Management
Table of Contents
Namespaces
- Manifest
- Models
Classes
- AuditApi
- Append-only audit log, read-only by construction.
- CaCertificatesApi
- Organization CAs and the per-tenant signing CAs chained beneath them.
- CertificatesApi
- End-entity X.509 certificates -- the ones issued to users, services and IoT devices.
- ConflictError
- `409 Conflict` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- DirectoryApi
- A tenant's LDAP / Active Directory identity source (CONTRACT §30): the one configuration,
the explicit act that links an existing local account to its directory entry, and a
read-only view of the sync job. Signing in needs nothing new -- a directory account calls
the same §1 `login`.
- EmailConfigApi
- Transactional-mail transport, configurable at organization level and overridable per tenant.
- FederationApi
- Upstream IdP configuration and the per-user links it produces.
- FieldError
- One field-level complaint from a `400`/`422` validation body (CONTRACT.md §27.4
rule 7).
- GroupsApi
- Named collections of users. Roles assigned to a group are inherited by every member.
- ManagementApi
- The CONTRACT.md §27 management surface: 202 operations across 29 namespaces.
- ManagementChecks
- Local checks the generated §27 surface runs before any I/O (generator table `PRECHECKS`).
- ManagementErrorMapper
- The §27 status→error mapper (CONTRACT.md §27.4 rule 7).
- ManagementSupport
- Base class for the 28 generated namespace handles (CONTRACT.md §27.2).
- ManagementTransport
- The single wire path every one of the 190 §27 management operations goes through
(CONTRACT.md §27.8).
- NamespaceScope
- The `{org_id}`/`{tenant_id}` a namespace handle substitutes into its routes
(CONTRACT.md §27.4 rule 3).
- NetworkApi
- A tenant's network segments and the RADIUS reply profile each owns (RADIUS Live profile): a
segment is a node of the reserved /network subtree of the resource tree (kind, VLAN,
Filter-Id envelope, placement rank), and its profile is the typed `axiam-radius-reply/1`
record a decision renders. Every write is conditional on the `version` the caller read and
passes the server's write gate. The tenant's Session-Timeout cap is one more row of it
(get_policy, replace_policy): lowering it is always allowed, raising it is allowed and
audited. The decision route FreeRADIUS calls is not in this registry.
- NotFoundError
- `404 Not Found` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- NotificationRulesApi
- Which events raise a notification, and to whom.
- Oauth2ClientsApi
- Registered OAuth2/OIDC clients -- the registration half of what §12, §21 and §26 then speak
to.
- OrganizationsApi
- Organizations an SDK client may read and configure. Creation and deletion are outside the
SDK boundary (§27.0).
- Page
- One page of a paginated §27 list response (CONTRACT.md §27.4 rule 4).
- PageRequest
- One page's worth of `?offset=`/`?limit=`/`?search=` for a paginated §27 list call
(CONTRACT.md §27.4 rule 4).
- PermissionsApi
- Permissions -- an action on a resource, optionally narrowed by a scope.
- PgpKeysApi
- OpenPGP keys used for audit signing and encrypted data export.
- PlatformApi
- Deployment-level probes and FIDO metadata state. Unauthenticated where the server leaves
them so.
- PrivacyApi
- GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller,
never to another user.
- ReactorsApi
- Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK
could previously reach.
- ReadModifyWrite
- The read-modify-write form CONTRACT.md §27.4 rule 5 recommends for `replace` updates: a
read result turned back into the replacement body, every member carried over, so that
changing one field and sending the body back preserves the rest instead of resetting
every omitted member to its default.
- ResourcesApi
- The resource hierarchy role assignments cascade down.
- RolesApi
- Roles, their permission sets, and their assignment to users and groups.
- SamlApi
- A tenant's SAML 2.0 identity provider (CONTRACT §29): the registry of service providers, the
import of an SP's metadata into a *draft* registration (never a write), and the lifecycle of
the IdP signing credential. The protocol itself -- single sign-on, single logout, the IdP
metadata document -- is browser and SP-to-IdP surface under /saml/v2/{tenant_id}, an SP's
own SAML library speaks to it, and it is not in this registry.
- ScimTargetsApi
- A tenant's outbound SCIM targets (CONTRACT §31): the downstream SCIM 2.0 service providers
AXIAM pushes the tenant's users and groups to, each with its delivery state. The credential
AXIAM pushes with is write-only. Deleting a target does not deprovision anything downstream.
- ScimTokensApi
- Bearer tokens for the SCIM 2.0 provisioning endpoint.
- ScopesApi
- Sub-resource granularity, always addressed under their resource.
- ServiceAccountsApi
- Machine identities, their secrets, and the certificate a device-bound one authenticates
with.
- SettingsApi
- Effective settings, and the organization/tenant layers they resolve from.
- SsfApi
- A tenant's Shared Signals Framework streams (CONTRACT §32): which receiver -- an OAuth2
client of the tenant -- receives which CAEP and RISC security events, as SETs pushed to its
endpoint or polled. The receiver's own protocol (transmitter metadata, the SSF stream
management API, polling) is not in this registry.
- TenantsApi
- Tenants within an organization -- the isolation boundary every other namespace is scoped to.
- UsersApi
- Users within the client's tenant, and the administrative side of their second factor and
lockout state.
- ValidationError
- `400`/`422` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- WebauthnPolicyApi
- Per-tenant attestation policy governing the §24 ceremonies, and the compliance report over
it.
- WebhooksApi
- Outbound event notifications. Delivery signatures are verified with the §13 helper, which
this namespace configures.
Enums
- JsonNull
- An explicit JSON `null`, as distinct from an ABSENT member (CONTRACT.md §27.4 rule 5,
"null is not absent").