Application
Table of Contents
Interfaces
- JtiStore
- CONTRACT.md §21.7.2 check 8 — single-use `jti` tracking for DPoP proofs.
- MdsRefreshOutcomeVariant
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- ProviderConfigVariant
- Provider-specific connection details.
- OidcStateStoreInterface
- Optional server-side store for in-flight `oidcBegin` state (CONTRACT.md §12.3 rule 1).
- OpaqueNativeInterface
- The `libaxiam_opaque_ffi` C ABI, expressed in PHP terms.
- ReactorDelivery
- One message off the reactor's own queue (CONTRACT.md §22.1).
- ReactorTransport
- One live broker session for a reactor: a consumer on the reactor's own queue,
and a way to publish a reply back to the queue the delivery named
(CONTRACT.md §22.1, §8b).
Classes
- AccessEnforcer
- The single CONTRACT.md §11 ("Declarative Authorization Helpers") enforcement
implementation, shared by BOTH framework bridges
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener} and
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) so the `#[RequireAuth]` /
`#[RequireAccess]` / `#[RequireRole]` semantics can never drift between the two
integrations. Neither bridge re-implements resource resolution, subject propagation,
or the error-mapping table below — both call into this class exclusively.
- MfaEnrollment
- A TOTP factor offered but not yet active (CONTRACT.md §25.1).
- PasswordResetConfirmation
- Arguments to `AxiamClient::confirmPasswordReset()` (CONTRACT.md §25.1).
- PasswordResetContext
- The OPAQUE policy for the account a reset token belongs to (CONTRACT.md §25.1).
- PasswordResetRequest
- Arguments to `AxiamClient::requestPasswordReset()` (CONTRACT.md §25.1).
- AmqpDropMessage
- Poison-message sentinel. Application handlers throw this to signal that a
message is unprocessable and must NOT be requeued (e.g. a permanently
malformed or unsupported event) — distinct from a transient failure, which
should be requeued for retry.
- Consumer
- php-amqplib blocking consume loop with HMAC verify-before-handler
(CONTRACT.md §8, D-04).
- Hmac
- HMAC-SHA256 verify-before-handler primitive for inbound AMQP messages
(CONTRACT.md §8).
- ReplayGuard
- NEW-4 (CONTRACT.md §8 "v2 — Replay Protection", hard cutover) validation
gates, checked ONLY AFTER a delivery's HMAC signature has already
verified (see Hmac::verify / Consumer::verifyAndDispatch).
- ManagedGroup
- Declares that a group must exist, as part of a CONTRACT.md §27.6 manifest.
- ManagedPermission
- Declares that a permission must exist, as part of a CONTRACT.md §27.6 manifest.
- ManagedResource
- Declares that a resource must exist, as part of a CONTRACT.md §27.6 manifest.
- ManagedRole
- Declares that a role must exist, as part of a CONTRACT.md §27.6 manifest.
- OnReactorEvent
- Declares that a method handles one reactor hook event (CONTRACT.md §22.14,
canonical `reactor_handlers`).
- RequireAccess
- Declarative per-endpoint authorization requirement (CONTRACT.md §11, canonical
`require_access(action, resource[, scope])`). Placing this attribute on a controller
method or class does not itself perform any check — it is metadata read by the
framework-specific enforcement listener
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which resolves the target resource
and delegates the actual authorization decision to
{@see \Axiam\Sdk\AccessEnforcer::enforceAccess()}.
- RequireAuth
- Declarative "endpoint requires an authenticated AXIAM identity" marker (CONTRACT.md
§11, canonical `require_auth`). Pure sugar over the CONTRACT.md §10 authentication
guard for frameworks (Laravel, Symfony) where that guard is applied per-route rather
than globally: placing this attribute on a controller method or class does not itself
perform any verification — it is read by the framework-specific enforcement listener
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) which delegates the actual check to
{@see \Axiam\Sdk\AccessEnforcer::enforceAuth()}.
- RequireRole
- Declarative local role check (CONTRACT.md §11, canonical `require_role(role...)`,
MAY-level helper). Placing this attribute on a controller method or class does not
itself perform any check — it is metadata read by the framework-specific enforcement
listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which delegates to
{@see \Axiam\Sdk\AccessEnforcer::enforceRole()}.
- DpopRequest
- What {@see DpopVerifier::verifyProof()} needs to know about the current request.
- DpopVerifier
- DPoP proof verification — CONTRACT.md §21.7.2 (RFC 9449), contract 1.16.
- InMemoryJtiStore
- A {@see JtiStore} for a single PHP process.
- JwksVerifier
- Local EdDSA/Ed25519 JWKS verification (CONTRACT.md D-08).
- LoginResult
- Result of `AxiamClient::login()` (CONTRACT.md §1, D-09).
- PresentedProofs
- What the caller proved about **this** connection and **this** request, for
{@see JwksVerifier::verifyTokenBinding()}.
- RefreshGuard
- Shared-promise clear-on-both-paths helper (CONTRACT.md §9, D-06).
- UserInfo
- Result of `AxiamClient::getUserInfo()` (CONTRACT.md §1.1, contract 1.3).
