Models
Table of Contents
Interfaces
- MdsRefreshOutcomeVariant
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- ProviderConfigVariant
- Provider-specific connection details.
Classes
- AddMemberRequest
- The `AddMemberRequest` schema from the server's OpenAPI document.
- AddServiceAccountMemberRequest
- The `AddServiceAccountMemberRequest` schema from the server's OpenAPI document.
- ApiProviderConfig
- API-based provider configuration (SendGrid, Postmark, Resend, Brevo). `api_key` follows the
same write-only + omit-preserving contract as [`SmtpConfig::password`] (D-01/D-02).
- AssignRoleToGroupRequest
- The `AssignRoleToGroupRequest` schema from the server's OpenAPI document.
- AssignRoleToServiceAccountRequest
- The `AssignRoleToServiceAccountRequest` schema from the server's OpenAPI document.
- AssignRoleToUserRequest
- The `AssignRoleToUserRequest` schema from the server's OpenAPI document.
- AuditLogEntry
- The `AuditLogEntry` schema from the server's OpenAPI document.
- BindCertificate
- Request to bind a certificate to a service account.
- CaCertificate
- A CA (Certificate Authority) certificate at the organization level. CA certificates are the
root of trust for all tenant certificates within the organization. Private keys for signing
CAs are encrypted with AES-256-GCM and stored separately; non-signing CAs only store the
public certificate.
- Certificate
- A tenant-level certificate for users, services, or IoT devices. Certificates are signed by
the organization's CA. The private key is returned once on generation and never stored by
AXIAM.
- CertificatePolicy
- Certificate issuance constraints.
- ComplianceReportEntry
- One credential's compliance outcome (D9).
- CreateCaCertificateRequest
- The `CreateCaCertificateRequest` schema from the server's OpenAPI document.
- CreateCertificateRequest
- The `CreateCertificateRequest` schema from the server's OpenAPI document.
- CreateFederationConfigRequest
- The `CreateFederationConfigRequest` schema from the server's OpenAPI document.
- CreateGroupRequest
- The `CreateGroupRequest` schema from the server's OpenAPI document.
- CreateIntermediateCaRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas`.
- CreateNotificationRuleRequest
- The `CreateNotificationRuleRequest` schema from the server's OpenAPI document.
- CreateOAuth2ClientRequest
- The `CreateOAuth2ClientRequest` schema from the server's OpenAPI document.
- CreatePermissionRequest
- The `CreatePermissionRequest` schema from the server's OpenAPI document.
- CreatePgpKeyRequest
- The `CreatePgpKeyRequest` schema from the server's OpenAPI document.
- CreateReactorRequest
- The `CreateReactorRequest` schema from the server's OpenAPI document.
- CreateResourceRequest
- The `CreateResourceRequest` schema from the server's OpenAPI document.
- CreateRoleRequest
- The `CreateRoleRequest` schema from the server's OpenAPI document.
- CreateScimTokenRequest
- The `CreateScimTokenRequest` schema from the server's OpenAPI document.
- CreateScimTokenResponse
- The one-time reveal. Same shape as service-account creation: the secret is returned once and
only its hash is kept.
- CreateScopeRequest
- The `CreateScopeRequest` schema from the server's OpenAPI document.
- CreateServiceAccountRequest
- The `CreateServiceAccountRequest` schema from the server's OpenAPI document.
- CreateTenantRequest
- Request body for tenant creation (organization_id comes from the URL path).
- CreateUserRequest
- The `CreateUserRequest` schema from the server's OpenAPI document.
- CreateWebhookRequest
- The `CreateWebhookRequest` schema from the server's OpenAPI document.
- EmailConfig
- Fully resolved email configuration (all fields present).
- EmailConfigOverride
- Partial tenant overrides for email configuration. `None` = inherit from org baseline.
- EmailTestResult
- What a test send did.
- EmailVerificationPolicy
- Email verification requirements.
- EncryptedExport
- Result of encrypting data with a PGP public key.
- EncryptRequest
- Request body for encrypting data.
- FederationConfigResponse
- Federation config response -- omits client_secret.
- FederationLinkResponse
- The `FederationLinkResponse` schema from the server's OpenAPI document.
- GeneratedCaCertificate
- Response returned when a CA certificate is generated. Includes the private key PEM, which is
returned **once** and never stored or retrievable again — when the custodian produced one at
all. Under `vault_pki` custody the key was born inside Vault and there is nothing to return,
which is the point of that custodian rather than a shortcoming of this response.
- GeneratedCertificate
- Response returned when a tenant certificate is generated. Includes the private key PEM,
returned **once** and never stored.
