AXIAM PHP SDK

Application

Interfaces

JtiStore: CONTRACT.md §21.7.2 check 8 — single-use `jti` tracking for DPoP proofs.
MdsRefreshOutcomeVariant: `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors `axiam_db::mds_ingest::MdsIngestOutcome`).
ProviderConfigVariant: Provider-specific connection details.
ScimTargetAuthVariant: How AXIAM authenticates to the downstream service provider, without the credential itself.
ScimTargetScopeVariant: Which users a target provisions.
SubjectAltNameVariant: A name to put in a `Server` certificate's `subjectAltName`. Stated explicitly in the request, never read from a CSR: a CSR asking for a `subjectAltName` extension is still refused. URI and e-mail names are not offered — nothing in AXIAM consumes them yet.
CibaClock: The clock {@see OidcClient::cibaAwait()} waits on — injectable so the §33.7 schedule is testable without sleeping.
OidcStateStoreInterface: Optional server-side store for in-flight `oidcBegin` state (CONTRACT.md §12.3 rule 1).
OpaqueNativeInterface: The `libaxiam_opaque_ffi` C ABI, expressed in PHP terms.
ReactorDelivery: One message off the reactor's own queue (CONTRACT.md §22.1).
ReactorTransport: One live broker session for a reactor: a consumer on the reactor's own queue, and a way to publish a reply back to the queue the delivery named (CONTRACT.md §22.1, §8b).
ReplayStore: Remembers the `jti`s an {@see SsfReceiver} already accepted (CONTRACT.md §32.7 step 9).

