Models
Table of Contents
Interfaces
- MdsRefreshOutcomeVariant
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- ProviderConfigVariant
- Provider-specific connection details.
- ScimTargetAuthVariant
- How AXIAM authenticates to the downstream service provider, without the credential itself.
- ScimTargetScopeVariant
- Which users a target provisions.
- SubjectAltNameVariant
- A name to put in a `Server` certificate's `subjectAltName`. Stated explicitly in the
request, never read from a CSR: a CSR asking for a `subjectAltName` extension is still
refused. URI and e-mail names are not offered — nothing in AXIAM consumes them yet.
Classes
- AcsEndpoint
- One `AssertionConsumerService` endpoint of a service provider. The list of these is an
**allow-list**, checked the way OAuth2 redirect URIs are: an `AuthnRequest` naming an ACS
URL is honoured only when the URL equals one registered here, byte for byte. No globs, no
prefix match.
- AddMemberRequest
- The `AddMemberRequest` schema from the server's OpenAPI document.
- AddServiceAccountMemberRequest
- The `AddServiceAccountMemberRequest` schema from the server's OpenAPI document.
- ApiProviderConfig
- API-based provider configuration (SendGrid, Postmark, Resend, Brevo). `api_key` follows the
same write-only + omit-preserving contract as [`SmtpConfig::password`] (D-01/D-02).
- AssignRoleToGroupRequest
- The `AssignRoleToGroupRequest` schema from the server's OpenAPI document.
- AssignRoleToServiceAccountRequest
- The `AssignRoleToServiceAccountRequest` schema from the server's OpenAPI document.
- AssignRoleToUserRequest
- The `AssignRoleToUserRequest` schema from the server's OpenAPI document.
- AttributeMapping
- One entry of an SP's attribute mapping table.
- AuditLogEntry
- The `AuditLogEntry` schema from the server's OpenAPI document.
- BindCertificate
- Request to bind a certificate to a service account.
- CaCertificate
- A CA (Certificate Authority) certificate at the organization level. CA certificates are the
root of trust for all tenant certificates within the organization. Private keys for signing
CAs are encrypted with AES-256-GCM and stored separately; non-signing CAs only store the
public certificate.
- Certificate
- A tenant-level certificate for users, services, or IoT devices. Certificates are signed by
the organization's CA. The private key is returned once on generation and never stored by
AXIAM.
- CertificatePolicy
- Certificate issuance constraints.
- CimdPolicy
- Whether, and on what terms, a `client_id` that is a URL is resolved by fetching the document
it names (T21.5, `draft-ietf-oauth-client-id-metadata-document`). # Why this is one nested
policy rather than nine fields Every field here is a term of a single decision — *do we
fetch a stranger's URL and make a client out of what comes back* — and none of them means
anything without [`Self::enabled`]. A tenant that states a CIMD posture states all of it; a
tenant that states none inherits its organization's whole posture rather than half of one,
which is the only merge that cannot produce a combination neither party wrote. # The two
fields that can widen, and the seven that cannot [`Self::enabled`] and [`Self::allow_http`]
are **ordered**: a tenant may turn either off but never on, exactly as
`dynamic_registration` may only move down its ladder. Everything else names *this tenant's*
domains or *this tenant's* bounds, and there is no sense in which one tenant's list of
trusted publishers is stricter than another's — the same argument [`OidcPolicy`] already
makes for `dcr_allowed_redirect_hosts`. # Every bound here is a security control
[`Self::max_metadata_bytes`], [`Self::min_cache_secs`] and [`Self::max_cache_secs`] are not
tuning knobs. They are, respectively, the ceiling on a read from an attacker-chosen URL, the
floor under how often that read may be repeated, and the ceiling on how long its result may
be trusted. Each is clamped again in code against the three constants above, so a settings
row written by hand cannot lift them.
- ComplianceReportEntry
- One credential's compliance outcome (D9).
- ConsentView
- One consent record, as the subject sees it.
- CreateCaCertificateRequest
- The `CreateCaCertificateRequest` schema from the server's OpenAPI document.
- CreateCertificateRequest
- The `CreateCertificateRequest` schema from the server's OpenAPI document.
- CreateFederationConfigRequest
- The `CreateFederationConfigRequest` schema from the server's OpenAPI document.
- CreateGroupRequest
- The `CreateGroupRequest` schema from the server's OpenAPI document.
- CreateIntermediateCaRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas`.
- CreateNetworkReplyProfileRequest
- The body of `POST /api/v1/network/profiles`.
- CreateNetworkSegmentRequest
- The body of `POST /api/v1/network/segments`.
- CreateNotificationRuleRequest
- The `CreateNotificationRuleRequest` schema from the server's OpenAPI document.
- CreateOAuth2ClientRequest
- The `CreateOAuth2ClientRequest` schema from the server's OpenAPI document.
- CreatePermissionRequest
- The `CreatePermissionRequest` schema from the server's OpenAPI document.
- CreatePgpKeyRequest
- The `CreatePgpKeyRequest` schema from the server's OpenAPI document.
- CreateReactorRequest
- The `CreateReactorRequest` schema from the server's OpenAPI document.
- CreateRegistrationTokenRequest
- Request body for [`create_registration_token`].
- CreateRegistrationTokenResponse
- The one response that carries the handle.
- CreateResourceRequest
- The `CreateResourceRequest` schema from the server's OpenAPI document.
- CreateRoleRequest
- The `CreateRoleRequest` schema from the server's OpenAPI document.
- CreateScimTokenRequest
- The `CreateScimTokenRequest` schema from the server's OpenAPI document.
- CreateScimTokenResponse
- The one-time reveal. Same shape as service-account creation: the secret is returned once and
only its hash is kept.
- CreateScopeRequest
- The `CreateScopeRequest` schema from the server's OpenAPI document.
- CreateServiceAccountRequest
- The `CreateServiceAccountRequest` schema from the server's OpenAPI document.
- CreateTenantRequest
- Request body for tenant creation (organization_id comes from the URL path).
- CreateUserRequest
- The `CreateUserRequest` schema from the server's OpenAPI document.
- CreateWebhookRequest
- The `CreateWebhookRequest` schema from the server's OpenAPI document.
- DirectoryConfig
- A tenant's directory configuration, as stored and as read back. Carries no secret: see the
module documentation.
- DirectoryLinkResult
- What linking did.
- DirectorySyncStatus
- A read-only view of the sync job's state for one tenant. Counts of what a run did are in its
audit rows, and no account id is here.
- EmailConfig
- Fully resolved email configuration (all fields present).
- EmailConfigOverride
- Partial tenant overrides for email configuration. `None` = inherit from org baseline.
- EmailTestResult
- What a test send did.
- EmailVerificationPolicy
- Email verification requirements.
- EncryptedExport
- Result of encrypting data with a PGP public key.
- EncryptRequest
- Request body for encrypting data.
- FederationConfigResponse
- Federation config response -- omits client_secret.
- FederationLinkResponse
- The `FederationLinkResponse` schema from the server's OpenAPI document.
- GeneratedCaCertificate
- Response returned when a CA certificate is generated. Includes the private key PEM, which is
returned **once** and never stored or retrievable again — when the custodian produced one at
all. Under `vault_pki` custody the key was born inside Vault and there is nothing to return,
which is the point of that custodian rather than a shortcoming of this response.
- GeneratedCertificate
- Response returned when a tenant certificate is generated. Includes the private key PEM,
returned **once** and never stored.
- GeneratedPgpKey
- Response returned when a PGP key is generated.
- GrantedScope
- A scope named by a grant, resolved to something a human can read.
- GrantPermissionRequest
- The `GrantPermissionRequest` schema from the server's OpenAPI document.
- GrantScopeConsent
- Body for recording an OIDC scope-release consent.
- Group
- A group of users that can access resources based on their roles and permissions. Groups
simplify role management by allowing roles to be assigned to a group rather than individual
users.
- GroupMapping
- One row of the group-mapping table (G-3, T23.3.4, D-30): a directory group, named by its
distinguished name, and the AXIAM group a member of it is put into. **The table is the only
way a directory group reaches an AXIAM group.** There is no match by name, no prefix or
wildcard, and no AXIAM group is ever created from a directory one: a directory administrator
who names a group `admins` gains nothing unless a tenant administrator mapped it here. The
DN is stored as the administrator typed it and compared after RFC 4514 normalisation
(`axiam_directory::dn`), so `CN=Staff, OU=Groups` and `cn=staff,ou=groups` are the same row.
