access token with audience `taifa-management`. Endpoint roles and eligibility are reviewed separately from the OpenAPI bearer scheme.

No operation-specific scopes are declared in the OpenAPI document. Bearer authentication and endpoint authorization requirements still apply.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `institution_id` | path | string | Yes |  |
| `identifier` | path | string | Yes |  |
| `idempotency-key` | header | string | Yes |  |

### Request body

#### application/json

Required; identity__auth_engine_enrollment_router__Reason

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `reason` |  | string | Yes | Validation: min length 8; max length 500 |

### Responses

#### 200

Successful Response

No fields declared in the current specification.

#### 422

Validation Error

| Field | Variant | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `detail` |  | ValidationError[] | No |  |

### Request examples

Illustrative only. Replace placeholders and keep management tokens on the server.

#### cURL

```sh
curl -X POST 'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/cancel' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'idempotency-key: REPLACE_WITH_IDEMPOTENCY_KEY' \
  -H 'Content-Type: application/json' \
  --data '{
  "reason": "REPLACE_WITH_REASON"
}'
```

#### TypeScript (Node.js/server-side)

```typescript
const response = await fetch('https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/cancel', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.TAIFA_MANAGEMENT_TOKEN}`,
    'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
  "reason": "REPLACE_WITH_REASON"
})
});

const result = await response.json();
```

#### Python

```python
import os
import json
import requests

response = requests.request(
    'POST',
    'https://YOUR_IDENTITY_HOST/v1/institutions/REPLACE_WITH_INSTITUTION_ID/auth-engine-enrollments/REPLACE_WITH_IDENTIFIER/cancel',
    headers={'Authorization': 'Bearer ' + os.environ['TAIFA_MANAGEMENT_TOKEN'], 'idempotency-key': 'REPLACE_WITH_IDEMPOTENCY_KEY'},
    json=json.loads('{"reason":"REPLACE_WITH_REASON"}')
)
response.raise_for_status()
```

### Response example

No response example in the current specification.


[Request and response examples](/docs/api/operations/cancel_v1_institutions__institution_id__auth_engine_enrollments__identifier__cancel_post)