Classes

AccessEnforcer: The single CONTRACT.md §11 ("Declarative Authorization Helpers") enforcement implementation, shared by BOTH framework bridges ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener} and {@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) so the `#[RequireAuth]` / `#[RequireAccess]` / `#[RequireRole]` semantics can never drift between the two integrations. Neither bridge re-implements resource resolution, subject propagation, or the error-mapping table below — both call into this class exclusively.
MfaEnrollment: A TOTP factor offered but not yet active (CONTRACT.md §25.1).
PasswordResetConfirmation: Arguments to `AxiamClient::confirmPasswordReset()` (CONTRACT.md §25.1).
PasswordResetContext: The OPAQUE policy for the account a reset token belongs to (CONTRACT.md §25.1).
PasswordResetRequest: Arguments to `AxiamClient::requestPasswordReset()` (CONTRACT.md §25.1).
AmqpDropMessage: Poison-message sentinel. Application handlers throw this to signal that a message is unprocessable and must NOT be requeued (e.g. a permanently malformed or unsupported event) — distinct from a transient failure, which should be requeued for retry.
Consumer: php-amqplib blocking consume loop with HMAC verify-before-handler (CONTRACT.md §8, D-04).
Hmac: HMAC-SHA256 verify-before-handler primitive for inbound AMQP messages (CONTRACT.md §8).
ReplayGuard: NEW-4 (CONTRACT.md §8 "v2 — Replay Protection", hard cutover) validation gates, checked ONLY AFTER a delivery's HMAC signature has already verified (see Hmac::verify / Consumer::verifyAndDispatch).
ManagedGroup: Declares that a group must exist, as part of a CONTRACT.md §27.6 manifest.
ManagedPermission: Declares that a permission must exist, as part of a CONTRACT.md §27.6 manifest.
ManagedResource: Declares that a resource must exist, as part of a CONTRACT.md §27.6 manifest.
ManagedRole: Declares that a role must exist, as part of a CONTRACT.md §27.6 manifest.
OnReactorEvent: Declares that a method handles one reactor hook event (CONTRACT.md §22.14, canonical `reactor_handlers`).
RequireAccess: Declarative per-endpoint authorization requirement (CONTRACT.md §11, canonical `require_access(action, resource[, scope])`). Placing this attribute on a controller method or class does not itself perform any check — it is metadata read by the framework-specific enforcement listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener}, {@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which resolves the target resource and delegates the actual authorization decision to {@see \Axiam\Sdk\AccessEnforcer::enforceAccess()}.
RequireAuth: Declarative "endpoint requires an authenticated AXIAM identity" marker (CONTRACT.md §11, canonical `require_auth`). Pure sugar over the CONTRACT.md §10 authentication guard for frameworks (Laravel, Symfony) where that guard is applied per-route rather than globally: placing this attribute on a controller method or class does not itself perform any verification — it is read by the framework-specific enforcement listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener}, {@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) which delegates the actual check to {@see \Axiam\Sdk\AccessEnforcer::enforceAuth()}.
RequireRole: Declarative local role check (CONTRACT.md §11, canonical `require_role(role...)`, MAY-level helper). Placing this attribute on a controller method or class does not itself perform any check — it is metadata read by the framework-specific enforcement listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener}, {@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which delegates to {@see \Axiam\Sdk\AccessEnforcer::enforceRole()}.
DeviceToken: The result of `AxiamClient::authenticateDevice()` — the mTLS device login (CONTRACT.md §6.1 rules 6-10, contract 1.51).
DpopRequest: What {@see DpopVerifier::verifyProof()} needs to know about the current request.
DpopVerifier: DPoP proof verification — CONTRACT.md §21.7.2 (RFC 9449), contract 1.16.
InMemoryJtiStore: A {@see JtiStore} for a single PHP process.
JwksVerifier: Local EdDSA/Ed25519 JWKS verification (CONTRACT.md D-08).
LoginResult: Result of `AxiamClient::login()` (CONTRACT.md §1, D-09).
PresentedProofs: What the caller proved about **this** connection and **this** request, for {@see JwksVerifier::verifyTokenBinding()}.
RefreshGuard: Shared-promise clear-on-both-paths helper (CONTRACT.md §9, D-06).
RevocationFeed: The optional session-revocation feed poller (CONTRACT.md §10.4, contract 1.44 — AXIAM threats T-39 and T-143).
RptPermission: A UMA 2.0 permission carried by an RPT (CONTRACT.md §20) — one entry of {@see TokenIntrospection::$permissions}.
TokenIntrospection: The result of `AxiamClient::introspectToken()` — the RFC 7662 set, every field of the wire `IntrospectTokenResponse` (CONTRACT.md §1.1.1 rule 3, contract 1.51).
TokenValidation: The result of `AxiamClient::validateToken()` — every field of the wire `ValidateTokenResponse` (CONTRACT.md §1.1.1 rule 3, contract 1.51).
UserInfo: Result of `AxiamClient::getUserInfo()` (CONTRACT.md §1.1, contract 1.3).
AuthzDispatcher: Transparent REST/gRPC authz transport selection (CONTRACT.md §1, D-03, SC#3).
AxiamClient: The AXIAM PHP SDK's public REST entry point (CONTRACT.md §1–§9, SC#1).
AuthError: Authentication failure: wrong credentials, expired session, MFA failure, or a 401 on refresh (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so REST and gRPC transports cannot drift on the error taxonomy.
AuthzError: Authorization failure: the caller is authenticated but lacks permission for the requested operation (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so REST and gRPC transports cannot drift on the error taxonomy.
AxiamException: Base exception for all AXIAM SDK errors (CONTRACT.md §2, D-10).
ConfigClampedEvent: Emitted at construction, once per caller-supplied setting the SDK clamped (CONTRACT.md §19.1, §19.2 rule 6).
DecisionMemo: Client-side decision memo — CONTRACT.md §17.
ErrorMapper: Central status→error mapper (CONTRACT.md §2, D-10). {@see self::fromStatus()} is the single translation point from an HTTP status code to a typed {@see AxiamException} subtype — no other class in the SDK is permitted to hand-roll this branching: 401 → {@see AuthError}; 403/409 → {@see AuthzError}; everything else (400/408/429/5xx/transport) → {@see NetworkError}.
NetworkError: Transport-level failure: connection refused, timeout, TLS error, DNS failure, or a server-side 5xx (CONTRACT.md §2).
OAuthProtocolError: An RFC 6749 protocol error returned by an `/oauth2/*` endpoint as an `OAuth2ErrorResponse` body — `invalid_grant`, `invalid_client`, `invalid_request`, `unsupported_grant_type`, … (CONTRACT.md §2, §12.3 rule 3).
RefreshEvent: Emitted around a §9 single-flight refresh (CONTRACT.md §19).
RequestEndEvent: Emitted after a call completes, success or failure (CONTRACT.md §19).
RequestStartEvent: Emitted before an outbound call leaves the SDK (CONTRACT.md §19).
RetryEvent: Emitted before each §16 retry wait (CONTRACT.md §19).
RetryPolicy: Bounded read-only retry policy — CONTRACT.md §16.
Sensitive: Wraps a token-carrying value so it can never be accidentally exposed via `__toString()`, `var_export()`/`print_r()`, or JSON serialization (CONTRACT.md §7, D-11).
SsfUnjudgedEvent: Emitted when `ssf.poll` returns normally leaving at least one SET unjudged (CONTRACT.md §19.1, contract 1.60; §34.2 P1).
TelemetryDispatcher: Internal §19 dispatcher. A null hook is the overwhelmingly common case and costs one null check per request.
TelemetryEvent: A telemetry event (CONTRACT.md §19).
AuthzGrpcClient: gRPC authorization transport (CONTRACT.md §1/§6/§9, D-03/D-06/D-12).
TokenGrpcClient: gRPC token-validation transport (CONTRACT.md §1.1.1/§10.3, contract 1.51) — wraps `axiam.v1.TokenService/ValidateToken` and `/IntrospectToken`, the RPCs §10.3 obliges a gRPC-validating SDK to read `cnf` from and no method in this SDK's public surface wrapped before 1.51.
UserInfoGrpcClient: gRPC userinfo transport (CONTRACT.md §1.1/§5/§6/§9, contract 1.3) — the low-latency gRPC counterpart of the server's REST `GET /oauth2/userinfo` endpoint. This is the hand-written service-client sibling of {@see AuthzGrpcClient}: it mirrors that class's channel/metadata/status-mapping machinery exactly, differing only in the single RPC it exposes (`GetUserInfo` instead of `CheckAccess`/`BatchCheckAccess`).
AxiamAccessMiddleware: Laravel CONTRACT.md §11 declarative-authorization enforcement middleware, registered under the `axiam.access` alias (D-02). Supports BOTH developer-experience styles the plan calls for, from the SAME class, delegating every actual decision to the shared {@see AccessEnforcer} (never re-implementing resource resolution, subject propagation, or the error-mapping table itself):
AxiamGate: Laravel authorization gate (D-02, CONTRACT.md §1/§10): a one-line delegation to {@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins, default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker.
AxiamMiddleware: Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie token, verifies it via {@see AxiamClient::verifyLocally()} — the no-fallback seam mandated by §10.1 rule 8 — and populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on success. Returns a standardized 401 JSON error body on any failure (missing token, invalid signature, expired token). Never duplicates JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is made by {@see AxiamClient}.
AxiamServiceProvider: Auto-discovered Laravel bridge entry point (D-01): listed under `composer.json` `extra.laravel.providers`, so a Laravel consumer gets this provider registered with ZERO manual wiring beyond `composer require axiam/axiam-sdk` (true zero-config auto-discovery, unlike the Symfony bridge which has no equivalent mechanism without a published Flex recipe).
