AXIAM PHP SDK

ManagementApi
in package

FinalYes

The CONTRACT.md §27 management surface: 202 operations across 29 namespaces.

Reached as $client->management(). This class holds nothing but the shared ManagementTransport and the client's default scope; each accessor below hands back a namespace handle (§27.2) that can be re-scoped per call with ->inOrg() / ->forTenant() (§27.4 rule 3).

Handles are constructed on demand rather than cached. §27.4 rule 10 forbids caching RESPONSES, not handles — but a handle is two references and a scope, and building one per call keeps ->inOrg() from having anything shared to mutate.

Table of Contents

Methods

__construct()  : mixed
Wires the management surface onto the client's existing request path.
audit()  : AuditApi
Append-only audit log, read-only by construction.
caCertificates()  : CaCertificatesApi
Organization CAs and the per-tenant signing CAs chained beneath them.
certificates()  : CertificatesApi
End-entity X.509 certificates -- the ones issued to users, services and IoT devices.
directory()  : DirectoryApi
A tenant's LDAP / Active Directory identity source (CONTRACT §30): the one configuration, the explicit act that links an existing local account to its directory entry, and a read-only view of the sync job. Signing in needs nothing new -- a directory account calls the same §1 `login`.
emailConfig()  : EmailConfigApi
Transactional-mail transport, configurable at organization level and overridable per tenant.
federation()  : FederationApi
Upstream IdP configuration and the per-user links it produces.
groups()  : GroupsApi
Named collections of users. Roles assigned to a group are inherited by every member.
manifest()  : ManifestApi
The §27.6 declarative layer: plan and apply a manifest.
network()  : NetworkApi
A tenant's network segments and the RADIUS reply profile each owns (RADIUS Live profile): a segment is a node of the reserved /network subtree of the resource tree (kind, VLAN, Filter-Id envelope, placement rank), and its profile is the typed `axiam-radius-reply/1` record a decision renders. Every write is conditional on the `version` the caller read and passes the server's write gate. The tenant's Session-Timeout cap is one more row of it (get_policy, replace_policy): lowering it is always allowed, raising it is allowed and audited. The decision route FreeRADIUS calls is not in this registry.
notificationRules()  : NotificationRulesApi
Which events raise a notification, and to whom.
oauth2Clients()  : Oauth2ClientsApi
Registered OAuth2/OIDC clients -- the registration half of what §12, §21 and §26 then speak to.
organizations()  : OrganizationsApi
Organizations an SDK client may read and configure. Creation and deletion are outside the SDK boundary (§27.0).
permissions()  : PermissionsApi
Permissions -- an action on a resource, optionally narrowed by a scope.
pgpKeys()  : PgpKeysApi
OpenPGP keys used for audit signing and encrypted data export.
platform()  : PlatformApi
Deployment-level probes and FIDO metadata state. Unauthenticated where the server leaves them so.
privacy()  : PrivacyApi
GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller, never to another user.
reactors()  : ReactorsApi
Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK could previously reach.
resources()  : ResourcesApi
The resource hierarchy role assignments cascade down.
roles()  : RolesApi
Roles, their permission sets, and their assignment to users and groups.
saml()  : SamlApi
A tenant's SAML 2.0 identity provider (CONTRACT §29): the registry of service providers, the import of an SP's metadata into a *draft* registration (never a write), and the lifecycle of the IdP signing credential. The protocol itself -- single sign-on, single logout, the IdP metadata document -- is browser and SP-to-IdP surface under /saml/v2/{tenant_id}, an SP's own SAML library speaks to it, and it is not in this registry.
scimTargets()  : ScimTargetsApi
A tenant's outbound SCIM targets (CONTRACT §31): the downstream SCIM 2.0 service providers AXIAM pushes the tenant's users and groups to, each with its delivery state.
scimTokens()  : ScimTokensApi
Bearer tokens for the SCIM 2.0 provisioning endpoint.
scopes()  : ScopesApi
Sub-resource granularity, always addressed under their resource.
serviceAccounts()  : ServiceAccountsApi
Machine identities, their secrets, and the certificate a device-bound one authenticates with.
settings()  : SettingsApi
Effective settings, and the organization/tenant layers they resolve from.
ssf()  : SsfApi
A tenant's Shared Signals Framework streams (CONTRACT §32): which receiver -- an OAuth2 client of the tenant -- receives which CAEP and RISC security events, as SETs pushed to its endpoint or polled. The receiver's own protocol (transmitter metadata, the SSF stream management API, polling) is not in this registry.
tenants()  : TenantsApi
Tenants within an organization -- the isolation boundary every other namespace is scoped to.
users()  : UsersApi
Users within the client's tenant, and the administrative side of their second factor and lockout state.
webauthnPolicy()  : WebauthnPolicyApi
Per-tenant attestation policy governing the §24 ceremonies, and the compliance report over it.
webhooks()  : WebhooksApi
Outbound event notifications. Delivery signatures are verified with the §13 helper, which this namespace configures.