- HealthResponse
- Response body for `GET /health`. `profile` and `unavailable` are additive (G-8, D-59): a
client that reads only `status` is unaffected.
- ImportCaCertificateRequest
- Body of `POST /api/v1/organizations/{org_id}/ca-certificates/import`. Deliberately carries
no subject, validity window or key algorithm: all three are read out of the certificate
itself. A caller that could name them separately could name a subject the certificate does
not have, and AXIAM would enforce the claim while every relying party read the certificate.
- IssueSamlIdpCredential
- `POST …/saml/idp-credentials` body.
- LinkDirectoryAccount
- `POST /api/v1/tenants/{tenant_id}/directory/links` body.
- LockoutPolicy
- Account lockout rules.
- MdsRefreshOutcome
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- MdsRefreshOutcomeInitial
- The `initial` arm of {@see MdsRefreshOutcome} (`outcome: "initial"`).
- MdsRefreshOutcomeNoOpRefresh
- The `no_op_refresh` arm of {@see MdsRefreshOutcome} (`outcome: "no_op_refresh"`).
- MdsRefreshOutcomeReplaced
- The `replaced` arm of {@see MdsRefreshOutcome} (`outcome: "replaced"`).
- MdsRefreshOutcomeRollbackRejected
- The `rollback_rejected` arm of {@see MdsRefreshOutcome} (`outcome: "rollback_rejected"`).
- MdsStatusResponse
- `GET /api/v1/mds/status` response. `no`/`next_update`/`last_refreshed_at` are `None` and
`stale` is `false` when MDS has never been ingested — a meaningful, valid answer ("nothing
ingested yet"), not an error.
- MfaMethodResponse
- The `MfaMethodResponse` schema from the server's OpenAPI document.
- MfaPolicy
- Multi-factor authentication policy.
- MigrateCustodyResponse
- What a custody migration did.
- ModelDecode
- Reads a REQUIRED field out of a decoded response body.
- MtlsTrustAnchorResponse
- The acknowledgement, which is mostly about the restart.
- NetworkPolicyResponse
- The tenant's network policy, as the management API returns it.
- NetworkReplyProfile
- A segment's reply profile as read: **the effective one**, with the `Session-Timeout` already
clamped to the tenant's current cap (design note §3.4) and `Idle-Timeout` kept within it.
- NetworkReplyProfileInput
- What a writer supplies for a profile. Closed: an unknown key is a refusal naming it, never
ignored (design note §3.4).
- NetworkSegmentResponse
- A network segment, as the management API returns it.
- NotificationPolicy
- Admin notification preferences.
- NotificationRuleResponse
- Notification rule response.
- OAuth2ClientCreatedResponse
- Response for client creation -- includes the one-time plaintext secret.
- OAuth2ClientResponse
- OAuth2 client response -- omits client_secret_hash.
- OidcAuthorizeRequest
- The `OidcAuthorizeRequest` schema from the server's OpenAPI document.
- OidcAuthorizeResponse
- The `OidcAuthorizeResponse` schema from the server's OpenAPI document.
- OidcCallbackRequest
- The `OidcCallbackRequest` schema from the server's OpenAPI document.
- OidcCallbackResponse
- The `OidcCallbackResponse` schema from the server's OpenAPI document.
- OidcPolicy
- OpenID Connect surface controls (X7 G8, plan §4.6/§4.8; T21.4). Settings that are not
password rules, here because this is the org-baseline-plus-tenant-override surface every
other per-tenant control lives on. They are not all of the same kind as each other, and
which is which is the whole of what [`validate_tenant_override`] and
[`clamp_overrides_to_org`] read, so it is set out rather than inferred. **Ordered** — a
tenant may be stricter than its organization and never more permissive: *
[`Self::sensitive_scopes_enabled`], validated **disable-only** — the mirror image of
`mfa_enforced`, because releasing personal data is the less-restrictive direction, so a
tenant can turn its organization's decision off but never on. * [`Self::saml_idp_enabled`],
validated **disable-only** exactly like [`Self::sensitive_scopes_enabled`] (D-20): a tenant
may turn its organization's `true` off and never its `false` on. * [`Self::ssf_enabled`],
validated **disable-only** the same way (D-45). * [`Self::dynamic_registration`], on the
ladder `disabled` → `initial_access_token` → `anonymous`: a tenant may move down it and
never up. * [`Self::dcr_max_clients`] and [`Self::dcr_unused_client_ttl_days`], on the
ordinary `tenant <= org` rule — with the wrinkle that `0` on the second means *never sweep*,
which is the longest window of all and is handled by [`dcr_ttl_strictness`]. **Not
ordered**, therefore never validated against the baseline and never clamped: *
[`Self::default_locale`]. A language is a presentation preference; there is no sense in
which Italian is stricter than French. * [`Self::dcr_allowed_scopes`],
[`Self::dcr_allowed_redirect_hosts`] and [`Self::external_client_allowed_resources`]. Each
names per-tenant resources — *this* tenant's MCP servers, *this* tenant's callback hosts —
and there is no sense in which one such list is stricter than another. A subset rule would
force an organization to enumerate every tenant's resource servers in its own baseline
before any tenant could name one. The model's rule is "a tenant may only be more
restrictive", which binds every field that *has* a restrictiveness; a field that has none
cannot violate it. One cross-field interlock spans both groups and is checked on the
resolved policy rather than on either input: see [`validate_dcr_policy`].