OidcCallbackController: Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): an invokable controller that validates the IdP callback, consumes the single-use stored state, exchanges the authorization code, and redirects (or replies `200 JSON`) on success. All security-critical logic lives in {@see OidcLoginFlow} — see {@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
OidcLoginController: Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): an invokable controller that builds the authorization request, parks its `state`/`nonce`/`code_verifier` in the configured {@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the browser to the IdP. All security-critical logic lives in {@see OidcLoginFlow} — this class only translates its {@see OidcLoginOutcome} into an HTTP response, exactly as {@see AxiamMiddleware} never duplicates {@see \Axiam\Sdk\AxiamClient}'s own verification logic.
AuditApi: Append-only audit log, read-only by construction.
CaCertificatesApi: Organization CAs and the per-tenant signing CAs chained beneath them.
CertificatesApi: End-entity X.509 certificates -- the ones issued to users, services and IoT devices.
ConflictError: `409 Conflict` on the §27 management surface — CONTRACT.md §27.4 rule 7.
DirectoryApi: A tenant's LDAP / Active Directory identity source (CONTRACT §30): the one configuration, the explicit act that links an existing local account to its directory entry, and a read-only view of the sync job. Signing in needs nothing new -- a directory account calls the same §1 `login`.
EmailConfigApi: Transactional-mail transport, configurable at organization level and overridable per tenant.
FederationApi: Upstream IdP configuration and the per-user links it produces.
FieldError: One field-level complaint from a `400`/`422` validation body (CONTRACT.md §27.4 rule 7).
GroupsApi: Named collections of users. Roles assigned to a group are inherited by every member.
ManagementApi: The CONTRACT.md §27 management surface: 202 operations across 29 namespaces.
ManagementChecks: Local checks the generated §27 surface runs before any I/O (generator table `PRECHECKS`).
ManagementErrorMapper: The §27 status→error mapper (CONTRACT.md §27.4 rule 7).
ManagementSupport: Base class for the 28 generated namespace handles (CONTRACT.md §27.2).
ManagementTransport: The single wire path every one of the 190 §27 management operations goes through (CONTRACT.md §27.8).
ApplyReport: What {@see ManifestApi::apply()} actually did — including, when it stopped early, what it had already done.
BindingRebindFailed: A role binding's `Update` failed at its RE-ASSIGNMENT (§27.6.1 addition 2, contract 1.51).
ManagementManifest: A declarative description of the state a tenant must be in (CONTRACT.md §27.6).
ManagementPlan: What {@see ManifestApi::plan()} produced: the ordered changes an apply would make.
ManifestApi: Plans and applies a §27.6 manifest (CONTRACT.md §27.6, §27.7).
ManifestAttributeReader: Builds a {@see ManagementManifest} from the `#[Managed*]` attributes on a class (CONTRACT.md §27.6).
ManifestBuilder: Fluent construction of a {@see ManagementManifest} (CONTRACT.md §27.6).
ManifestEntity: One entity a §27.6 manifest declares must exist.
ManifestException: A manifest was rejected before any request was sent (CONTRACT.md §27.6).
ManifestValidation: Refuses an incoherent manifest BEFORE the first wire call (CONTRACT.md §27.6).
NetworkReconciler: The `network` namespace of a §27.6 manifest (CONTRACT.md §27.6.2, contract 1.62): what `plan` reads, and how `apply` writes the three kinds — the tenant's policy, its segments and their reply profiles — through the generated {@see NetworkApi}.
PlannedChange: One entry in a {@see ManagementPlan}: what would happen to one entity, and why.
RoleBinding: One role bound to a subject — a group or a service account — in one of the two shapes §27.6.1 addition 2 allows (contract 1.51).
AcsEndpoint: One `AssertionConsumerService` endpoint of a service provider. The list of these is an **allow-list**, checked the way OAuth2 redirect URIs are: an `AuthnRequest` naming an ACS URL is honoured only when the URL equals one registered here, byte for byte. No globs, no prefix match.
AddMemberRequest: The `AddMemberRequest` schema from the server's OpenAPI document.
AddServiceAccountMemberRequest: The `AddServiceAccountMemberRequest` schema from the server's OpenAPI document.
ApiProviderConfig: API-based provider configuration (SendGrid, Postmark, Resend, Brevo). `api_key` follows the same write-only + omit-preserving contract as [`SmtpConfig::password`] (D-01/D-02).
AssignRoleToGroupRequest: The `AssignRoleToGroupRequest` schema from the server's OpenAPI document.
AssignRoleToServiceAccountRequest: The `AssignRoleToServiceAccountRequest` schema from the server's OpenAPI document.
AssignRoleToUserRequest: The `AssignRoleToUserRequest` schema from the server's OpenAPI document.
AttributeMapping: One entry of an SP's attribute mapping table.
AuditLogEntry: The `AuditLogEntry` schema from the server's OpenAPI document.
BindCertificate: Request to bind a certificate to a service account.
CaCertificate: A CA (Certificate Authority) certificate at the organization level. CA certificates are the root of trust for all tenant certificates within the organization. Private keys for signing CAs are encrypted with AES-256-GCM and stored separately; non-signing CAs only store the public certificate.
Certificate: A tenant-level certificate for users, services, or IoT devices. Certificates are signed by the organization's CA. The private key is returned once on generation and never stored by AXIAM.
CertificatePolicy: Certificate issuance constraints.
CimdPolicy: Whether, and on what terms, a `client_id` that is a URL is resolved by fetching the document it names (T21.5, `draft-ietf-oauth-client-id-metadata-document`). # Why this is one nested policy rather than nine fields Every field here is a term of a single decision — *do we fetch a stranger's URL and make a client out of what comes back* — and none of them means anything without [`Self::enabled`]. A tenant that states a CIMD posture states all of it; a tenant that states none inherits its organization's whole posture rather than half of one, which is the only merge that cannot produce a combination neither party wrote. # The two fields that can widen, and the seven that cannot [`Self::enabled`] and [`Self::allow_http`] are **ordered**: a tenant may turn either off but never on, exactly as `dynamic_registration` may only move down its ladder. Everything else names *this tenant's* domains or *this tenant's* bounds, and there is no sense in which one tenant's list of trusted publishers is stricter than another's — the same argument [`OidcPolicy`] already makes for `dcr_allowed_redirect_hosts`. # Every bound here is a security control [`Self::max_metadata_bytes`], [`Self::min_cache_secs`] and [`Self::max_cache_secs`] are not tuning knobs. They are, respectively, the ceiling on a read from an attacker-chosen URL, the floor under how often that read may be repeated, and the ceiling on how long its result may be trusted. Each is clamped again in code against the three constants above, so a settings row written by hand cannot lift them.
ComplianceReportEntry: One credential's compliance outcome (D9).
ConsentView: One consent record, as the subject sees it.
CreateCaCertificateRequest: The `CreateCaCertificateRequest` schema from the server's OpenAPI document.
CreateCertificateRequest: The `CreateCertificateRequest` schema from the server's OpenAPI document.
CreateFederationConfigRequest: The `CreateFederationConfigRequest` schema from the server's OpenAPI document.
CreateGroupRequest: The `CreateGroupRequest` schema from the server's OpenAPI document.
CreateIntermediateCaRequest: Body of `POST .../tenants/{tenant_id}/signing-cas`.
CreateNetworkReplyProfileRequest: The body of `POST /api/v1/network/profiles`.
CreateNetworkSegmentRequest: The body of `POST /api/v1/network/segments`.
CreateNotificationRuleRequest: The `CreateNotificationRuleRequest` schema from the server's OpenAPI document.
CreateOAuth2ClientRequest: The `CreateOAuth2ClientRequest` schema from the server's OpenAPI document.
CreatePermissionRequest: The `CreatePermissionRequest` schema from the server's OpenAPI document.
CreatePgpKeyRequest: The `CreatePgpKeyRequest` schema from the server's OpenAPI document.
CreateReactorRequest: The `CreateReactorRequest` schema from the server's OpenAPI document.
CreateRegistrationTokenRequest: Request body for [`create_registration_token`].
CreateRegistrationTokenResponse: The one response that carries the handle.
CreateResourceRequest: The `CreateResourceRequest` schema from the server's OpenAPI document.
CreateRoleRequest: The `CreateRoleRequest` schema from the server's OpenAPI document.
CreateScimTokenRequest: The `CreateScimTokenRequest` schema from the server's OpenAPI document.
CreateScimTokenResponse: The one-time reveal. Same shape as service-account creation: the secret is returned once and only its hash is kept.
CreateScopeRequest: The `CreateScopeRequest` schema from the server's OpenAPI document.
CreateServiceAccountRequest: The `CreateServiceAccountRequest` schema from the server's OpenAPI document.
CreateTenantRequest: Request body for tenant creation (organization_id comes from the URL path).
CreateUserRequest: The `CreateUserRequest` schema from the server's OpenAPI document.
CreateWebhookRequest: The `CreateWebhookRequest` schema from the server's OpenAPI document.
DirectoryConfig: A tenant's directory configuration, as stored and as read back. Carries no secret: see the module documentation.
DirectoryLinkResult: What linking did.
DirectorySyncStatus: A read-only view of the sync job's state for one tenant. Counts of what a run did are in its audit rows, and no account id is here.
EmailConfig: Fully resolved email configuration (all fields present).
EmailConfigOverride: Partial tenant overrides for email configuration. `None` = inherit from org baseline.
EmailTestResult: What a test send did.
EmailVerificationPolicy: Email verification requirements.
