# Taifa Identity documentation

Owned authentication, reviewed access and product integrations. Read the platform status before enabling production.

## Guides

- [What Identity owns](/docs/guides/overview.md): The issuer authenticates people, management governs access, and products enforce their own permissions.
- [Quick start](/docs/guides/quickstart.md): Run the isolated issuer tests and a disposable account before integrating an application.
- [Platform status](/docs/guides/platform-status.md): See what runs today, what has an API contract, and what blocks a production rollout.
- [Projects and approval](/docs/guides/projects.md): Establish an approved project, reviewed owner, permission catalog and exact owned-client policy.
- [Register a client](/docs/guides/client-registration.md): Review exact client policy and permissions, then understand the separate issuer readback gate.
- [Web sign-in](/docs/guides/web.md): Use authorization code with PKCE and a backend session for a future web client.
- [Native sign-in](/docs/guides/native.md): Use the system browser, a public client, and an exact registered redirect.
- [OIDC reference](/docs/guides/protocol.md): Discover the local issuer and validate tokens, PKCE, state, nonce, and assurance.
- [API authentication](/docs/guides/api-authentication.md): Send management audience access tokens and interpret authorization failures.
- [Machine access](/docs/guides/machine-access.md): Use a reviewed, project-scoped service identity for lifecycle and attestation.
- [Management API](/docs/guides/management-api.md): Browse versioned routes, request bodies, idempotency, and the generated schema.
- [Identity and account mapping](/docs/guides/identity-model.md): Key people by issuer and subject, then explicitly bind Institution and product accounts.
- [Eligibility and lifecycle](/docs/guides/lifecycle.md): Consume signed ordered changes, snapshot on gaps, and fail closed after freshness expires.
- [Enrollment and recovery](/docs/guides/security.md): Understand strong authentication, reviewed admission, passkeys, and recovery boundaries.
- [Credentials and rotation](/docs/guides/credentials.md): Separate human sessions, issuer signing keys, client secrets, and Mail delivery credentials.
- [Taifa Mail](/docs/guides/mail.md): Connect workforce login and transactional identity mail through distinct boundaries.
- [Errors and troubleshooting](/docs/guides/errors.md): Diagnose OIDC, management API, client approval, and lifecycle failures.
- [Availability and outages](/docs/guides/availability.md): Handle sign-in failure, stale eligibility, and incomplete delivery safely.
- [Deployment](/docs/guides/deployment.md): Prepare the owned issuer, management, portal, secrets, ingress, and database.
- [Product migration](/docs/guides/migration.md): Move product accounts to issuer and subject bindings without restoring old access.
- [Operations and rollback](/docs/guides/operations.md): Observe queues and acknowledgements, rotate keys, and contain a failed rollout.

## API reference

- [Overview](/docs/api/index.md)
- [Personal account](/docs/api/groups/personal-account.md): 4 operations
- [Credential actions](/docs/api/groups/credential-actions.md): 3 operations
- [Reviewed Access grants](/docs/api/groups/reviewed-access-grants.md): 4 operations
- [Lifecycle service authority](/docs/api/groups/lifecycle-service-authority.md): 5 operations
- [Institution federation](/docs/api/groups/institution-federation.md): 3 operations
- [Other](/docs/api/groups/other.md): 19 operations
- [Audit investigation](/docs/api/groups/audit-investigation.md): 2 operations
- [Workflows](/docs/api/groups/workflows.md): 28 operations
- [Staff enrollment](/docs/api/groups/staff-enrollment.md): 6 operations
- [Standalone workforce admission](/docs/api/groups/standalone-workforce-admission.md): 5 operations
- [Personal sessions](/docs/api/groups/personal-sessions.md): 2 operations
- [Account linking](/docs/api/groups/account-linking.md): 9 operations
- [Security incident sessions](/docs/api/groups/security-incident-sessions.md): 3 operations
- [Reviewed authentication policy](/docs/api/groups/reviewed-authentication-policy.md): 4 operations
- [Operations](/docs/api/groups/operations.md): 4 operations
- [Personal capabilities](/docs/api/groups/personal-capabilities.md): 14 operations
- [Reviewed project clients](/docs/api/groups/reviewed-project-clients.md): 8 operations
- [Owned client custody](/docs/api/groups/owned-client-custody.md): 1 operations
- [Project authority status](/docs/api/groups/project-authority-status.md): 1 operations
- [Project lifecycle](/docs/api/groups/project-lifecycle.md): 6 operations

- [Public OpenAPI JSON](/docs/openapi.json)
- [Full Markdown](/docs/llms-full.txt)