- OpaqueEnrollment
- The client-supplied half of an OPAQUE enrolment, as it appears inside registration /
change-password / reset-completion / bootstrap request bodies. There is no standalone
`register/finish` endpoint, deliberately. A record can only be created at a moment when the
plaintext password legitimately exists on the client, and every one of those moments is
already an endpoint that takes a password. A free-standing finish would be an endpoint whose
only job is to attach a credential to an account, which is a thing worth not having. Kept
separate from [`CreateOpaqueCredential`] because the tenant, the user and the credential
identifier are all decided by the server — a client that could name them could enrol a
record against somebody else's account.
- OpaquePolicy
- Secure Remote Password policy. `suite` and `ksf` are the parameters a *new* registration
record is enrolled with. They deliberately do not apply retroactively: an existing record is
only valid under the suite and KSF it was created with, so tightening these takes effect as
users next set a password rather than invalidating everybody at once.
- Organization
- An organization groups multiple tenants under a single administrative entity. Organizations
represent companies, departments, or business units. CA certificates are registered at the
organization level, enabling a hierarchical trust model across all tenants.
- ParseSamlSpMetadata
- `POST …/saml/parse-sp-metadata` body: **exactly one** of the two members.
- PasswordPolicy
- Password complexity and history requirements.
- Permission
- The `Permission` schema from the server's OpenAPI document.
- PgpKey
- An OpenPGP key stored by AXIAM.
- PolicyResponse
- `GET` response: the stored policy plus the unknown-AAGUID action it currently *resolves to*.
- PrivacyPolicy
- Data-retention rules that apply after a subject asks to be erased.
- ProviderConfig
- Provider-specific connection details.
- ProviderConfigBrevo
- The `brevo` arm of {@see ProviderConfig} (`kind: "brevo"`).
- ProviderConfigPostmark
- The `postmark` arm of {@see ProviderConfig} (`kind: "postmark"`).
- ProviderConfigResend
- The `resend` arm of {@see ProviderConfig} (`kind: "resend"`).
- ProviderConfigSendGrid
- The `send_grid` arm of {@see ProviderConfig} (`kind: "send_grid"`).
- ProviderConfigSmtp
- The `smtp` arm of {@see ProviderConfig} (`kind: "smtp"`).
- ReactorEventDescriptor
- One hookable event, as the registry describes it.
- ReactorResponse
- The `ReactorResponse` schema from the server's OpenAPI document.
- ReadyResponse
- The `ReadyResponse` schema from the server's OpenAPI document.
- RegistrationTokenResponse
- Metadata only. The handle exists in plaintext exactly once, in
[`CreateRegistrationTokenResponse`].
- ReplaceNetworkPolicyRequest
- The body of `PUT /api/v1/network/policy`: a **replacement** of the policy.
- ReplaceNetworkReplyProfileRequest
- The body of `PUT /api/v1/network/profiles/{segment_id}`.
- ReplaceNetworkSegmentRequest
- The body of `PUT /api/v1/network/segments/{id}`: a **replacement** of the envelope. The kind
and the place in the tree do not change.
- ResolvedPermissionGrant
- A permission grant with its scopes resolved. A superset of [`PermissionGrant`]: `scope_ids`
is still present and still authoritative, so a client written before `scopes` existed is
unaffected.