EncryptedExport: Result of encrypting data with a PGP public key.
EncryptRequest: Request body for encrypting data.
FederationConfigResponse: Federation config response -- omits client_secret.
FederationLinkResponse: The `FederationLinkResponse` schema from the server's OpenAPI document.
GeneratedCaCertificate: Response returned when a CA certificate is generated. Includes the private key PEM, which is returned **once** and never stored or retrievable again — when the custodian produced one at all. Under `vault_pki` custody the key was born inside Vault and there is nothing to return, which is the point of that custodian rather than a shortcoming of this response.
GeneratedCertificate: Response returned when a tenant certificate is generated. Includes the private key PEM, returned **once** and never stored.
GeneratedPgpKey: Response returned when a PGP key is generated.
GrantedScope: A scope named by a grant, resolved to something a human can read.
GrantPermissionRequest: The `GrantPermissionRequest` schema from the server's OpenAPI document.
GrantScopeConsent: Body for recording an OIDC scope-release consent.
Group: A group of users that can access resources based on their roles and permissions. Groups simplify role management by allowing roles to be assigned to a group rather than individual users.
GroupMapping: One row of the group-mapping table (G-3, T23.3.4, D-30): a directory group, named by its distinguished name, and the AXIAM group a member of it is put into. **The table is the only way a directory group reaches an AXIAM group.** There is no match by name, no prefix or wildcard, and no AXIAM group is ever created from a directory one: a directory administrator who names a group `admins` gains nothing unless a tenant administrator mapped it here. The DN is stored as the administrator typed it and compared after RFC 4514 normalisation (`axiam_directory::dn`), so `CN=Staff, OU=Groups` and `cn=staff,ou=groups` are the same row.
HealthResponse: Response body for `GET /health`. `profile` and `unavailable` are additive (G-8, D-59): a client that reads only `status` is unaffected.
ImportCaCertificateRequest: Body of `POST /api/v1/organizations/{org_id}/ca-certificates/import`. Deliberately carries no subject, validity window or key algorithm: all three are read out of the certificate itself. A caller that could name them separately could name a subject the certificate does not have, and AXIAM would enforce the claim while every relying party read the certificate.
IssueSamlIdpCredential: `POST …/saml/idp-credentials` body.
LinkDirectoryAccount: `POST /api/v1/tenants/{tenant_id}/directory/links` body.
LockoutPolicy: Account lockout rules.
MdsRefreshOutcome: `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors `axiam_db::mds_ingest::MdsIngestOutcome`).
MdsRefreshOutcomeInitial: The `initial` arm of {@see MdsRefreshOutcome} (`outcome: "initial"`).
MdsRefreshOutcomeNoOpRefresh: The `no_op_refresh` arm of {@see MdsRefreshOutcome} (`outcome: "no_op_refresh"`).
MdsRefreshOutcomeReplaced: The `replaced` arm of {@see MdsRefreshOutcome} (`outcome: "replaced"`).
MdsRefreshOutcomeRollbackRejected: The `rollback_rejected` arm of {@see MdsRefreshOutcome} (`outcome: "rollback_rejected"`).
MdsStatusResponse: `GET /api/v1/mds/status` response. `no`/`next_update`/`last_refreshed_at` are `None` and `stale` is `false` when MDS has never been ingested — a meaningful, valid answer ("nothing ingested yet"), not an error.
MfaMethodResponse: The `MfaMethodResponse` schema from the server's OpenAPI document.
MfaPolicy: Multi-factor authentication policy.
MigrateCustodyResponse: What a custody migration did.
ModelDecode: Reads a REQUIRED field out of a decoded response body.
MtlsTrustAnchorResponse: The acknowledgement, which is mostly about the restart.
NetworkPolicyResponse: The tenant's network policy, as the management API returns it.
NetworkReplyProfile: A segment's reply profile as read: **the effective one**, with the `Session-Timeout` already clamped to the tenant's current cap (design note §3.4) and `Idle-Timeout` kept within it.
NetworkReplyProfileInput: What a writer supplies for a profile. Closed: an unknown key is a refusal naming it, never ignored (design note §3.4).
NetworkSegmentResponse: A network segment, as the management API returns it.
NotificationPolicy: Admin notification preferences.
NotificationRuleResponse: Notification rule response.
OAuth2ClientCreatedResponse: Response for client creation -- includes the one-time plaintext secret.
OAuth2ClientResponse: OAuth2 client response -- omits client_secret_hash.
OidcAuthorizeRequest: The `OidcAuthorizeRequest` schema from the server's OpenAPI document.
OidcAuthorizeResponse: The `OidcAuthorizeResponse` schema from the server's OpenAPI document.
OidcCallbackRequest: The `OidcCallbackRequest` schema from the server's OpenAPI document.
OidcCallbackResponse: The `OidcCallbackResponse` schema from the server's OpenAPI document.
OidcPolicy: OpenID Connect surface controls (X7 G8, plan §4.6/§4.8; T21.4). Settings that are not password rules, here because this is the org-baseline-plus-tenant-override surface every other per-tenant control lives on. They are not all of the same kind as each other, and which is which is the whole of what [`validate_tenant_override`] and [`clamp_overrides_to_org`] read, so it is set out rather than inferred. **Ordered** — a tenant may be stricter than its organization and never more permissive: * [`Self::sensitive_scopes_enabled`], validated **disable-only** — the mirror image of `mfa_enforced`, because releasing personal data is the less-restrictive direction, so a tenant can turn its organization's decision off but never on. * [`Self::saml_idp_enabled`], validated **disable-only** exactly like [`Self::sensitive_scopes_enabled`] (D-20): a tenant may turn its organization's `true` off and never its `false` on. * [`Self::ssf_enabled`], validated **disable-only** the same way (D-45). * [`Self::dynamic_registration`], on the ladder `disabled` → `initial_access_token` → `anonymous`: a tenant may move down it and never up. * [`Self::dcr_max_clients`] and [`Self::dcr_unused_client_ttl_days`], on the ordinary `tenant <= org` rule — with the wrinkle that `0` on the second means *never sweep*, which is the longest window of all and is handled by [`dcr_ttl_strictness`]. **Not ordered**, therefore never validated against the baseline and never clamped: * [`Self::default_locale`]. A language is a presentation preference; there is no sense in which Italian is stricter than French. * [`Self::dcr_allowed_scopes`], [`Self::dcr_allowed_redirect_hosts`] and [`Self::external_client_allowed_resources`]. Each names per-tenant resources — *this* tenant's MCP servers, *this* tenant's callback hosts — and there is no sense in which one such list is stricter than another. A subset rule would force an organization to enumerate every tenant's resource servers in its own baseline before any tenant could name one. The model's rule is "a tenant may only be more restrictive", which binds every field that *has* a restrictiveness; a field that has none cannot violate it. One cross-field interlock spans both groups and is checked on the resolved policy rather than on either input: see [`validate_dcr_policy`].
OpaqueEnrollment: The client-supplied half of an OPAQUE enrolment, as it appears inside registration / change-password / reset-completion / bootstrap request bodies. There is no standalone `register/finish` endpoint, deliberately. A record can only be created at a moment when the plaintext password legitimately exists on the client, and every one of those moments is already an endpoint that takes a password. A free-standing finish would be an endpoint whose only job is to attach a credential to an account, which is a thing worth not having. Kept separate from [`CreateOpaqueCredential`] because the tenant, the user and the credential identifier are all decided by the server — a client that could name them could enrol a record against somebody else's account.
OpaquePolicy: Secure Remote Password policy. `suite` and `ksf` are the parameters a *new* registration record is enrolled with. They deliberately do not apply retroactively: an existing record is only valid under the suite and KSF it was created with, so tightening these takes effect as users next set a password rather than invalidating everybody at once.
Organization: An organization groups multiple tenants under a single administrative entity. Organizations represent companies, departments, or business units. CA certificates are registered at the organization level, enabling a hierarchical trust model across all tenants.
ParseSamlSpMetadata: `POST …/saml/parse-sp-metadata` body: **exactly one** of the two members.
PasswordPolicy: Password complexity and history requirements.
Permission: The `Permission` schema from the server's OpenAPI document.
PgpKey: An OpenPGP key stored by AXIAM.
PolicyResponse: `GET` response: the stored policy plus the unknown-AAGUID action it currently *resolves to*.
PrivacyPolicy: Data-retention rules that apply after a subject asks to be erased.
ProviderConfig: Provider-specific connection details.
ProviderConfigBrevo: The `brevo` arm of {@see ProviderConfig} (`kind: "brevo"`).
ProviderConfigPostmark: The `postmark` arm of {@see ProviderConfig} (`kind: "postmark"`).
ProviderConfigResend: The `resend` arm of {@see ProviderConfig} (`kind: "resend"`).
ProviderConfigSendGrid: The `send_grid` arm of {@see ProviderConfig} (`kind: "send_grid"`).
ProviderConfigSmtp: The `smtp` arm of {@see ProviderConfig} (`kind: "smtp"`).
ReactorEventDescriptor: One hookable event, as the registry describes it.
ReactorResponse: The `ReactorResponse` schema from the server's OpenAPI document.
ReadyResponse: The `ReadyResponse` schema from the server's OpenAPI document.
RegistrationTokenResponse: Metadata only. The handle exists in plaintext exactly once, in [`CreateRegistrationTokenResponse`].
