AXIAM PHP SDK

DirectoryApi extends ManagementSupport
in package

FinalYes

A tenant's LDAP / Active Directory identity source (CONTRACT §30): the one configuration, the explicit act that links an existing local account to its directory entry, and a read-only view of the sync job. Signing in needs nothing new -- a directory account calls the same §1 `login`.

The directory namespace handle (CONTRACT.md §27.2), reached as $client->management()->directory(). Every method here goes through the one shared ManagementTransport, so §3 CSRF, the §4 cookie jar, the §5 tenant header, §6 TLS, §16 retry and §19 telemetry apply without this class doing anything to opt in (§27.8).

Table of Contents

Methods

__construct()  : mixed
delete()  : void
`DELETE /api/v1/tenants/{tenant_id}/directory`
forTenant()  : static
A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.
get()  : DirectoryConfig
`GET /api/v1/tenants/{tenant_id}/directory`
getSyncStatus()  : DirectorySyncStatus
`GET /api/v1/tenants/{tenant_id}/directory/sync-status`
inOrg()  : static
A COPY of this handle scoped to `$orgId` (§27.4 rule 3).
linkAccount()  : DirectoryLinkResult
`POST /api/v1/tenants/{tenant_id}/directory/links` — link a local account to its directory entry (D-28).
set()  : DirectoryConfig
`PUT /api/v1/tenants/{tenant_id}/directory` — create or **replace**.
update()  : DirectoryConfig
`PATCH /api/v1/tenants/{tenant_id}/directory` — a **sparse** update.

Methods

__construct()

public __construct(ManagementTransport $transport[, NamespaceScope $scope = new NamespaceScope() ][, string|null $clientOrgId = null ][, string|null $clientTenantId = null ]) : mixed
Parameters
$transport : ManagementTransport

The one wire path (§27.8).

$scope : NamespaceScope = new NamespaceScope()

Per-handle {org_id}/{tenant_id} overrides.

$clientOrgId : string|null = null

The client's own organization id, or null.

$clientTenantId : string|null = null

The client's own tenant id, or null.

delete()

`DELETE /api/v1/tenants/{tenant_id}/directory`

public delete() : void

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Deleting stops the directory, and only that (§30.3 rule 5): directory accounts can no longer sign in with a password -- there is no fallback to a local hash -- and the sync stops. Sessions, refresh tokens and passkeys those accounts already hold keep working until they expire or the accounts are deactivated. There is no unlink: a linked account stays a directory account.

forTenant()

A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.

public forTenant(string $tenantId) : static
Parameters
$tenantId : string
Return values
static

inOrg()

A COPY of this handle scoped to `$orgId` (§27.4 rule 3).

public inOrg(string $orgId) : static

Returns a new handle rather than mutating this one. An administrator holding a handle to their own organization should not find it repointed at someone else's because an unrelated code path re-scoped a shared object — and on a management surface that failure mode writes to the wrong tenant rather than merely reading from it.

Parameters
$orgId : string
Return values
static

linkAccount()

`POST /api/v1/tenants/{tenant_id}/directory/links` — link a local account to its directory entry (D-28).

public linkAccount(LinkDirectoryAccount $body) : DirectoryLinkResult

POST /api/v1/tenants/{tenant_id}/directory/links.

Signs the account's owner out everywhere (§30.3 rule 6): linking deletes the account's WebAuthn credentials and federation links, revokes its User certificates, all its sessions and its OAuth2 refresh tokens (TOTP is kept). The entry is found by the account's own username; a repeat on an already-linked account answers was_already_linked and repeats the revocations.

Parameters
$body : LinkDirectoryAccount

the request body

Return values
DirectoryLinkResult

set()

`PUT /api/v1/tenants/{tenant_id}/directory` — create or **replace**.

public set(SetDirectoryConfig $body) : DirectoryConfig

PUT /api/v1/tenants/{tenant_id}/directory.

Moving the connection requires the secret again (§30.3 rule 2): a set that changes url, start_tls, bind_dn or trust_anchors_pem without bindSecret is refused 400 and changes nothing. The SDK holds no copy of the secret and cannot re-send one for you. bindSecret is required while the tenant has no configuration; otherwise absent keeps the stored secret. Every other optional member left out is reset to its default -- start from ReadModifyWrite::directoryConfig(). An enabled directory and an effective opaque_mode = required never coexist (409); without the deployment's directory key a write carrying a secret is 503.

Parameters
$body : SetDirectoryConfig

the request body

Return values
DirectoryConfig

update()

`PATCH /api/v1/tenants/{tenant_id}/directory` — a **sparse** update.

public update(UpdateDirectoryConfig $body) : DirectoryConfig

PATCH /api/v1/tenants/{tenant_id}/directory.

Moving the connection requires the secret again (§30.3 rule 2): an update that changes url, start_tls, bind_dn or trust_anchors_pem without bindSecret is refused 400 and changes nothing; the SDK holds no copy of the secret to re-send. A member left null is not sent and stays as stored; groupBaseDn / groupFilter set to JsonNull::Null are sent as null and clear the value. An enabled directory and an effective opaque_mode = required never coexist (409).

Parameters
$body : UpdateDirectoryConfig

the request body

Return values
DirectoryConfig
On this page

Search results