- Resource
- The `Resource` schema from the server's OpenAPI document.
- RetryPolicy
- Retry policy for failed webhook deliveries.
- Role
- The `Role` schema from the server's OpenAPI document.
- RoleAssignment
- A role together with its assignment context (the resource it is scoped to).
- RoleGroupAssignment
- A group together with the resource scope of its assignment of this role.
- RoleServiceAccountAssignment
- A service account together with the resource scope of its assignment.
- RoleUserAssignment
- A user together with the resource scope of their assignment of this role.
- RotateSecretResponse
- Response for secret rotation.
- SamlIdpCredential
- The tenant's IdP signing credential, **public facts only**. There is no key on it and no
field a key could be put in: the private key is generated by the server, sealed at rest,
never returned by any route and destroyed on retirement (D-21).
- SamlIdpCredentialPromotion
- What promoting the `next` credential did.
- SamlIdpInfo
- The tenant's SAML IdP, as the administrator needs to see it before and while switching it
on: what an SP will be given, and whether it answers yet.
- SamlServiceProvider
- A registered service provider, as stored.
- SamlServiceProviderInput
- Everything an administrator supplies when registering or replacing a service provider
(`create` and `update` both take it; `update` is a full replacement). Every field but
`entity_id`, `display_name` and `acs_urls` has a default, so a client written against a
later revision of this struct keeps working.
- SamlSpMetadataDraft
- A parse of SP metadata: **a draft, not a registration**. Nothing is stored until the caller
submits `service_provider` to `create_service_provider` or `update_service_provider`, and
nothing in it is trusted because it came from a document (D-41).
- ScimReconcileAccepted
- The body of a started reconciliation's `202`.
- ScimTargetAuth
- How AXIAM authenticates to the downstream service provider, without the credential itself.
- ScimTargetAuthBearer
- The `bearer` arm of {@see ScimTargetAuth} (`type: "bearer"`).
- ScimTargetAuthOauth2ClientCredentials
- The `oauth2_client_credentials` arm of {@see ScimTargetAuth} (`type:
"oauth2_client_credentials"`).
- ScimTargetAuthUnknown
- A {@see ScimTargetAuth} whose `type` this SDK's copy of the spec does not list.
- ScimTargetDeliveryState
- A target's delivery state, as `GET` projects it. Fixed vocabulary only: the failure reason
is one of the deliverer's phrases, never a URL, a response body or a value.
- ScimTargetInput
- `create` and `update` (a **replacement**) body.
- ScimTargetResponse
- A registered SCIM target, as the management API returns it. **The credential is never
returned**, and there is no member that says anything about it.
- ScimTargetScope
- Which users a target provisions.
- ScimTargetScopeAllUsers
- The `all_users` arm of {@see ScimTargetScope} (`type: "all_users"`).
- ScimTargetScopeGroups
- The `groups` arm of {@see ScimTargetScope} (`type: "groups"`).
- ScimTargetScopeUnknown
- A {@see ScimTargetScope} whose `type` this SDK's copy of the spec does not list.
- ScimTokenResponse
- Metadata only. The handle is never in a list response — it exists in plaintext exactly once,
in [`CreateScimTokenResponse`].
- Scope
- The `Scope` schema from the server's OpenAPI document.
- SecuritySettings
- Fully resolved security settings (all fields present).
- ServiceAccountCreatedResponse
- Response for service account creation — includes the one-time plaintext secret.
- ServiceAccountResponse
- Public-safe service account representation.
- SessionResponse
- One of a user's sessions, as an administrator sees it.
- SetDirectoryConfig
- `PUT /api/v1/tenants/{tenant_id}/directory` — a **replacement**. Every `DirectoryConfig`
member except `id`, `tenant_id` and the two timestamps, plus the write-only `bind_secret`.
- SetMtlsTrustAnchor
- Body for `PUT .../ca-certificates/{id}/mtls-trust-anchor`.
- SetOrgEmailConfig
- Input for setting organization-level email config.
- SetOrgSettings
- Input for setting organization-level security settings.
- SignAuditBatchRequest
- Request body for signing an audit batch.
- SignCertificateCsrRequest
- Body of `POST /api/v1/certificates/sign-csr`. No `subject` and no `key_algorithm`: both are
read out of the CSR, which is the only place they can be stated without the row and the
certificate being able to disagree. No key is returned, so there is no key field anywhere on
this exchange. The CSR's common name meets the rules of `subject` on `POST
/api/v1/certificates` (printable, at most 64 characters) and is refused, not rewritten, when
it does not. So does the value of every other attribute of the CSR's subject, and a subject
with more than one common name is refused.