ReplaceNetworkPolicyRequest: The body of `PUT /api/v1/network/policy`: a **replacement** of the policy.
ReplaceNetworkReplyProfileRequest: The body of `PUT /api/v1/network/profiles/{segment_id}`.
ReplaceNetworkSegmentRequest: The body of `PUT /api/v1/network/segments/{id}`: a **replacement** of the envelope. The kind and the place in the tree do not change.
ResolvedPermissionGrant: A permission grant with its scopes resolved. A superset of [`PermissionGrant`]: `scope_ids` is still present and still authoritative, so a client written before `scopes` existed is unaffected.
Resource: The `Resource` schema from the server's OpenAPI document.
RetryPolicy: Retry policy for failed webhook deliveries.
Role: The `Role` schema from the server's OpenAPI document.
RoleAssignment: A role together with its assignment context (the resource it is scoped to).
RoleGroupAssignment: A group together with the resource scope of its assignment of this role.
RoleServiceAccountAssignment: A service account together with the resource scope of its assignment.
RoleUserAssignment: A user together with the resource scope of their assignment of this role.
RotateSecretResponse: Response for secret rotation.
SamlIdpCredential: The tenant's IdP signing credential, **public facts only**. There is no key on it and no field a key could be put in: the private key is generated by the server, sealed at rest, never returned by any route and destroyed on retirement (D-21).
SamlIdpCredentialPromotion: What promoting the `next` credential did.
SamlIdpInfo: The tenant's SAML IdP, as the administrator needs to see it before and while switching it on: what an SP will be given, and whether it answers yet.
SamlServiceProvider: A registered service provider, as stored.
SamlServiceProviderInput: Everything an administrator supplies when registering or replacing a service provider (`create` and `update` both take it; `update` is a full replacement). Every field but `entity_id`, `display_name` and `acs_urls` has a default, so a client written against a later revision of this struct keeps working.
SamlSpMetadataDraft: A parse of SP metadata: **a draft, not a registration**. Nothing is stored until the caller submits `service_provider` to `create_service_provider` or `update_service_provider`, and nothing in it is trusted because it came from a document (D-41).
ScimReconcileAccepted: The body of a started reconciliation's `202`.
ScimTargetAuth: How AXIAM authenticates to the downstream service provider, without the credential itself.
ScimTargetAuthBearer: The `bearer` arm of {@see ScimTargetAuth} (`type: "bearer"`).
ScimTargetAuthOauth2ClientCredentials: The `oauth2_client_credentials` arm of {@see ScimTargetAuth} (`type: "oauth2_client_credentials"`).
ScimTargetAuthUnknown: A {@see ScimTargetAuth} whose `type` this SDK's copy of the spec does not list.
ScimTargetDeliveryState: A target's delivery state, as `GET` projects it. Fixed vocabulary only: the failure reason is one of the deliverer's phrases, never a URL, a response body or a value.
ScimTargetInput: `create` and `update` (a **replacement**) body.
ScimTargetResponse: A registered SCIM target, as the management API returns it. **The credential is never returned**, and there is no member that says anything about it.
ScimTargetScope: Which users a target provisions.
ScimTargetScopeAllUsers: The `all_users` arm of {@see ScimTargetScope} (`type: "all_users"`).
ScimTargetScopeGroups: The `groups` arm of {@see ScimTargetScope} (`type: "groups"`).
ScimTargetScopeUnknown: A {@see ScimTargetScope} whose `type` this SDK's copy of the spec does not list.
ScimTokenResponse: Metadata only. The handle is never in a list response — it exists in plaintext exactly once, in [`CreateScimTokenResponse`].
Scope: The `Scope` schema from the server's OpenAPI document.
SecuritySettings: Fully resolved security settings (all fields present).
ServiceAccountCreatedResponse: Response for service account creation — includes the one-time plaintext secret.
ServiceAccountResponse: Public-safe service account representation.
SessionResponse: One of a user's sessions, as an administrator sees it.
SetDirectoryConfig: `PUT /api/v1/tenants/{tenant_id}/directory` — a **replacement**. Every `DirectoryConfig` member except `id`, `tenant_id` and the two timestamps, plus the write-only `bind_secret`.
SetMtlsTrustAnchor: Body for `PUT .../ca-certificates/{id}/mtls-trust-anchor`.
SetOrgEmailConfig: Input for setting organization-level email config.
SetOrgSettings: Input for setting organization-level security settings.
SignAuditBatchRequest: Request body for signing an audit batch.
SignCertificateCsrRequest: Body of `POST /api/v1/certificates/sign-csr`. No `subject` and no `key_algorithm`: both are read out of the CSR, which is the only place they can be stated without the row and the certificate being able to disagree. No key is returned, so there is no key field anywhere on this exchange. The CSR's common name meets the rules of `subject` on `POST /api/v1/certificates` (printable, at most 64 characters) and is refused, not rewritten, when it does not. So does the value of every other attribute of the CSR's subject, and a subject with more than one common name is refused.
SignedAuditBatch: A signed batch of audit log entries.
SignIntermediateCsrRequest: Body of `POST .../tenants/{tenant_id}/signing-cas/sign-csr`. Deliberately carries no key algorithm: it is the CSR's, read out of the request, because a caller who could state it separately could state one the key does not have.
SmtpConfig: SMTP-specific configuration. `password` is write-only (D-01): `#[serde(skip_serializing)]` means it is never emitted in a GET/serialized response. On the write path (D-02), `#[serde(default)]` lets a caller omit the field entirely (deserializing to `""`); an empty string is the sentinel for "no new secret supplied — preserve whatever is already stored" (see `SurrealEmailConfigRepository:: set_org_config`). A non-empty value is a real secret to encrypt+replace.
SsfStream: A registered SSF stream, as the management API returns it. **The push `Authorization` header is never returned**; `authorization_header_set` says whether one is stored.
SsfStreamInput: `create_stream` and `update_stream` (a **replacement**) body.
SubjectAltName: A name to put in a `Server` certificate's `subjectAltName`. Stated explicitly in the request, never read from a CSR: a CSR asking for a `subjectAltName` extension is still refused. URI and e-mail names are not offered — nothing in AXIAM consumes them yet.
SubjectAltNameDns: The `dns` arm of {@see SubjectAltName} (`{"dns": …}`).
SubjectAltNameIp: The `ip` arm of {@see SubjectAltName} (`{"ip": …}`).
Tenant: A tenant is an isolated context within an organization. Each tenant has its own set of users, roles, permissions, resources, certificates, and configuration. Tenants can represent environments (dev/staging/prod) or separate business contexts.
TenantSettingsOverride: Partial tenant overrides. `None` = inherit from org baseline.
TokenExchangeTrustRequest: X4 trust for exchanging this provider's tokens (RFC 8693, external issuer). Mirrors [`TokenExchangeTrust`] on the wire rather than reusing it directly so the API surface can carry its own defaults: an admin PUTting a partial block gets the documented default for anything they omitted, instead of a deserialization error listing fields they have never heard of.
TokenExchangeTrustResponse: X4 trust as returned. Same shape as the request; nothing here is secret — an operator reading a provider needs to see exactly what it trusts.
TokenPolicy: Token lifetime configuration.
UpdateDirectoryConfig: `PATCH /api/v1/tenants/{tenant_id}/directory` — a **sparse** update. Every member optional: absent leaves the stored value, and for the two nullable members an explicit `null` clears it.
UpdateFederationConfigRequest: The `UpdateFederationConfigRequest` schema from the server's OpenAPI document.
UpdateGroup: The `UpdateGroup` schema from the server's OpenAPI document.
UpdateNotificationRuleRequest: The `UpdateNotificationRuleRequest` schema from the server's OpenAPI document.
UpdateOAuth2ClientRequest: The `UpdateOAuth2ClientRequest` schema from the server's OpenAPI document.
UpdateOrganizationRequest: The `UpdateOrganizationRequest` schema from the server's OpenAPI document.
UpdatePermissionRequest: The `UpdatePermissionRequest` schema from the server's OpenAPI document.
UpdateReactorRequest: The `UpdateReactorRequest` schema from the server's OpenAPI document.
UpdateResourceRequest: The `UpdateResourceRequest` schema from the server's OpenAPI document.
UpdateRole: The `UpdateRole` schema from the server's OpenAPI document.
UpdateScopeRequest: The `UpdateScopeRequest` schema from the server's OpenAPI document.
UpdateServiceAccount: The `UpdateServiceAccount` schema from the server's OpenAPI document.
UpdateTenant: Fields that can be updated on an existing tenant.
UpdateUserRequest: The `UpdateUserRequest` schema from the server's OpenAPI document.
UpdateWebhookRequest: The `UpdateWebhookRequest` schema from the server's OpenAPI document.
UserAttributeMap: Which directory attribute feeds each AXIAM user field.
UserResponse: Public-safe user representation (no password_hash, no mfa_secret).
WebauthnAttestationPolicy: Per-tenant WebAuthn attestation policy (D5). One row per tenant; an absent row means [`WebauthnAttestationPolicy::default`], which is today's behavior unchanged.
WebauthnPolicy: WebAuthn ceremony policy. One field today. It is a struct rather than a bare field on [`SecuritySettings`] so that the next WebAuthn control has an obvious home, and so the admin UI can group them. The *attestation* policy is deliberately not here: it lives in [`crate::models::webauthn_policy::WebauthnAttestationPolicy`], is tenant-only, and cannot join this model because AAGUID allow/block lists have no "more restrictive than" ordering to validate an override against. User verification does, so it can.
WebhookResponse: Webhook response — omits the shared secret.