- AuthzDispatcher
- Transparent REST/gRPC authz transport selection (CONTRACT.md §1, D-03, SC#3).
- AxiamClient
- The AXIAM PHP SDK's public REST entry point (CONTRACT.md §1–§9, SC#1).
- AuthError
- Authentication failure: wrong credentials, expired session, MFA failure, or a 401
on refresh (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so REST and
gRPC transports cannot drift on the error taxonomy.
- AuthzError
- Authorization failure: the caller is authenticated but lacks permission for the
requested operation (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so
REST and gRPC transports cannot drift on the error taxonomy.
- AxiamException
- Base exception for all AXIAM SDK errors (CONTRACT.md §2, D-10).
- ConfigClampedEvent
- Emitted at construction, once per caller-supplied setting the SDK clamped
(CONTRACT.md §19.1, §19.2 rule 6).
- DecisionMemo
- Client-side decision memo — CONTRACT.md §17.
- ErrorMapper
- Central status→error mapper (CONTRACT.md §2, D-10). {@see self::fromStatus()} is the
single translation point from an HTTP status code to a typed {@see AxiamException}
subtype — no other class in the SDK is permitted to hand-roll this branching:
401 → {@see AuthError}; 403/409 → {@see AuthzError}; everything else
(400/408/429/5xx/transport) → {@see NetworkError}.
- NetworkError
- Transport-level failure: connection refused, timeout, TLS error, DNS failure, or a
server-side 5xx (CONTRACT.md §2).
- OAuthProtocolError
- An RFC 6749 protocol error returned by an `/oauth2/*` endpoint as an
`OAuth2ErrorResponse` body — `invalid_grant`, `invalid_client`, `invalid_request`,
`unsupported_grant_type`, … (CONTRACT.md §2, §12.3 rule 3).
- RefreshEvent
- Emitted around a §9 single-flight refresh (CONTRACT.md §19).
- RequestEndEvent
- Emitted after a call completes, success or failure (CONTRACT.md §19).
- RequestStartEvent
- Emitted before an outbound call leaves the SDK (CONTRACT.md §19).
- RetryEvent
- Emitted before each §16 retry wait (CONTRACT.md §19).
- RetryPolicy
- Bounded read-only retry policy — CONTRACT.md §16.
- Sensitive
- Wraps a token-carrying value so it can never be accidentally exposed via
`__toString()`, `var_export()`/`print_r()`, or JSON serialization
(CONTRACT.md §7, D-11).
- TelemetryDispatcher
- Internal §19 dispatcher. A null hook is the overwhelmingly common case and
costs one null check per request.
- TelemetryEvent
- A telemetry event (CONTRACT.md §19).
- AuthzGrpcClient
- gRPC authorization transport (CONTRACT.md §1/§6/§9, D-03/D-06/D-12).
- UserInfoGrpcClient
- gRPC userinfo transport (CONTRACT.md §1.1/§5/§6/§9, contract 1.3) — the low-latency
gRPC counterpart of the server's REST `GET /oauth2/userinfo` endpoint. This is the
hand-written service-client sibling of {@see AuthzGrpcClient}: it mirrors that class's
channel/metadata/status-mapping machinery exactly, differing only in the single RPC it
exposes (`GetUserInfo` instead of `CheckAccess`/`BatchCheckAccess`).
- AxiamAccessMiddleware
- Laravel CONTRACT.md §11 declarative-authorization enforcement middleware, registered
under the `axiam.access` alias (D-02). Supports BOTH developer-experience styles the
plan calls for, from the SAME class, delegating every actual decision to the shared
{@see AccessEnforcer} (never re-implementing resource resolution, subject
propagation, or the error-mapping table itself):
- AxiamGate
- Laravel authorization gate (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker.
- AxiamMiddleware
- Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie
token, verifies it via {@see AxiamClient::verifyLocally()} — the no-fallback seam
mandated by §10.1 rule 8 — and populates the `axiam_user` request attribute with
`user_id`/`tenant_id`/`roles` on success. Returns a standardized 401 JSON error body on
any failure (missing token, invalid signature, expired token). Never duplicates
JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is made
by {@see AxiamClient}.
- AxiamServiceProvider
- Auto-discovered Laravel bridge entry point (D-01): listed under `composer.json`
`extra.laravel.providers`, so a Laravel consumer gets this provider registered
with ZERO manual wiring beyond `composer require axiam/axiam-sdk` (true
zero-config auto-discovery, unlike the Symfony bridge which has no equivalent
mechanism without a published Flex recipe).
- OidcCallbackController
- Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): an invokable
controller that validates the IdP callback, consumes the single-use stored
state, exchanges the authorization code, and redirects (or replies `200 JSON`)
on success. All security-critical logic lives in {@see OidcLoginFlow} — see
{@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
- OidcLoginController
- Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): an invokable
controller that builds the authorization request, parks its
`state`/`nonce`/`code_verifier` in the configured
{@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the browser to the
IdP. All security-critical logic lives in {@see OidcLoginFlow} — this class only
translates its {@see OidcLoginOutcome} into an HTTP response, exactly as
{@see AxiamMiddleware} never duplicates {@see \Axiam\Sdk\AxiamClient}'s own
verification logic.