- SignedAuditBatch
- A signed batch of audit log entries.
- SignIntermediateCsrRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas/sign-csr`. Deliberately carries no key
algorithm: it is the CSR's, read out of the request, because a caller who could state it
separately could state one the key does not have.
- SmtpConfig
- SMTP-specific configuration. `password` is write-only (D-01): `#[serde(skip_serializing)]`
means it is never emitted in a GET/serialized response. On the write path (D-02),
`#[serde(default)]` lets a caller omit the field entirely (deserializing to `""`); an empty
string is the sentinel for "no new secret supplied — preserve whatever is already stored"
(see `SurrealEmailConfigRepository:: set_org_config`). A non-empty value is a real secret to
encrypt+replace.
- SsfStream
- A registered SSF stream, as the management API returns it. **The push `Authorization` header
is never returned**; `authorization_header_set` says whether one is stored.
- SsfStreamInput
- `create_stream` and `update_stream` (a **replacement**) body.
- SubjectAltName
- A name to put in a `Server` certificate's `subjectAltName`. Stated explicitly in the
request, never read from a CSR: a CSR asking for a `subjectAltName` extension is still
refused. URI and e-mail names are not offered — nothing in AXIAM consumes them yet.
- SubjectAltNameDns
- The `dns` arm of {@see SubjectAltName} (`{"dns": …}`).
- SubjectAltNameIp
- The `ip` arm of {@see SubjectAltName} (`{"ip": …}`).
- Tenant
- A tenant is an isolated context within an organization. Each tenant has its own set of
users, roles, permissions, resources, certificates, and configuration. Tenants can represent
environments (dev/staging/prod) or separate business contexts.
- TenantSettingsOverride
- Partial tenant overrides. `None` = inherit from org baseline.
- TokenExchangeTrustRequest
- X4 trust for exchanging this provider's tokens (RFC 8693, external issuer). Mirrors
[`TokenExchangeTrust`] on the wire rather than reusing it directly so the API surface can
carry its own defaults: an admin PUTting a partial block gets the documented default for
anything they omitted, instead of a deserialization error listing fields they have never
heard of.
- TokenExchangeTrustResponse
- X4 trust as returned. Same shape as the request; nothing here is secret — an operator
reading a provider needs to see exactly what it trusts.
- TokenPolicy
- Token lifetime configuration.
- UpdateDirectoryConfig
- `PATCH /api/v1/tenants/{tenant_id}/directory` — a **sparse** update. Every member optional:
absent leaves the stored value, and for the two nullable members an explicit `null` clears
it.
- UpdateFederationConfigRequest
- The `UpdateFederationConfigRequest` schema from the server's OpenAPI document.
- UpdateGroup
- The `UpdateGroup` schema from the server's OpenAPI document.
- UpdateNotificationRuleRequest
- The `UpdateNotificationRuleRequest` schema from the server's OpenAPI document.
- UpdateOAuth2ClientRequest
- The `UpdateOAuth2ClientRequest` schema from the server's OpenAPI document.
- UpdateOrganizationRequest
- The `UpdateOrganizationRequest` schema from the server's OpenAPI document.
- UpdatePermissionRequest
- The `UpdatePermissionRequest` schema from the server's OpenAPI document.
- UpdateReactorRequest
- The `UpdateReactorRequest` schema from the server's OpenAPI document.
- UpdateResourceRequest
- The `UpdateResourceRequest` schema from the server's OpenAPI document.
- UpdateRole
- The `UpdateRole` schema from the server's OpenAPI document.
- UpdateScopeRequest
- The `UpdateScopeRequest` schema from the server's OpenAPI document.
- UpdateServiceAccount
- The `UpdateServiceAccount` schema from the server's OpenAPI document.
- UpdateTenant
- Fields that can be updated on an existing tenant.
- UpdateUserRequest
- The `UpdateUserRequest` schema from the server's OpenAPI document.
- UpdateWebhookRequest
- The `UpdateWebhookRequest` schema from the server's OpenAPI document.
- UserAttributeMap
- Which directory attribute feeds each AXIAM user field.