- GeneratedPgpKey
- Response returned when a PGP key is generated.
- GrantedScope
- A scope named by a grant, resolved to something a human can read.
- GrantPermissionRequest
- The `GrantPermissionRequest` schema from the server's OpenAPI document.
- Group
- A group of users that can access resources based on their roles and permissions. Groups
simplify role management by allowing roles to be assigned to a group rather than individual
users.
- HealthResponse
- The `HealthResponse` schema from the server's OpenAPI document.
- ImportCaCertificateRequest
- Body of `POST /api/v1/organizations/{org_id}/ca-certificates/import`. Deliberately carries
no subject, validity window or key algorithm: all three are read out of the certificate
itself. A caller that could name them separately could name a subject the certificate does
not have, and AXIAM would enforce the claim while every relying party read the certificate.
- LockoutPolicy
- Account lockout rules.
- MdsRefreshOutcome
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- MdsRefreshOutcomeInitial
- The `initial` arm of {@see MdsRefreshOutcome} (`outcome: "initial"`).
- MdsRefreshOutcomeNoOpRefresh
- The `no_op_refresh` arm of {@see MdsRefreshOutcome} (`outcome: "no_op_refresh"`).
- MdsRefreshOutcomeReplaced
- The `replaced` arm of {@see MdsRefreshOutcome} (`outcome: "replaced"`).
- MdsRefreshOutcomeRollbackRejected
- The `rollback_rejected` arm of {@see MdsRefreshOutcome} (`outcome: "rollback_rejected"`).
- MdsStatusResponse
- `GET /api/v1/mds/status` response. `no`/`next_update`/`last_refreshed_at` are `None` and
`stale` is `false` when MDS has never been ingested — a meaningful, valid answer ("nothing
ingested yet"), not an error.
- MfaMethodResponse
- The `MfaMethodResponse` schema from the server's OpenAPI document.
- MfaPolicy
- Multi-factor authentication policy.
- MigrateCustodyResponse
- What a custody migration did.
- ModelDecode
- Reads a REQUIRED field out of a decoded response body.
- MtlsTrustAnchorResponse
- The acknowledgement, which is mostly about the restart.
- NotificationPolicy
- Admin notification preferences.
- NotificationRuleResponse
- Notification rule response.
- OAuth2ClientCreatedResponse
- Response for client creation -- includes the one-time plaintext secret.
- OAuth2ClientResponse
- OAuth2 client response -- omits client_secret_hash.
- OidcAuthorizeRequest
- The `OidcAuthorizeRequest` schema from the server's OpenAPI document.
- OidcAuthorizeResponse
- The `OidcAuthorizeResponse` schema from the server's OpenAPI document.
- OidcCallbackRequest
- The `OidcCallbackRequest` schema from the server's OpenAPI document.
- OidcCallbackResponse
- The `OidcCallbackResponse` schema from the server's OpenAPI document.
- OpaqueEnrollment
- The client-supplied half of an OPAQUE enrolment, as it appears inside registration /
change-password / reset-completion / bootstrap request bodies. There is no standalone
`register/finish` endpoint, deliberately. A record can only be created at a moment when the
plaintext password legitimately exists on the client, and every one of those moments is
already an endpoint that takes a password. A free-standing finish would be an endpoint whose
only job is to attach a credential to an account, which is a thing worth not having. Kept
separate from [`CreateOpaqueCredential`] because the tenant, the user and the credential
identifier are all decided by the server — a client that could name them could enrol a
record against somebody else's account.
- OpaquePolicy
- Secure Remote Password policy. `suite` and `ksf` are the parameters a *new* registration
record is enrolled with. They deliberately do not apply retroactively: an existing record is
only valid under the suite and KSF it was created with, so tightening these takes effect as
users next set a password rather than invalidating everybody at once.
- Organization
- An organization groups multiple tenants under a single administrative entity. Organizations
represent companies, departments, or business units. CA certificates are registered at the
organization level, enabling a hierarchical trust model across all tenants.
- PasswordPolicy
- Password complexity and history requirements.
- Permission
- The `Permission` schema from the server's OpenAPI document.
- PgpKey
- An OpenPGP key stored by AXIAM.
- PolicyResponse
- `GET` response: the stored policy plus the unknown-AAGUID action it currently *resolves to*.
- PrivacyPolicy
- Data-retention rules that apply after a subject asks to be erased.
- ProviderConfig
- Provider-specific connection details.
- ProviderConfigBrevo
- The `brevo` arm of {@see ProviderConfig} (`kind: "brevo"`).