- AuditApi
- Append-only audit log, read-only by construction.
- CaCertificatesApi
- Organization CAs and the per-tenant signing CAs chained beneath them.
- CertificatesApi
- End-entity X.509 certificates -- the ones issued to users, services and IoT devices.
- ConflictError
- `409 Conflict` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- EmailConfigApi
- Transactional-mail transport, configurable at organization level and overridable per tenant.
- FederationApi
- Upstream IdP configuration and the per-user links it produces.
- FieldError
- One field-level complaint from a `400`/`422` validation body (CONTRACT.md §27.4
rule 7).
- GroupsApi
- Named collections of users. Roles assigned to a group are inherited by every member.
- ManagementApi
- The CONTRACT.md §27 management surface: 147 operations across 24 namespaces.
- ManagementErrorMapper
- The §27 status→error mapper (CONTRACT.md §27.4 rule 7).
- ManagementSupport
- Base class for the 24 generated namespace handles (CONTRACT.md §27.2).
- ManagementTransport
- The single wire path every one of the 147 §27 management operations goes through
(CONTRACT.md §27.8).
- ApplyReport
- What {@see ManifestApi::apply()} actually did — including, when it stopped early, what
it had already done.
- ManagementManifest
- A declarative description of the state a tenant must be in (CONTRACT.md §27.6).
- ManagementPlan
- What {@see ManifestApi::plan()} produced: the ordered changes an apply would make.
- ManifestApi
- Plans and applies a §27.6 manifest (CONTRACT.md §27.6, §27.7).
- ManifestAttributeReader
- Builds a {@see ManagementManifest} from the `#[Managed*]` attributes on a class
(CONTRACT.md §27.6).
- ManifestBuilder
- Fluent construction of a {@see ManagementManifest} (CONTRACT.md §27.6).
- ManifestEntity
- One entity a §27.6 manifest declares must exist.
- ManifestException
- A manifest was rejected before any request was sent (CONTRACT.md §27.6).
- ManifestValidation
- Refuses an incoherent manifest BEFORE the first wire call (CONTRACT.md §27.6).
- PlannedChange
- One entry in a {@see ManagementPlan}: what would happen to one entity, and why.
- AddMemberRequest
- The `AddMemberRequest` schema from the server's OpenAPI document.
- AddServiceAccountMemberRequest
- The `AddServiceAccountMemberRequest` schema from the server's OpenAPI document.
- ApiProviderConfig
- API-based provider configuration (SendGrid, Postmark, Resend, Brevo). `api_key` follows the
same write-only + omit-preserving contract as [`SmtpConfig::password`] (D-01/D-02).
- AssignRoleToGroupRequest
- The `AssignRoleToGroupRequest` schema from the server's OpenAPI document.
- AssignRoleToServiceAccountRequest
- The `AssignRoleToServiceAccountRequest` schema from the server's OpenAPI document.
- AssignRoleToUserRequest
- The `AssignRoleToUserRequest` schema from the server's OpenAPI document.
- AuditLogEntry
- The `AuditLogEntry` schema from the server's OpenAPI document.
- BindCertificate
- Request to bind a certificate to a service account.
- CaCertificate
- A CA (Certificate Authority) certificate at the organization level. CA certificates are the
root of trust for all tenant certificates within the organization. Private keys for signing
CAs are encrypted with AES-256-GCM and stored separately; non-signing CAs only store the
public certificate.
- Certificate
- A tenant-level certificate for users, services, or IoT devices. Certificates are signed by
the organization's CA. The private key is returned once on generation and never stored by
AXIAM.
- CertificatePolicy
- Certificate issuance constraints.
- ComplianceReportEntry
- One credential's compliance outcome (D9).
- CreateCaCertificateRequest
- The `CreateCaCertificateRequest` schema from the server's OpenAPI document.
- CreateCertificateRequest
- The `CreateCertificateRequest` schema from the server's OpenAPI document.
- CreateFederationConfigRequest
- The `CreateFederationConfigRequest` schema from the server's OpenAPI document.
- CreateGroupRequest
- The `CreateGroupRequest` schema from the server's OpenAPI document.
- CreateIntermediateCaRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas`.
- CreateNotificationRuleRequest
- The `CreateNotificationRuleRequest` schema from the server's OpenAPI document.
- CreateOAuth2ClientRequest
- The `CreateOAuth2ClientRequest` schema from the server's OpenAPI document.
- CreatePermissionRequest
- The `CreatePermissionRequest` schema from the server's OpenAPI document.
- CreatePgpKeyRequest
- The `CreatePgpKeyRequest` schema from the server's OpenAPI document.
- CreateReactorRequest
- The `CreateReactorRequest` schema from the server's OpenAPI document.
- CreateResourceRequest
- The `CreateResourceRequest` schema from the server's OpenAPI document.
- CreateRoleRequest
- The `CreateRoleRequest` schema from the server's OpenAPI document.
- CreateScimTokenRequest
- The `CreateScimTokenRequest` schema from the server's OpenAPI document.
- CreateScimTokenResponse
- The one-time reveal. Same shape as service-account creation: the secret is returned once and
only its hash is kept.