- UserResponse
- Public-safe user representation (no password_hash, no mfa_secret).
- WebauthnAttestationPolicy
- Per-tenant WebAuthn attestation policy (D5). One row per tenant; an absent row means
[`WebauthnAttestationPolicy::default`], which is today's behavior unchanged.
- WebauthnPolicy
- WebAuthn ceremony policy. One field today. It is a struct rather than a bare field on
[`SecuritySettings`] so that the next WebAuthn control has an obvious home, and so the admin
UI can group them. The *attestation* policy is deliberately not here: it lives in
[`crate::models::webauthn_policy::WebauthnAttestationPolicy`], is tenant-only, and cannot
join this model because AAGUID allow/block lists have no "more restrictive than" ordering to
validate an override against. User verification does, so it can.
- WebhookResponse
- Webhook response — omits the shared secret.
Enums
- ActorType
- The `ActorType` enumeration from the server's OpenAPI document.
- AttestationMode
- What attestation conveyance a registration ceremony requests, and whether the policy is
enforced at all. `None` is the default and reproduces today's behavior byte-for-byte:
`evaluate` allows every registration unconditionally, with no MDS lookup (D8 step 1).
- AttributeSource
- Where an attribute's value comes from. Every variant has a real source today; a variant with
none (a telephone number the OIDC `phone` scope gates behind its own consent, say) is
deliberately absent rather than mapped to an empty value.
- AuditOutcome
- The `AuditOutcome` enumeration from the server's OpenAPI document.
- AuthnRequestParamsMode
- Whether this client's authorization requests may carry OpenID Connect's
authentication-request parameters, or whether they are ignored (X7.1). The bundle this
governs is `prompt`, `max_age`, `acr_values`, `claims`, `id_token_hint`, `login_hint`,
`display`, `ui_locales` and `claims_locales`. It is **one** field rather than nine booleans
for the same reason [`ClientProfile`] is one field rather than a dozen: a client that
honours `max_age` but ignores `prompt=none` is not "mostly conformant", it is a client a
relying party cannot reason about. [`Ignore`](Self::Ignore) is the serde default and is
exactly what AXIAM has always done — unknown authorization-request parameters are dropped by
the query deserialiser and never reach a decision. Every row written before schema v54
therefore decodes to the behaviour it already had.
- CertificateStatus
- Status of a certificate in its lifecycle.
- CertificateType
- The purpose for which a certificate was issued.
- CertificationLevel
- FIDO certification level, as recorded in an MDS `statusReports` entry's `FIDO_CERTIFIED*`
status. Variant order is significant: `derive(PartialOrd, Ord)` gives `L1 < L1Plus < L2 <
L2Plus < L3 < L3Plus`, which `WebauthnAttestationPolicy::evaluate` (D8 step 9) relies on
directly for the `min_certification` boundary check (`entry_level >= policy_min`).
- CibaDeliveryMode
- How a CIBA client learns that a request has been decided (CIBA Core §5). `push` is
deliberately absent: AXIAM does not offer it, and the FAPI-CIBA profile forbids it — push
delivers the tokens themselves to a client endpoint, which makes the notification endpoint a
token sink.
- CibaRequestSigningAlg
- The JWS algorithm a CIBA client signs its authentication requests with (CIBA Core §4
`backchannel_authentication_request_signing_alg`, §7.1.1). Exactly the three algorithms
AXIAM verifies on any client-signed JWT (`axiam_oauth2::jose::PERMITTED_ALGORITHMS`): FAPI
2.0 §5.3.1.1's list. A registration naming anything else — `RS256`, `HS256`, `none` — is
refused rather than stored, so no row can hold an algorithm the verifier would not honour
(D-61).
- ClientAuthMethod
- How a client proves its identity at the token endpoint (RFC 8705 §2, OIDC Core §9 naming).
- ClientProfile
- Which security posture a client is registered under (X5.1). This is the FAPI "one switch".
- DeprovisionPolicy
- What happens downstream to a user who falls out of scope or is no longer active. Erasure
always deletes, whatever this says.
- DirectoryKind
- Which kind of directory server a configuration points at. It drives **defaults only**: the
external-id attribute, the group-membership strategy and the change attribute the sync job
reads. Every one of them is still an explicit, editable field of the configuration (or, for
the strategy and change attribute, derived from this value at the point of use); nothing
about the kind changes what is *allowed*.