- ProviderConfigPostmark
- The `postmark` arm of {@see ProviderConfig} (`kind: "postmark"`).
- ProviderConfigResend
- The `resend` arm of {@see ProviderConfig} (`kind: "resend"`).
- ProviderConfigSendGrid
- The `send_grid` arm of {@see ProviderConfig} (`kind: "send_grid"`).
- ProviderConfigSmtp
- The `smtp` arm of {@see ProviderConfig} (`kind: "smtp"`).
- ReactorEventDescriptor
- One hookable event, as the registry describes it.
- ReactorResponse
- The `ReactorResponse` schema from the server's OpenAPI document.
- ReadyResponse
- The `ReadyResponse` schema from the server's OpenAPI document.
- ResolvedPermissionGrant
- A permission grant with its scopes resolved. A superset of [`PermissionGrant`]: `scope_ids`
is still present and still authoritative, so a client written before `scopes` existed is
unaffected.
- Resource
- The `Resource` schema from the server's OpenAPI document.
- RetryPolicy
- Retry policy for failed webhook deliveries.
- Role
- The `Role` schema from the server's OpenAPI document.
- RoleAssignment
- A role together with its assignment context (the resource it is scoped to).
- RoleGroupAssignment
- A group together with the resource scope of its assignment of this role.
- RoleServiceAccountAssignment
- A service account together with the resource scope of its assignment.
- RoleUserAssignment
- A user together with the resource scope of their assignment of this role.
- RotateSecretResponse
- Response for secret rotation.
- ScimTokenResponse
- Metadata only. The handle is never in a list response — it exists in plaintext exactly once,
in [`CreateScimTokenResponse`].
- Scope
- The `Scope` schema from the server's OpenAPI document.
- SecuritySettings
- Fully resolved security settings (all fields present).
- ServiceAccountCreatedResponse
- Response for service account creation — includes the one-time plaintext secret.
- ServiceAccountResponse
- Public-safe service account representation.
- SetMtlsTrustAnchor
- Body for `PUT .../ca-certificates/{id}/mtls-trust-anchor`.
- SetOrgEmailConfig
- Input for setting organization-level email config.
- SetOrgSettings
- Input for setting organization-level security settings.
- SignAuditBatchRequest
- Request body for signing an audit batch.
- SignedAuditBatch
- A signed batch of audit log entries.
- SignIntermediateCsrRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas/sign-csr`. Deliberately carries no key
algorithm: it is the CSR's, read out of the request, because a caller who could state it
separately could state one the key does not have.
- SmtpConfig
- SMTP-specific configuration. `password` is write-only (D-01): `#[serde(skip_serializing)]`
means it is never emitted in a GET/serialized response. On the write path (D-02),
`#[serde(default)]` lets a caller omit the field entirely (deserializing to `""`); an empty
string is the sentinel for "no new secret supplied — preserve whatever is already stored"
(see `SurrealEmailConfigRepository:: set_org_config`). A non-empty value is a real secret to
encrypt+replace.
- Tenant
- A tenant is an isolated context within an organization. Each tenant has its own set of
users, roles, permissions, resources, certificates, and configuration. Tenants can represent
environments (dev/staging/prod) or separate business contexts.
- TenantSettingsOverride
- Partial tenant overrides. `None` = inherit from org baseline.
- TokenExchangeTrustRequest
- X4 trust for exchanging this provider's tokens (RFC 8693, external issuer). Mirrors
[`TokenExchangeTrust`] on the wire rather than reusing it directly so the API surface can
carry its own defaults: an admin PUTting a partial block gets the documented default for
anything they omitted, instead of a deserialization error listing fields they have never
heard of.
- TokenExchangeTrustResponse
- X4 trust as returned. Same shape as the request; nothing here is secret — an operator
reading a provider needs to see exactly what it trusts.
- TokenPolicy
- Token lifetime configuration.
- UpdateFederationConfigRequest
- The `UpdateFederationConfigRequest` schema from the server's OpenAPI document.
- UpdateGroup
- The `UpdateGroup` schema from the server's OpenAPI document.
- UpdateNotificationRuleRequest
- The `UpdateNotificationRuleRequest` schema from the server's OpenAPI document.
- UpdateOAuth2ClientRequest
- The `UpdateOAuth2ClientRequest` schema from the server's OpenAPI document.
- UpdateOrganizationRequest
- The `UpdateOrganizationRequest` schema from the server's OpenAPI document.
- UpdatePermissionRequest
- The `UpdatePermissionRequest` schema from the server's OpenAPI document.
- UpdateReactorRequest
- The `UpdateReactorRequest` schema from the server's OpenAPI document.