- CreateScopeRequest
- The `CreateScopeRequest` schema from the server's OpenAPI document.
- CreateServiceAccountRequest
- The `CreateServiceAccountRequest` schema from the server's OpenAPI document.
- CreateTenantRequest
- Request body for tenant creation (organization_id comes from the URL path).
- CreateUserRequest
- The `CreateUserRequest` schema from the server's OpenAPI document.
- CreateWebhookRequest
- The `CreateWebhookRequest` schema from the server's OpenAPI document.
- EmailConfig
- Fully resolved email configuration (all fields present).
- EmailConfigOverride
- Partial tenant overrides for email configuration. `None` = inherit from org baseline.
- EmailTestResult
- What a test send did.
- EmailVerificationPolicy
- Email verification requirements.
- EncryptedExport
- Result of encrypting data with a PGP public key.
- EncryptRequest
- Request body for encrypting data.
- FederationConfigResponse
- Federation config response -- omits client_secret.
- FederationLinkResponse
- The `FederationLinkResponse` schema from the server's OpenAPI document.
- GeneratedCaCertificate
- Response returned when a CA certificate is generated. Includes the private key PEM, which is
returned **once** and never stored or retrievable again — when the custodian produced one at
all. Under `vault_pki` custody the key was born inside Vault and there is nothing to return,
which is the point of that custodian rather than a shortcoming of this response.
- GeneratedCertificate
- Response returned when a tenant certificate is generated. Includes the private key PEM,
returned **once** and never stored.
- GeneratedPgpKey
- Response returned when a PGP key is generated.
- GrantedScope
- A scope named by a grant, resolved to something a human can read.
- GrantPermissionRequest
- The `GrantPermissionRequest` schema from the server's OpenAPI document.
- Group
- A group of users that can access resources based on their roles and permissions. Groups
simplify role management by allowing roles to be assigned to a group rather than individual
users.
- HealthResponse
- The `HealthResponse` schema from the server's OpenAPI document.
- ImportCaCertificateRequest
- Body of `POST /api/v1/organizations/{org_id}/ca-certificates/import`. Deliberately carries
no subject, validity window or key algorithm: all three are read out of the certificate
itself. A caller that could name them separately could name a subject the certificate does
not have, and AXIAM would enforce the claim while every relying party read the certificate.
- LockoutPolicy
- Account lockout rules.
- MdsRefreshOutcome
- `POST /api/v1/mds/refresh` response — the outcome of one ingestion attempt (mirrors
`axiam_db::mds_ingest::MdsIngestOutcome`).
- MdsRefreshOutcomeInitial
- The `initial` arm of {@see MdsRefreshOutcome} (`outcome: "initial"`).
- MdsRefreshOutcomeNoOpRefresh
- The `no_op_refresh` arm of {@see MdsRefreshOutcome} (`outcome: "no_op_refresh"`).
- MdsRefreshOutcomeReplaced
- The `replaced` arm of {@see MdsRefreshOutcome} (`outcome: "replaced"`).
- MdsRefreshOutcomeRollbackRejected
- The `rollback_rejected` arm of {@see MdsRefreshOutcome} (`outcome: "rollback_rejected"`).
- MdsStatusResponse
- `GET /api/v1/mds/status` response. `no`/`next_update`/`last_refreshed_at` are `None` and
`stale` is `false` when MDS has never been ingested — a meaningful, valid answer ("nothing
ingested yet"), not an error.
- MfaMethodResponse
- The `MfaMethodResponse` schema from the server's OpenAPI document.
- MfaPolicy
- Multi-factor authentication policy.
- MigrateCustodyResponse
- What a custody migration did.
- ModelDecode
- Reads a REQUIRED field out of a decoded response body.
- MtlsTrustAnchorResponse
- The acknowledgement, which is mostly about the restart.
- NotificationPolicy
- Admin notification preferences.
- NotificationRuleResponse
- Notification rule response.
- OAuth2ClientCreatedResponse
- Response for client creation -- includes the one-time plaintext secret.
- OAuth2ClientResponse
- OAuth2 client response -- omits client_secret_hash.
- OidcAuthorizeRequest
- The `OidcAuthorizeRequest` schema from the server's OpenAPI document.
- OidcAuthorizeResponse
- The `OidcAuthorizeResponse` schema from the server's OpenAPI document.
- OidcCallbackRequest
- The `OidcCallbackRequest` schema from the server's OpenAPI document.
- OidcCallbackResponse
- The `OidcCallbackResponse` schema from the server's OpenAPI document.
- OpaqueEnrollment
- The client-supplied half of an OPAQUE enrolment, as it appears inside registration /
change-password / reset-completion / bootstrap request bodies. There is no standalone
`register/finish` endpoint, deliberately. A record can only be created at a moment when the
plaintext password legitimately exists on the client, and every one of those moments is
already an endpoint that takes a password. A free-standing finish would be an endpoint whose
only job is to attach a credential to an account, which is a thing worth not having. Kept
separate from [`CreateOpaqueCredential`] because the tenant, the user and the credential
identifier are all decided by the server — a client that could name them could enrol a
record against somebody else's account.