NamespaceScope: The `{org_id}`/`{tenant_id}` a namespace handle substitutes into its routes (CONTRACT.md §27.4 rule 3).
NetworkApi: A tenant's network segments and the RADIUS reply profile each owns (RADIUS Live profile): a segment is a node of the reserved /network subtree of the resource tree (kind, VLAN, Filter-Id envelope, placement rank), and its profile is the typed `axiam-radius-reply/1` record a decision renders. Every write is conditional on the `version` the caller read and passes the server's write gate. The tenant's Session-Timeout cap is one more row of it (get_policy, replace_policy): lowering it is always allowed, raising it is allowed and audited. The decision route FreeRADIUS calls is not in this registry.
NotFoundError: `404 Not Found` on the §27 management surface — CONTRACT.md §27.4 rule 7.
NotificationRulesApi: Which events raise a notification, and to whom.
Oauth2ClientsApi: Registered OAuth2/OIDC clients -- the registration half of what §12, §21 and §26 then speak to.
OrganizationsApi: Organizations an SDK client may read and configure. Creation and deletion are outside the SDK boundary (§27.0).
Page: One page of a paginated §27 list response (CONTRACT.md §27.4 rule 4).
PageRequest: One page's worth of `?offset=`/`?limit=`/`?search=` for a paginated §27 list call (CONTRACT.md §27.4 rule 4).
PermissionsApi: Permissions -- an action on a resource, optionally narrowed by a scope.
PgpKeysApi: OpenPGP keys used for audit signing and encrypted data export.
PlatformApi: Deployment-level probes and FIDO metadata state. Unauthenticated where the server leaves them so.
PrivacyApi: GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller, never to another user.
ReactorsApi: Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK could previously reach.
ReadModifyWrite: The read-modify-write form CONTRACT.md §27.4 rule 5 recommends for `replace` updates: a read result turned back into the replacement body, every member carried over, so that changing one field and sending the body back preserves the rest instead of resetting every omitted member to its default.
ResourcesApi: The resource hierarchy role assignments cascade down.
RolesApi: Roles, their permission sets, and their assignment to users and groups.
SamlApi: A tenant's SAML 2.0 identity provider (CONTRACT §29): the registry of service providers, the import of an SP's metadata into a *draft* registration (never a write), and the lifecycle of the IdP signing credential. The protocol itself -- single sign-on, single logout, the IdP metadata document -- is browser and SP-to-IdP surface under /saml/v2/{tenant_id}, an SP's own SAML library speaks to it, and it is not in this registry.
ScimTargetsApi: A tenant's outbound SCIM targets (CONTRACT §31): the downstream SCIM 2.0 service providers AXIAM pushes the tenant's users and groups to, each with its delivery state. The credential AXIAM pushes with is write-only. Deleting a target does not deprovision anything downstream.
ScimTokensApi: Bearer tokens for the SCIM 2.0 provisioning endpoint.
ScopesApi: Sub-resource granularity, always addressed under their resource.
ServiceAccountsApi: Machine identities, their secrets, and the certificate a device-bound one authenticates with.
SettingsApi: Effective settings, and the organization/tenant layers they resolve from.
SsfApi: A tenant's Shared Signals Framework streams (CONTRACT §32): which receiver -- an OAuth2 client of the tenant -- receives which CAEP and RISC security events, as SETs pushed to its endpoint or polled. The receiver's own protocol (transmitter metadata, the SSF stream management API, polling) is not in this registry.
TenantsApi: Tenants within an organization -- the isolation boundary every other namespace is scoped to.
UsersApi: Users within the client's tenant, and the administrative side of their second factor and lockout state.
ValidationError: `400`/`422` on the §27 management surface — CONTRACT.md §27.4 rule 7.
WebauthnPolicyApi: Per-tenant attestation policy governing the §24 ceremonies, and the compliance report over it.
WebhooksApi: Outbound event notifications. Delivery signatures are verified with the §13 helper, which this namespace configures.
BearerChallengeError: The three RFC 6750 §3.1 error codes a `WWW-Authenticate: Bearer` challenge may name (CONTRACT.md §28.4) — the complete vocabulary; nothing else, not even a well-formed OAuth error code such as `invalid_grant`, is accepted by {@see Mcp::bearerChallenge()}.
Mcp: MCP resource-server helpers (CONTRACT.md §28, RFC 9728 + RFC 6750) — the ONE §28 implementation both {@see \Axiam\Sdk\Laravel\AxiamMiddleware} and {@see \Axiam\Sdk\Symfony\AxiamAuthSubscriber} are built on, mirroring how this SDK never duplicates a security-critical decision across its two framework bridges (D-02).
McpGuardOptions: Validates a §10 guard's CONTRACT.md §28.5 configuration and precomputes the challenge values it will emit, at guard-CONSTRUCTION time so that an invalid one is a startup failure rather than a surprise on the 401 path — the same discipline {@see \Axiam\Sdk\AxiamClient}'s own constructor applies to every other CONDITIONAL option.
ProtectedResourceMetadata: What {@see Mcp::protectedResourceMetadata()} returns: the RFC 9728 §2 document, the path it is served at, and the URL that path resolves to (CONTRACT.md §28.1).
AuthorizationRequest: The result of `oidcBegin` — everything the caller needs to start an authorization-code + PKCE login (CONTRACT.md §12.1).
CibaInitiateRequest: Arguments to {@see OidcClient::cibaInitiate()} — `CibaInitiateRequest` (CONTRACT.md §33.2).
CibaInitiateResponse: `CibaInitiateResponse` (CONTRACT.md §33.2) — what {@see OidcClient::cibaInitiate()} returns.
CibaRequestSigner: The key and algorithm for CIBA's signed authentication request (CONTRACT.md §33.2, CIBA Core §7.1.1). Both are the caller's: there is no default for either, and the SDK signs under exactly the algorithm given — the one the client registered as `backchannel_authentication_request_signing_alg`.
ClientRegistration: An RFC 7591 §3.2.1 / RFC 7592 §3 client information response — what {@see \Axiam\Sdk\AxiamClient::readClientRegistration()} and {@see \Axiam\Sdk\AxiamClient::updateClientRegistration()} return (CONTRACT.md §28.12.1).
DeviceAuthorization: The `DeviceAuthorizationResponse` — what the device shows its user, plus the `device_code` it polls with (CONTRACT.md §14.1).
ExchangedToken: The result of an RFC 8693 exchange (wire schema `TokenExchangeResponse`, CONTRACT.md §15.1).
FederationProvider: One sign-in button (wire schema `PublicFederationProvider`, CONTRACT.md §12.1, contract 1.38).
FederationProviderList: The result of `ssoProviders` (wire schema `PublicFederationProvidersResponse`, CONTRACT.md §12.1).
IdTokenValidator: ID-token claim validation — CONTRACT.md §12.4, OIDC Core §3.1.3.7.
IntrospectionResult: The RFC 7662 introspection result (wire schema `IntrospectionResponse`, CONTRACT.md §12.1). Only `$active` is guaranteed; the server omits the metadata fields for an inactive token.
MemoryOidcStateStore: In-memory reference implementation of {@see OidcStateStoreInterface} (CONTRACT.md §12.3 rule 1).
MtlsEndpointAliases: RFC 8705 §5 `mtls_endpoint_aliases` — the seven endpoints re-based on the host that performs the mutual-TLS handshake (wire schema `MtlsEndpointAliases`, contract 1.40; the seventh, CIBA's `backchannel_authentication_endpoint`, contract 1.58 — CONTRACT.md §21.3.1 as amended by §33).
OidcClient: The OIDC / SSO relying-party engine (CONTRACT.md §12) behind {@see \Axiam\Sdk\AxiamClient}'s nine public `oidc*`/`introspect`/`revoke`/`sso*` methods.
OidcConfiguration: The OIDC Discovery 1.0 metadata document served by `GET /.well-known/openid-configuration` (wire schema `OidcDiscoveryDocument`, CONTRACT.md §12.1).
OidcLoginFlow: Shared "Login with AXIAM" core (CONTRACT.md §12) — the ONE begin/complete + state-store + error-mapping path BOTH {@see \Axiam\Sdk\Laravel\OidcLoginController}/ {@see \Axiam\Sdk\Laravel\OidcCallbackController} and {@see \Axiam\Sdk\Symfony\OidcLoginController}/{@see \Axiam\Sdk\Symfony\OidcCallbackController} call, mirroring the TypeScript reference's `middleware/oidcLoginCore.ts` (the ONE §12 path, exactly as `AccessEnforcer` is the one §11 path shared by both framework bridges in this SDK).
OidcLoginOutcome: What a login/callback handler should do next — one shape per outcome kind. Framework controllers ({@see \Axiam\Sdk\Laravel\OidcLoginController}/`OidcCallbackController`, {@see \Axiam\Sdk\Symfony\OidcLoginController}/`OidcCallbackController`) translate this into their own framework's redirect/JSON response and add nothing of their own, so Laravel and Symfony cannot drift (mirrors the TypeScript reference's `OidcLoginOutcome` discriminated union).
OidcStateEntry: The tuple an {@see OidcStateStoreInterface} holds for one in-flight login.
OidcTokenSet: A token set returned by the OAuth2 token endpoint (wire schema `TokenResponse`), returned by `oidcExchange`, `oidcRefresh` and `loginClientCredentials` (CONTRACT.md §12.1).
Pkce: PKCE + CSPRNG primitives for the OIDC relying-party flow (CONTRACT.md §12.1 "`oidc_begin` inputs and construction", RFC 7636).
PushedAuthorizationRequest: The result of `AxiamClient::oidcPar()` (CONTRACT.md §26.1).
RequestedPermission: One `(resource, scopes)` pair a resource server requires (CONTRACT.md §20.1).
RequestingPartyToken: The result of the UMA ticket grant (CONTRACT.md §20.1).
ResourceSet: A UMA resource set — an AXIAM resource seen through the Protection API (CONTRACT.md §20.1).
RptPermission: One entry of an RPT's `permissions` claim (CONTRACT.md §20.1).
SsoCompleteResult: The result of `ssoComplete` (wire schema `SsoLoginSuccessResponse`, CONTRACT.md §12.1). Carries **no token material** — the session arrives as `Set-Cookie`, so the §4 cookie jar (shared by every `AxiamClient` Guzzle transport) is what actually captures it (§12.1 note 6).
SsoStartResult: The result of `ssoStart` (wire schema `OidcStartResponse`, CONTRACT.md §12.1).