Methods

__construct()

Wires the management surface onto the client's existing request path.

public __construct(ManagementTransport $transport[, string|null $orgId = null ][, string|null $tenantId = null ]) : mixed
Parameters
$transport : ManagementTransport

The one §27.8 wire path.

$orgId : string|null = null

The client's organization id, or null if unset.

$tenantId : string|null = null

The client's tenant id, or null if unset.

directory()

A tenant's LDAP / Active Directory identity source (CONTRACT §30): the one configuration, the explicit act that links an existing local account to its directory entry, and a read-only view of the sync job. Signing in needs nothing new -- a directory account calls the same §1 `login`.

public directory() : DirectoryApi
Return values
DirectoryApi

manifest()

The §27.6 declarative layer: plan and apply a manifest.

public manifest() : ManifestApi

plan() writes nothing; apply() performs the plan, stops at the first failure and does not roll back (§27.7). Hand-written rather than generated — the manifest layer is a convergence loop over the operations below, not an endpoint the registry describes.

Return values
ManifestApi

network()

A tenant's network segments and the RADIUS reply profile each owns (RADIUS Live profile): a segment is a node of the reserved /network subtree of the resource tree (kind, VLAN, Filter-Id envelope, placement rank), and its profile is the typed `axiam-radius-reply/1` record a decision renders. Every write is conditional on the `version` the caller read and passes the server's write gate. The tenant's Session-Timeout cap is one more row of it (get_policy, replace_policy): lowering it is always allowed, raising it is allowed and audited. The decision route FreeRADIUS calls is not in this registry.

public network() : NetworkApi
Return values
NetworkApi

privacy()

GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller, never to another user.

public privacy() : PrivacyApi
Return values
PrivacyApi

reactors()

Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK could previously reach.

public reactors() : ReactorsApi
Return values
ReactorsApi

saml()

A tenant's SAML 2.0 identity provider (CONTRACT §29): the registry of service providers, the import of an SP's metadata into a *draft* registration (never a write), and the lifecycle of the IdP signing credential. The protocol itself -- single sign-on, single logout, the IdP metadata document -- is browser and SP-to-IdP surface under /saml/v2/{tenant_id}, an SP's own SAML library speaks to it, and it is not in this registry.

public saml() : SamlApi
Return values
SamlApi

scimTargets()

A tenant's outbound SCIM targets (CONTRACT §31): the downstream SCIM 2.0 service providers AXIAM pushes the tenant's users and groups to, each with its delivery state.

public scimTargets() : ScimTargetsApi

The credential AXIAM pushes with is write-only. Deleting a target does not deprovision anything downstream.

Return values
ScimTargetsApi

ssf()

A tenant's Shared Signals Framework streams (CONTRACT §32): which receiver -- an OAuth2 client of the tenant -- receives which CAEP and RISC security events, as SETs pushed to its endpoint or polled. The receiver's own protocol (transmitter metadata, the SSF stream management API, polling) is not in this registry.

public ssf() : SsfApi
Return values
SsfApi

users()

Users within the client's tenant, and the administrative side of their second factor and lockout state.

public users() : UsersApi
Return values
UsersApi

webhooks()

Outbound event notifications. Delivery signatures are verified with the §13 helper, which this namespace configures.

public webhooks() : WebhooksApi
Return values
WebhooksApi
On this page

Search results