- OpaquePolicy
- Secure Remote Password policy. `suite` and `ksf` are the parameters a *new* registration
record is enrolled with. They deliberately do not apply retroactively: an existing record is
only valid under the suite and KSF it was created with, so tightening these takes effect as
users next set a password rather than invalidating everybody at once.
- Organization
- An organization groups multiple tenants under a single administrative entity. Organizations
represent companies, departments, or business units. CA certificates are registered at the
organization level, enabling a hierarchical trust model across all tenants.
- PasswordPolicy
- Password complexity and history requirements.
- Permission
- The `Permission` schema from the server's OpenAPI document.
- PgpKey
- An OpenPGP key stored by AXIAM.
- PolicyResponse
- `GET` response: the stored policy plus the unknown-AAGUID action it currently *resolves to*.
- PrivacyPolicy
- Data-retention rules that apply after a subject asks to be erased.
- ProviderConfig
- Provider-specific connection details.
- ProviderConfigBrevo
- The `brevo` arm of {@see ProviderConfig} (`kind: "brevo"`).
- ProviderConfigPostmark
- The `postmark` arm of {@see ProviderConfig} (`kind: "postmark"`).
- ProviderConfigResend
- The `resend` arm of {@see ProviderConfig} (`kind: "resend"`).
- ProviderConfigSendGrid
- The `send_grid` arm of {@see ProviderConfig} (`kind: "send_grid"`).
- ProviderConfigSmtp
- The `smtp` arm of {@see ProviderConfig} (`kind: "smtp"`).
- ReactorEventDescriptor
- One hookable event, as the registry describes it.
- ReactorResponse
- The `ReactorResponse` schema from the server's OpenAPI document.
- ReadyResponse
- The `ReadyResponse` schema from the server's OpenAPI document.
- ResolvedPermissionGrant
- A permission grant with its scopes resolved. A superset of [`PermissionGrant`]: `scope_ids`
is still present and still authoritative, so a client written before `scopes` existed is
unaffected.
- Resource
- The `Resource` schema from the server's OpenAPI document.
- RetryPolicy
- Retry policy for failed webhook deliveries.
- Role
- The `Role` schema from the server's OpenAPI document.
- RoleAssignment
- A role together with its assignment context (the resource it is scoped to).
- RoleGroupAssignment
- A group together with the resource scope of its assignment of this role.
- RoleServiceAccountAssignment
- A service account together with the resource scope of its assignment.
- RoleUserAssignment
- A user together with the resource scope of their assignment of this role.
- RotateSecretResponse
- Response for secret rotation.
- ScimTokenResponse
- Metadata only. The handle is never in a list response — it exists in plaintext exactly once,
in [`CreateScimTokenResponse`].
- Scope
- The `Scope` schema from the server's OpenAPI document.
- SecuritySettings
- Fully resolved security settings (all fields present).
- ServiceAccountCreatedResponse
- Response for service account creation — includes the one-time plaintext secret.
- ServiceAccountResponse
- Public-safe service account representation.
- SetMtlsTrustAnchor
- Body for `PUT .../ca-certificates/{id}/mtls-trust-anchor`.
- SetOrgEmailConfig
- Input for setting organization-level email config.
- SetOrgSettings
- Input for setting organization-level security settings.
- SignAuditBatchRequest
- Request body for signing an audit batch.
- SignedAuditBatch
- A signed batch of audit log entries.
- SignIntermediateCsrRequest
- Body of `POST .../tenants/{tenant_id}/signing-cas/sign-csr`. Deliberately carries no key
algorithm: it is the CSR's, read out of the request, because a caller who could state it
separately could state one the key does not have.
- SmtpConfig
- SMTP-specific configuration. `password` is write-only (D-01): `#[serde(skip_serializing)]`
means it is never emitted in a GET/serialized response. On the write path (D-02),
`#[serde(default)]` lets a caller omit the field entirely (deserializing to `""`); an empty
string is the sentinel for "no new secret supplied — preserve whatever is already stored"
(see `SurrealEmailConfigRepository:: set_org_config`). A non-empty value is a real secret to
encrypt+replace.
- Tenant
- A tenant is an isolated context within an organization. Each tenant has its own set of
users, roles, permissions, resources, certificates, and configuration. Tenants can represent
environments (dev/staging/prod) or separate business contexts.
- TenantSettingsOverride
- Partial tenant overrides. `None` = inherit from org baseline.
- TokenExchangeTrustRequest
- X4 trust for exchanging this provider's tokens (RFC 8693, external issuer). Mirrors
[`TokenExchangeTrust`] on the wire rather than reusing it directly so the API surface can
carry its own defaults: an admin PUTting a partial block gets the documented default for
anything they omitted, instead of a deserialization error listing fields they have never
heard of.
- TokenExchangeTrustResponse
- X4 trust as returned. Same shape as the request; nothing here is secret — an operator
reading a provider needs to see exactly what it trusts.
- TokenPolicy
- Token lifetime configuration.
- UpdateFederationConfigRequest
- The `UpdateFederationConfigRequest` schema from the server's OpenAPI document.
- UpdateGroup
- The `UpdateGroup` schema from the server's OpenAPI document.