SystemCibaClock: The real {@see CibaClock}: `microtime(true)` and `sleep()`.
UmaChallenge: A parsed `WWW-Authenticate: UMA` challenge (UMA 2.0 §3.2, CONTRACT.md §20.3).
VerifiedLogoutToken: What a verified back-channel logout token names (CONTRACT.md §12.7.3).
FfiOpaqueNative: The real FFI binding to `libaxiam_opaque_ffi`.
KsfParams: The key-stretching function and cost a `/start` response names (CONTRACT.md §23.4).
LoginExchange: One in-flight login (CONTRACT.md §23).
Opaque: Entry points into `libaxiam_opaque_ffi` (CONTRACT.md §23).
OpaqueEnrollment: The `opaque` object CONTRACT.md §23 defines: a registration record and the server-issued session handle that identifies the exchange it came from.
OpaqueExchange: One in-flight OPAQUE exchange, owning a native state handle.
OpaqueLibrary: Loads `libaxiam_opaque_ffi` once per process, memoizing failure as well as success.
OpaqueMode: The tenant's `opaque_mode`, as `login/start` reports it (CONTRACT.md §23.4 rule 7, §23.5).
RegistrationExchange: One in-flight enrolment (CONTRACT.md §23).
AmqpLibReactorDelivery: Adapts a `php-amqplib` {@see AMQPMessage} to {@see ReactorDelivery} (CONTRACT.md §22.1).
AmqpLibReactorTransport: The `php-amqplib` implementation of {@see ReactorTransport} (CONTRACT.md §22.1, §8b).
ReactorAnswer: What a reactor handler decided (CONTRACT.md §22.4, §22.10).
ReactorConfig: Identifies one reactor to {@see ReactorServer} (CONTRACT.md §22.1, §22.10, §22.12).
ReactorEvent: One hook firing, delivered to a reactor and **already verified** (CONTRACT.md §22.3).
ReactorEvents: The CONTRACT.md §22.5 event registry, §22.8's budget constants and §22.1's topology helpers.
ReactorEventSpec: One hookable event from the CONTRACT.md §22.5 registry: its wire name, what a reply may change, and what happens when the reactor does not answer.
ReactorHandlers: Declarative reactor handler binding — CONTRACT.md §22.14.
ReactorProtocol: The reactor wire protocol — CONTRACT.md §22.2, §22.3, §22.4.
ReactorRejection: A reactor delivery or handler answer this SDK refuses (CONTRACT.md §22.3, §22.4).
ReactorServer: The CONTRACT.md §22 reactor runtime — §22.10's `reactor_serve`, spelled {@see self::reactorServe()} in PHP by that subsection's per-language table.
ReactorTelemetryEvent: One reactor-runtime telemetry event (CONTRACT.md §19, §22.8).
AccessDecision: The full outcome of an access check, including the CONTRACT.md §11 rule 9 `reason_code`.
AuthMiddleware: `HandlerStack` middleware: injects `Authorization` (current access token) and `X-Tenant-ID` on EVERY outgoing request, `X-Axiam-Tenant` (CONTRACT.md §5.2 rule 1, contract 1.51) on every request while an acting tenant is set, and `X-CSRF-Token` (captured from a prior response, {@see Session::csrfToken()}) on state-changing requests (CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
AuthzRestClient: REST authorization transport (FND-04, CONTRACT.md §1): `checkAccess()`/`can()`/ `batchCheck()` over `POST /api/v1/authz/check[/batch]` — the ALWAYS-available authz path (D-03). Reuses the caller-supplied Guzzle client (the same instance {@see \Axiam\Sdk\Session} wires with {@see AuthMiddleware}/{@see RefreshMiddleware} on its `HandlerStack`), so `Authorization`/`X-Tenant-ID`/`X-CSRF-Token` header injection and the single-flight refresh-on-401 behavior (D-06) apply to authz calls exactly as they do to every other REST call — this class never re-implements any of that.
ReasonCode: The three `reason_code` values CONTRACT.md §11 rule 9 defines.
RefreshMiddleware: `HandlerStack` middleware: on a `401` response, triggers the session's single-flight refresh (CONTRACT.md §9, D-06, SC#2) and retries the ORIGINAL request exactly once via the inner `$handler` — never a loop. All concurrent 401-triggering requests on one {@see Session} share the SAME refresh `PromiseInterface` ({@see Session::refreshIfNeeded()}), so N concurrent expired-token requests still result in exactly one `/api/v1/auth/refresh` call.
Session: Per-`AxiamClient` session state (CONTRACT.md §3/§4/§5/§9): owns the shared Guzzle `CookieJar` (§4), captures/exposes the non-browser CSRF token (§3), and is the single-flight home for the shared refresh `Promise` (§9, D-06).
InMemoryReplayStore: The default {@see ReplayStore}: one process's memory, entries expiring after the window.
RefusedSet: One SET a poll returned that {@see SsfReceiver::verifySet()} refused.
SecurityEvent: A verified Security Event Token — {@see SsfReceiver::verifySet()}'s result (CONTRACT.md §32.7).
SetErr: One RFC 8936 `setErrs` entry: the RFC 8935 §2.4 `err` code and an optional description.
SetVerificationError: A Security Event Token refused by {@see SsfReceiver::verifySet()} (CONTRACT.md §32.7) — an {@see AuthError}, as §32.7 requires, carrying the step that failed as a typed {@see SetFailureReason}. {@see AuthError::getReason()} returns the same code as a string.
SsfEventTypes: The six event types AXIAM transmits and the two SSF stream events (CONTRACT.md §32.6), as named constants. Event types are open: a SET of another type still verifies, and {@see SecurityEvent::$eventType} carries it verbatim.
SsfPollOptions: Arguments to {@see SsfReceiver::poll()} (RFC 8936). Every member is passed through exactly as given; an unset (`null`) one is not sent, so a poll with no options sends `{}`.
SsfPollResult: What {@see SsfReceiver::poll()} returns: the verified SETs and the refused ones, apart — and the ones it could not judge.
SsfReceiver: The SSF receiver helper — CONTRACT.md §32.7 (contract 1.56).
SupportedVersions: The range of PHP versions this SDK is built and tested against.
AxiamAccessAttributeListener: Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an `EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension point Symfony's own `#[IsGranted]` attribute is enforced from (`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
AxiamAuthSubscriber: Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to `kernel.request`, extracts the bearer/cookie token, verifies it via {@see AxiamClient::verifyLocally()} — the no-fallback seam mandated by §10.1 rule 8 — and populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on success. Short-circuits the request with a standardized 401 JSON error body on any failure (missing token, invalid signature, expired token). Never duplicates JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is made by {@see AxiamClient}.
AxiamBundle: The Symfony bundle bootstrap. This class intentionally carries no container extension of its own — `AxiamAuthSubscriber` (`kernel.event_subscriber`), `AxiamVoter` (`security.voter`), and `AxiamAccessAttributeListener` (`kernel.event_subscriber`, CONTRACT.md §11 declarative authorization helpers) are all wired via the consuming application's OWN `config/services.yaml` (manual registration, Pitfall 5), exactly like the `config/bundles.php` entry that registers this bundle itself. Registering this class is what tells Symfony's kernel the AXIAM SDK bundle is present; it performs no additional auto-wiring beyond that on its own.
AxiamVoter: Symfony authorization voter (D-02, CONTRACT.md §1/§10): a one-line delegation to {@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins, default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker. This class never caches a decision beyond the token's own TTL and never implements a client-side deny-override (project RBAC constraint, CLAUDE.md).
OidcCallbackController: Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): validates the IdP callback, consumes the single-use stored state, exchanges the authorization code, and redirects (or replies `200 JSON`) on success. See {@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
OidcLoginController: Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): builds the authorization request, parks its `state`/`nonce`/`code_verifier` in the configured {@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the browser to the IdP. All security-critical logic lives in {@see OidcLoginFlow} — this class only translates its {@see OidcLoginOutcome} into an HTTP response.
ProtectedResourceMetadataController: Symfony's realization of CONTRACT.md §28.3's `serve_protected_resource_metadata`: an invokable controller that serves the RFC 9728 protected-resource metadata document, `200 application/json`, at the path {@see ProtectedResourceMetadata} derived from the `resource` it was built from.
UmaChallenger: A configured `WWW-Authenticate: UMA` challenge emitter (CONTRACT.md §20.3, emit half).
WebauthnChallenge: A started ceremony: the server's options plus the token binding a response to them (CONTRACT.md §24.1).
WebauthnCredential: A credential the user just enrolled — the `201` body of `register/finish` (CONTRACT.md §24.1).
WebauthnLoginResult: A completed authentication ceremony (CONTRACT.md §24.3).
WebauthnWorkspace: The workspace a usernameless ceremony runs in (CONTRACT.md §24.1).
AxiamWebhooks: Verifies the `X-Axiam-Signature` HMAC-SHA256 header AXIAM attaches to every webhook delivery (CONTRACT.md §13, T-145). Mirrors the server's signer (`crates/axiam-api-rest/src/webhook.rs`'s `compute_signature_v2`): the MAC covers the ASCII string `<t>.<raw_body>`, keyed with the webhook secret's raw UTF-8 bytes.
WebhookEvent: A webhook delivery whose `X-Axiam-Signature` has already been verified by {@see AxiamWebhooks::verify()} (CONTRACT.md §13). {@see self::$eventType} and {@see self::$deliveryId} are a best-effort parse of the verified body's `event`/`id` JSON fields — a non-JSON or differently-shaped body still verifies successfully (the MAC only covers the raw bytes, not their JSON shape), it simply leaves those two properties `null`. Callers that need the delivery id for at-least-once dedup (§13.3 rule 7) should prefer the `X-Axiam-Delivery` header over relying solely on this parse.
WebhookVerificationException: Thrown by {@see AxiamWebhooks::verify()} when a webhook delivery fails signature verification (CONTRACT.md §13.3 rule 6: "fail closed and quiet").