- UpdateResourceRequest
- The `UpdateResourceRequest` schema from the server's OpenAPI document.
- UpdateRole
- The `UpdateRole` schema from the server's OpenAPI document.
- UpdateScopeRequest
- The `UpdateScopeRequest` schema from the server's OpenAPI document.
- UpdateServiceAccount
- The `UpdateServiceAccount` schema from the server's OpenAPI document.
- UpdateTenant
- Fields that can be updated on an existing tenant.
- UpdateUserRequest
- The `UpdateUserRequest` schema from the server's OpenAPI document.
- UpdateWebhookRequest
- The `UpdateWebhookRequest` schema from the server's OpenAPI document.
- UserResponse
- Public-safe user representation (no password_hash, no mfa_secret).
- WebauthnAttestationPolicy
- Per-tenant WebAuthn attestation policy (D5). One row per tenant; an absent row means
[`WebauthnAttestationPolicy::default`], which is today's behavior unchanged.
- WebauthnPolicy
- WebAuthn ceremony policy. One field today. It is a struct rather than a bare field on
[`SecuritySettings`] so that the next WebAuthn control has an obvious home, and so the admin
UI can group them. The *attestation* policy is deliberately not here: it lives in
[`crate::models::webauthn_policy::WebauthnAttestationPolicy`], is tenant-only, and cannot
join this model because AAGUID allow/block lists have no "more restrictive than" ordering to
validate an override against. User verification does, so it can.
- WebhookResponse
- Webhook response — omits the shared secret.
Enums
- ActorType
- The `ActorType` enumeration from the server's OpenAPI document.
- AttestationMode
- What attestation conveyance a registration ceremony requests, and whether the policy is
enforced at all. `None` is the default and reproduces today's behavior byte-for-byte:
`evaluate` allows every registration unconditionally, with no MDS lookup (D8 step 1).
- AuditOutcome
- The `AuditOutcome` enumeration from the server's OpenAPI document.
- CertificateStatus
- Status of a certificate in its lifecycle.
- CertificateType
- The purpose for which a certificate was issued.
- CertificationLevel
- FIDO certification level, as recorded in an MDS `statusReports` entry's `FIDO_CERTIFIED*`
status. Variant order is significant: `derive(PartialOrd, Ord)` gives `L1 < L1Plus < L2 <
L2Plus < L3 < L3Plus`, which `WebauthnAttestationPolicy::evaluate` (D8 step 9) relies on
directly for the `min_certification` boundary check (`entry_level >= policy_min`).
- ClientAuthMethod
- How a client proves its identity at the token endpoint (RFC 8705 §2, OIDC Core §9 naming).
- ClientProfile
- Which security posture a client is registered under (X5.1). This is the FAPI "one switch".
- FailurePolicy
- What the server does when an interceptor does not produce a usable reply — timeout,
transport failure, bad signature, stale nonce, or a patch the allow-list rejects.
- KeyAlgorithm
- The type of key algorithm used for a certificate.
- MfaMethodType
- Type of MFA method.
- NotificationEventType
- Events that can trigger an admin notification.
- PermissionEffect
- Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default
deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant
refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny
wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in
full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one
checkable property — **adding a deny rule can never widen access, and can never be undone by
adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X
denied?" unanswerable without enumerating every other rule that might out-specify it.
- PgpKeyAlgorithm
- Key algorithm for OpenPGP keys.
- PgpKeyPurpose
- The purpose of an OpenPGP key.
- PgpKeyStatus
- Status of an OpenPGP key.
- ReactorMode
- How a reactor participates in an event.
- ScimTokenStatus
- Why a token is or is not currently usable — for display only. The authentication path never
surfaces this distinction on the wire.
- SettingsScope
- Whether a settings row belongs to an organization or a tenant.
- TenantKind
- What a tenant *is*, as distinct from what state it is in. Reserved rather than inferred: an
organization has exactly one tenant of kind [`Self::Organization`], enforced by a unique
index rather than by convention. Deriving it from a magic slug or from "the oldest tenant"
would make the organization scope something an operator could rename or delete by accident,
and it is the scope the super-admin lives in.
- TenantStatus
- Lifecycle status of a tenant. A `Suspended` tenant remains stored and its data isolated, but
is treated as administratively disabled. New tenants are `Active` by default.
- UnknownAaguidAction
- What to do with an AAGUID that has no MDS entry (i.e. FIDO Alliance has no metadata for it —
not necessarily malicious, MDS coverage is incomplete for some legitimate authenticators).
- UserStatus
- The `UserStatus` enumeration from the server's OpenAPI document.