- UpdateNotificationRuleRequest
- The `UpdateNotificationRuleRequest` schema from the server's OpenAPI document.
- UpdateOAuth2ClientRequest
- The `UpdateOAuth2ClientRequest` schema from the server's OpenAPI document.
- UpdateOrganizationRequest
- The `UpdateOrganizationRequest` schema from the server's OpenAPI document.
- UpdatePermissionRequest
- The `UpdatePermissionRequest` schema from the server's OpenAPI document.
- UpdateReactorRequest
- The `UpdateReactorRequest` schema from the server's OpenAPI document.
- UpdateResourceRequest
- The `UpdateResourceRequest` schema from the server's OpenAPI document.
- UpdateRole
- The `UpdateRole` schema from the server's OpenAPI document.
- UpdateScopeRequest
- The `UpdateScopeRequest` schema from the server's OpenAPI document.
- UpdateServiceAccount
- The `UpdateServiceAccount` schema from the server's OpenAPI document.
- UpdateTenant
- Fields that can be updated on an existing tenant.
- UpdateUserRequest
- The `UpdateUserRequest` schema from the server's OpenAPI document.
- UpdateWebhookRequest
- The `UpdateWebhookRequest` schema from the server's OpenAPI document.
- UserResponse
- Public-safe user representation (no password_hash, no mfa_secret).
- WebauthnAttestationPolicy
- Per-tenant WebAuthn attestation policy (D5). One row per tenant; an absent row means
[`WebauthnAttestationPolicy::default`], which is today's behavior unchanged.
- WebauthnPolicy
- WebAuthn ceremony policy. One field today. It is a struct rather than a bare field on
[`SecuritySettings`] so that the next WebAuthn control has an obvious home, and so the admin
UI can group them. The *attestation* policy is deliberately not here: it lives in
[`crate::models::webauthn_policy::WebauthnAttestationPolicy`], is tenant-only, and cannot
join this model because AAGUID allow/block lists have no "more restrictive than" ordering to
validate an override against. User verification does, so it can.
- WebhookResponse
- Webhook response — omits the shared secret.
- NamespaceScope
- The `{org_id}`/`{tenant_id}` a namespace handle substitutes into its routes
(CONTRACT.md §27.4 rule 3).
- NotFoundError
- `404 Not Found` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- NotificationRulesApi
- Which events raise a notification, and to whom.
- Oauth2ClientsApi
- Registered OAuth2/OIDC clients -- the registration half of what §12, §21 and §26 then speak
to.
- OrganizationsApi
- Organizations an SDK client may read and configure. Creation and deletion are outside the
SDK boundary (§27.0).
- Page
- One page of a paginated §27 list response (CONTRACT.md §27.4 rule 4).
- PageRequest
- One page's worth of `?offset=`/`?limit=`/`?search=` for a paginated §27 list call
(CONTRACT.md §27.4 rule 4).
- PermissionsApi
- Permissions -- an action on a resource, optionally narrowed by a scope.
- PgpKeysApi
- OpenPGP keys used for audit signing and encrypted data export.
- PlatformApi
- Deployment-level probes and FIDO metadata state. Unauthenticated where the server leaves
them so.
- PrivacyApi
- GDPR self-service: the authenticated account's own export and erasure. Scoped to the caller,
never to another user.
- ReactorsApi
- Registration of §22 AMQP extension actors -- the admin surface §22.9 describes, which no SDK
could previously reach.
- ResourcesApi
- The resource hierarchy role assignments cascade down.
- RolesApi
- Roles, their permission sets, and their assignment to users and groups.
- ScimTokensApi
- Bearer tokens for the SCIM 2.0 provisioning endpoint.
- ScopesApi
- Sub-resource granularity, always addressed under their resource.
- ServiceAccountsApi
- Machine identities, their secrets, and the certificate a device-bound one authenticates
with.
- SettingsApi
- Effective settings, and the organization/tenant layers they resolve from.
- TenantsApi
- Tenants within an organization -- the isolation boundary every other namespace is scoped to.
- UsersApi
- Users within the client's tenant, and the administrative side of their second factor and
lockout state.
- ValidationError
- `400`/`422` on the §27 management surface — CONTRACT.md §27.4 rule 7.
- WebauthnPolicyApi
- Per-tenant attestation policy governing the §24 ceremonies, and the compliance report over
it.
- WebhooksApi
- Outbound event notifications. Delivery signatures are verified with the §13 helper, which
this namespace configures.
- AuthorizationRequest
- The result of `oidcBegin` — everything the caller needs to start an
authorization-code + PKCE login (CONTRACT.md §12.1).
- DeviceAuthorization
- The `DeviceAuthorizationResponse` — what the device shows its user, plus the
`device_code` it polls with (CONTRACT.md §14.1).
- ExchangedToken
- The result of an RFC 8693 exchange (wire schema `TokenExchangeResponse`,
CONTRACT.md §15.1).
- FederationProvider
- One sign-in button (wire schema `PublicFederationProvider`, CONTRACT.md §12.1,
contract 1.38).
- FederationProviderList
- The result of `ssoProviders` (wire schema `PublicFederationProvidersResponse`,
CONTRACT.md §12.1).