Traits

TokenBindingSupport: Shared machinery behind {@see TokenValidation::status()}/`verifyPossession()` and {@see TokenIntrospection::status()}/`verifyPossession()` (CONTRACT.md §10.1 rule 9, §10.3, contract 1.51).

Enums

TokenStatus: What a `validateToken`/`introspectToken` result means for the presenter — the three cases CONTRACT.md §10.1 rule 9 and §10.3 distinguish (contract 1.51).
JsonNull: An explicit JSON `null`, as distinct from an ABSENT member (CONTRACT.md §27.4 rule 5, "null is not absent").
ChangeAction: What a plan intends to do to one declared entity (CONTRACT.md §27.6).
ManifestKind: The entity kinds a §27.6 manifest can declare.
ActorType: The `ActorType` enumeration from the server's OpenAPI document.
AttestationMode: What attestation conveyance a registration ceremony requests, and whether the policy is enforced at all. `None` is the default and reproduces today's behavior byte-for-byte: `evaluate` allows every registration unconditionally, with no MDS lookup (D8 step 1).
AttributeSource: Where an attribute's value comes from. Every variant has a real source today; a variant with none (a telephone number the OIDC `phone` scope gates behind its own consent, say) is deliberately absent rather than mapped to an empty value.
AuditOutcome: The `AuditOutcome` enumeration from the server's OpenAPI document.
AuthnRequestParamsMode: Whether this client's authorization requests may carry OpenID Connect's authentication-request parameters, or whether they are ignored (X7.1). The bundle this governs is `prompt`, `max_age`, `acr_values`, `claims`, `id_token_hint`, `login_hint`, `display`, `ui_locales` and `claims_locales`. It is **one** field rather than nine booleans for the same reason [`ClientProfile`] is one field rather than a dozen: a client that honours `max_age` but ignores `prompt=none` is not "mostly conformant", it is a client a relying party cannot reason about. [`Ignore`](Self::Ignore) is the serde default and is exactly what AXIAM has always done — unknown authorization-request parameters are dropped by the query deserialiser and never reach a decision. Every row written before schema v54 therefore decodes to the behaviour it already had.
CertificateStatus: Status of a certificate in its lifecycle.
CertificateType: The purpose for which a certificate was issued.
CertificationLevel: FIDO certification level, as recorded in an MDS `statusReports` entry's `FIDO_CERTIFIED*` status. Variant order is significant: `derive(PartialOrd, Ord)` gives `L1 < L1Plus < L2 < L2Plus < L3 < L3Plus`, which `WebauthnAttestationPolicy::evaluate` (D8 step 9) relies on directly for the `min_certification` boundary check (`entry_level >= policy_min`).
CibaDeliveryMode: How a CIBA client learns that a request has been decided (CIBA Core §5). `push` is deliberately absent: AXIAM does not offer it, and the FAPI-CIBA profile forbids it — push delivers the tokens themselves to a client endpoint, which makes the notification endpoint a token sink.
CibaRequestSigningAlg: The JWS algorithm a CIBA client signs its authentication requests with (CIBA Core §4 `backchannel_authentication_request_signing_alg`, §7.1.1). Exactly the three algorithms AXIAM verifies on any client-signed JWT (`axiam_oauth2::jose::PERMITTED_ALGORITHMS`): FAPI 2.0 §5.3.1.1's list. A registration naming anything else — `RS256`, `HS256`, `none` — is refused rather than stored, so no row can hold an algorithm the verifier would not honour (D-61).
ClientAuthMethod: How a client proves its identity at the token endpoint (RFC 8705 §2, OIDC Core §9 naming).
ClientProfile: Which security posture a client is registered under (X5.1). This is the FAPI "one switch".
DeprovisionPolicy: What happens downstream to a user who falls out of scope or is no longer active. Erasure always deletes, whatever this says.
DirectoryKind: Which kind of directory server a configuration points at. It drives **defaults only**: the external-id attribute, the group-membership strategy and the change attribute the sync job reads. Every one of them is still an explicit, editable field of the configuration (or, for the strategy and change attribute, derived from this value at the point of use); nothing about the kind changes what is *allowed*.
FailurePolicy: What the server does when an interceptor does not produce a usable reply — timeout, transport failure, bad signature, stale nonce, or a patch the allow-list rejects.
KeyAlgorithm: The type of key algorithm used for a certificate.
ManagedBy: Who created a client registration (D5, T21.4). The discriminator that separates a registration an administrator made from one that arrived over an open endpoint. Three things read it and each would otherwise have to infer provenance from something that is not provenance: * `axiam_oauth2::fapi` refuses a FAPI profile on anything but [`Admin`](Self::Admin) (I5) — a client nobody vetted cannot be financial-grade; * the authorization endpoint forces a consent hop for every other value (D4) — an unrelated party gets a question put to the end user, whatever scopes it asked for; * the T21.4 sweeper deletes only [`Dcr`](Self::Dcr) rows, so an administrator's client is never swept however long it sits unused. [`Admin`](Self::Admin) is the serde default and therefore what every row written before T21.4 decodes to, which is the truth: they were all created through `POST /oauth2-clients` by somebody holding `oauth2_clients:create`.
MfaMethodType: Type of MFA method.
NameIdFormat: How the assertion's `NameID` is formed (per service provider).
NetworkSegmentKind: What a segment is for.
NotificationEventType: Events that can trigger an admin notification.
PermissionEffect: Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one checkable property — **adding a deny rule can never widen access, and can never be undone by adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X denied?" unanswerable without enumerating every other rule that might out-specify it.
PgpKeyAlgorithm: Key algorithm for OpenPGP keys.
PgpKeyPurpose: The purpose of an OpenPGP key.
PgpKeyStatus: Status of an OpenPGP key.
RadiusServiceType: `Service-Type` (RFC 2865 §5.6). Option B accepts only `framed_user`; the administrative values are refused with a 400.
RadiusTerminationAction: `Termination-Action` (RFC 2865 §5.29).
ReactorMode: How a reactor participates in an event.
SamlBinding: A SAML 2.0 protocol binding (SAML Bindings §3). The response binding for Web Browser SSO is always [`Self::HttpPost`], but the enum keeps both because SP metadata carries both, and an `slo_url` may use either.
SamlIdpCredentialStatus: Where a signing credential is in its life. An open set: an SDK decodes a value it does not know without failing.
SamlIdpSlot: Which slot a credential is issued into.
ScimTokenStatus: Why a token is or is not currently usable — for display only. The authentication path never surfaces this distinction on the wire.
SettingsScope: Whether a settings row belongs to an organization or a tenant.
SsfDeliveryMethod: How SETs reach the receiver.
SsfEventType: The six event types AXIAM transmits (G-5). Stored and sent as their event-type URIs; [`Self::ALL`] is the canonical order every list AXIAM returns is sorted in.
SsfStatusActor: Who set a stream's current status. A status an administrator set to anything but `enabled` cannot be changed by the receiver (D-51).
SsfStreamStatus: A stream's SSF status (SSF 1.0 §8.1.2), with AXIAM's meaning pinned by D-51.
SsfSubjectFormat: Which RFC 9493 subject identifier names the user in the SETs of a stream (D-46).
TenantKind: What a tenant *is*, as distinct from what state it is in. Reserved rather than inferred: an organization has exactly one tenant of kind [`Self::Organization`], enforced by a unique index rather than by convention. Deriving it from a magic slug or from "the oldest tenant" would make the organization scope something an operator could rename or delete by accident, and it is the scope the super-admin lives in.
TenantStatus: Lifecycle status of a tenant. A `Suspended` tenant remains stored and its data isolated, but is treated as administratively disabled. New tenants are `Active` by default.
UnknownAaguidAction: What to do with an AAGUID that has no MDS entry (i.e. FIDO Alliance has no metadata for it — not necessarily malicious, MDS coverage is incomplete for some legitimate authenticators).
UserNameSource: Which AXIAM attribute becomes the downstream `userName`. The mapping is a fixed attribute set, not a mapping language (D-57).
UserStatus: The `UserStatus` enumeration from the server's OpenAPI document.
CibaDeliveryMode: How a CIBA client receives the outcome, as it registered (CONTRACT.md §33.3 rule 1). There is no push mode: AXIAM does not offer it.
CibaSigningAlg: The algorithms a signed CIBA authentication request may use (CONTRACT.md §33.2) — the client's registered `backchannel_authentication_request_signing_alg`.
SetFailureReason: Why {@see SsfReceiver::verifySet()} refused a Security Event Token — the bracketed reason codes of CONTRACT.md §32.7, one per verification step that can fail.
WebauthnFailure: A ceremony failure a caller can say something useful about (CONTRACT.md §24.6b rule 5).

AXIAM PHP SDK

Application

Table of Contents

Interfaces

Classes

Traits

Enums

Search results