- FailurePolicy
- What the server does when an interceptor does not produce a usable reply — timeout,
transport failure, bad signature, stale nonce, or a patch the allow-list rejects.
- KeyAlgorithm
- The type of key algorithm used for a certificate.
- ManagedBy
- Who created a client registration (D5, T21.4). The discriminator that separates a
registration an administrator made from one that arrived over an open endpoint. Three things
read it and each would otherwise have to infer provenance from something that is not
provenance: * `axiam_oauth2::fapi` refuses a FAPI profile on anything but
[`Admin`](Self::Admin) (I5) — a client nobody vetted cannot be financial-grade; * the
authorization endpoint forces a consent hop for every other value (D4) — an unrelated party
gets a question put to the end user, whatever scopes it asked for; * the T21.4 sweeper
deletes only [`Dcr`](Self::Dcr) rows, so an administrator's client is never swept however
long it sits unused. [`Admin`](Self::Admin) is the serde default and therefore what every
row written before T21.4 decodes to, which is the truth: they were all created through `POST
/oauth2-clients` by somebody holding `oauth2_clients:create`.
- MfaMethodType
- Type of MFA method.
- NameIdFormat
- How the assertion's `NameID` is formed (per service provider).
- NetworkSegmentKind
- What a segment is for.
- NotificationEventType
- Events that can trigger an admin notification.
- PermissionEffect
- Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default
deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant
refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny
wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in
full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one
checkable property — **adding a deny rule can never widen access, and can never be undone by
adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X
denied?" unanswerable without enumerating every other rule that might out-specify it.
- PgpKeyAlgorithm
- Key algorithm for OpenPGP keys.
- PgpKeyPurpose
- The purpose of an OpenPGP key.
- PgpKeyStatus
- Status of an OpenPGP key.
- RadiusServiceType
- `Service-Type` (RFC 2865 §5.6). Option B accepts only `framed_user`; the administrative
values are refused with a 400.
- RadiusTerminationAction
- `Termination-Action` (RFC 2865 §5.29).
- ReactorMode
- How a reactor participates in an event.
- SamlBinding
- A SAML 2.0 protocol binding (SAML Bindings §3). The response binding for Web Browser SSO is
always [`Self::HttpPost`], but the enum keeps both because SP metadata carries both, and an
`slo_url` may use either.
- SamlIdpCredentialStatus
- Where a signing credential is in its life. An open set: an SDK decodes a value it does not
know without failing.
- SamlIdpSlot
- Which slot a credential is issued into.
- ScimTokenStatus
- Why a token is or is not currently usable — for display only. The authentication path never
surfaces this distinction on the wire.
- SettingsScope
- Whether a settings row belongs to an organization or a tenant.
- SsfDeliveryMethod
- How SETs reach the receiver.
- SsfEventType
- The six event types AXIAM transmits (G-5). Stored and sent as their event-type URIs;
[`Self::ALL`] is the canonical order every list AXIAM returns is sorted in.
- SsfStatusActor
- Who set a stream's current status. A status an administrator set to anything but `enabled`
cannot be changed by the receiver (D-51).
- SsfStreamStatus
- A stream's SSF status (SSF 1.0 §8.1.2), with AXIAM's meaning pinned by D-51.
- SsfSubjectFormat
- Which RFC 9493 subject identifier names the user in the SETs of a stream (D-46).
- TenantKind
- What a tenant *is*, as distinct from what state it is in. Reserved rather than inferred: an
organization has exactly one tenant of kind [`Self::Organization`], enforced by a unique
index rather than by convention. Deriving it from a magic slug or from "the oldest tenant"
would make the organization scope something an operator could rename or delete by accident,
and it is the scope the super-admin lives in.
- TenantStatus
- Lifecycle status of a tenant. A `Suspended` tenant remains stored and its data isolated, but
is treated as administratively disabled. New tenants are `Active` by default.
- UnknownAaguidAction
- What to do with an AAGUID that has no MDS entry (i.e. FIDO Alliance has no metadata for it —
not necessarily malicious, MDS coverage is incomplete for some legitimate authenticators).
- UserNameSource
- Which AXIAM attribute becomes the downstream `userName`. The mapping is a fixed attribute
set, not a mapping language (D-57).
- UserStatus
- The `UserStatus` enumeration from the server's OpenAPI document.