- IdTokenValidator
- ID-token claim validation — CONTRACT.md §12.4, OIDC Core §3.1.3.7.
- IntrospectionResult
- The RFC 7662 introspection result (wire schema `IntrospectionResponse`, CONTRACT.md
§12.1). Only `$active` is guaranteed; the server omits the metadata fields for an
inactive token.
- MemoryOidcStateStore
- In-memory reference implementation of {@see OidcStateStoreInterface} (CONTRACT.md
§12.3 rule 1).
- OidcClient
- The OIDC / SSO relying-party engine (CONTRACT.md §12) behind {@see
\Axiam\Sdk\AxiamClient}'s nine public `oidc*`/`introspect`/`revoke`/`sso*` methods.
- OidcConfiguration
- The OIDC Discovery 1.0 metadata document served by
`GET /.well-known/openid-configuration` (wire schema `OidcDiscoveryDocument`,
CONTRACT.md §12.1). Every field is required by the server's schema.
- OidcLoginFlow
- Shared "Login with AXIAM" core (CONTRACT.md §12) — the ONE begin/complete +
state-store + error-mapping path BOTH {@see \Axiam\Sdk\Laravel\OidcLoginController}/
{@see \Axiam\Sdk\Laravel\OidcCallbackController} and
{@see \Axiam\Sdk\Symfony\OidcLoginController}/{@see \Axiam\Sdk\Symfony\OidcCallbackController}
call, mirroring the TypeScript reference's `middleware/oidcLoginCore.ts` (the ONE §12
path, exactly as `AccessEnforcer` is the one §11 path shared by both framework
bridges in this SDK).
- OidcLoginOutcome
- What a login/callback handler should do next — one shape per outcome kind. Framework
controllers ({@see \Axiam\Sdk\Laravel\OidcLoginController}/`OidcCallbackController`,
{@see \Axiam\Sdk\Symfony\OidcLoginController}/`OidcCallbackController`) translate this
into their own framework's redirect/JSON response and add nothing of their own, so
Laravel and Symfony cannot drift (mirrors the TypeScript reference's
`OidcLoginOutcome` discriminated union).
- OidcStateEntry
- The tuple an {@see OidcStateStoreInterface} holds for one in-flight login.
- OidcTokenSet
- A token set returned by the OAuth2 token endpoint (wire schema `TokenResponse`),
returned by `oidcExchange`, `oidcRefresh` and `loginClientCredentials` (CONTRACT.md
§12.1).
- Pkce
- PKCE + CSPRNG primitives for the OIDC relying-party flow (CONTRACT.md §12.1
"`oidc_begin` inputs and construction", RFC 7636).
- PushedAuthorizationRequest
- The result of `AxiamClient::oidcPar()` (CONTRACT.md §26.1).
- RequestedPermission
- One `(resource, scopes)` pair a resource server requires (CONTRACT.md §20.1).
- RequestingPartyToken
- The result of the UMA ticket grant (CONTRACT.md §20.1).
- ResourceSet
- A UMA resource set — an AXIAM resource seen through the Protection API
(CONTRACT.md §20.1).
- RptPermission
- One entry of an RPT's `permissions` claim (CONTRACT.md §20.1).
- SsoCompleteResult
- The result of `ssoComplete` (wire schema `SsoLoginSuccessResponse`, CONTRACT.md
§12.1). Carries **no token material** — the session arrives as `Set-Cookie`, so the §4
cookie jar (shared by every `AxiamClient` Guzzle transport) is what actually captures
it (§12.1 note 6).
- SsoStartResult
- The result of `ssoStart` (wire schema `OidcStartResponse`, CONTRACT.md §12.1).
- UmaChallenge
- A parsed `WWW-Authenticate: UMA` challenge (UMA 2.0 §3.2, CONTRACT.md §20.3).
- VerifiedLogoutToken
- What a verified back-channel logout token names (CONTRACT.md §12.7.3).
- FfiOpaqueNative
- The real FFI binding to `libaxiam_opaque_ffi`.
- KsfParams
- The key-stretching function and cost a `/start` response names (CONTRACT.md §23.4).
- LoginExchange
- One in-flight login (CONTRACT.md §23).
- Opaque
- Entry points into `libaxiam_opaque_ffi` (CONTRACT.md §23).
- OpaqueEnrollment
- The `opaque` object CONTRACT.md §23 defines: a registration record and the server-issued
session handle that identifies the exchange it came from.
- OpaqueExchange
- One in-flight OPAQUE exchange, owning a native state handle.
- OpaqueLibrary
- Loads `libaxiam_opaque_ffi` once per process, memoizing failure as well as success.
- OpaqueMode
- The tenant's `opaque_mode`, as `login/start` reports it (CONTRACT.md §23.4 rule 7, §23.5).
- RegistrationExchange
- One in-flight enrolment (CONTRACT.md §23).
- AmqpLibReactorDelivery
- Adapts a `php-amqplib` {@see AMQPMessage} to {@see ReactorDelivery}
(CONTRACT.md §22.1).
- AmqpLibReactorTransport
- The `php-amqplib` implementation of {@see ReactorTransport} (CONTRACT.md §22.1,
§8b).
- ReactorAnswer
- What a reactor handler decided (CONTRACT.md §22.4, §22.10).
- ReactorConfig
- Identifies one reactor to {@see ReactorServer} (CONTRACT.md §22.1, §22.10,
§22.12).
- ReactorEvent
- One hook firing, delivered to a reactor and **already verified**
(CONTRACT.md §22.3).
- ReactorEvents
- The CONTRACT.md §22.5 event registry, §22.8's budget constants and §22.1's
topology helpers.
- ReactorEventSpec
- One hookable event from the CONTRACT.md §22.5 registry: its wire name, what a
reply may change, and what happens when the reactor does not answer.
- ReactorHandlers
- Declarative reactor handler binding — CONTRACT.md §22.14.
- ReactorProtocol
- The reactor wire protocol — CONTRACT.md §22.2, §22.3, §22.4.
- ReactorRejection
- A reactor delivery or handler answer this SDK refuses (CONTRACT.md §22.3,
§22.4).
- ReactorServer
- The CONTRACT.md §22 reactor runtime — §22.10's `reactor_serve`, spelled
{@see self::reactorServe()} in PHP by that subsection's per-language table.
- ReactorTelemetryEvent
- One reactor-runtime telemetry event (CONTRACT.md §19, §22.8).
- AccessDecision
- The full outcome of an access check, including the CONTRACT.md §11 rule 9
`reason_code`.
- AuthMiddleware
- `HandlerStack` middleware: injects `Authorization` (current access token) and
`X-Tenant-ID` on EVERY outgoing request, and `X-CSRF-Token` (captured from a prior
response, {@see Session::csrfToken()}) on state-changing requests
(CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
- AuthzRestClient
- REST authorization transport (FND-04, CONTRACT.md §1): `checkAccess()`/`can()`/
`batchCheck()` over `POST /api/v1/authz/check[/batch]` — the ALWAYS-available authz
path (D-03). Reuses the caller-supplied Guzzle client (the same instance
{@see \Axiam\Sdk\Session} wires with {@see AuthMiddleware}/{@see RefreshMiddleware} on
its `HandlerStack`), so `Authorization`/`X-Tenant-ID`/`X-CSRF-Token` header injection
and the single-flight refresh-on-401 behavior (D-06) apply to authz calls exactly as
they do to every other REST call — this class never re-implements any of that.
- ReasonCode
- The three `reason_code` values CONTRACT.md §11 rule 9 defines.
- RefreshMiddleware
- `HandlerStack` middleware: on a `401` response, triggers the session's single-flight
refresh (CONTRACT.md §9, D-06, SC#2) and retries the ORIGINAL request exactly once
via the inner `$handler` — never a loop. All concurrent 401-triggering requests on
one {@see Session} share the SAME refresh `PromiseInterface`
({@see Session::refreshIfNeeded()}), so N concurrent expired-token requests still
result in exactly one `/api/v1/auth/refresh` call.
- Session
- Per-`AxiamClient` session state (CONTRACT.md §3/§4/§5/§9): owns the shared Guzzle
`CookieJar` (§4), captures/exposes the non-browser CSRF token (§3), and is the
single-flight home for the shared refresh `Promise` (§9, D-06).
- SupportedVersions
- The range of PHP versions this SDK is built and tested against.
- AxiamAccessAttributeListener
- Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an
`EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension
point Symfony's own `#[IsGranted]` attribute is enforced from
(`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
- AxiamAuthSubscriber
- Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to
`kernel.request`, extracts the bearer/cookie token, verifies it via
{@see AxiamClient::verifyLocally()} — the no-fallback seam mandated by §10.1 rule 8
— and populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles`
on success. Short-circuits the request with a standardized 401 JSON error body on any
failure (missing token, invalid signature, expired token). Never duplicates
JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is
made by {@see AxiamClient}.
- AxiamBundle
- The Symfony bundle bootstrap. This class intentionally carries no container
extension of its own — `AxiamAuthSubscriber` (`kernel.event_subscriber`),
`AxiamVoter` (`security.voter`), and `AxiamAccessAttributeListener`
(`kernel.event_subscriber`, CONTRACT.md §11 declarative authorization helpers)
are all wired via the consuming application's OWN `config/services.yaml` (manual
registration, Pitfall 5), exactly like the `config/bundles.php` entry that
registers this bundle itself. Registering this class is what tells Symfony's
kernel the AXIAM SDK bundle is present; it performs no additional auto-wiring
beyond that on its own.
- AxiamVoter
- Symfony authorization voter (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative
decision-maker. This class never caches a decision beyond the token's own TTL and
never implements a client-side deny-override (project RBAC constraint,
CLAUDE.md).
- OidcCallbackController
- Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): validates the
IdP callback, consumes the single-use stored state, exchanges the authorization
code, and redirects (or replies `200 JSON`) on success. See
{@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
- OidcLoginController
- Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): builds the
authorization request, parks its `state`/`nonce`/`code_verifier` in the
configured {@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the
browser to the IdP. All security-critical logic lives in {@see OidcLoginFlow} —
this class only translates its {@see OidcLoginOutcome} into an HTTP response.
- UmaChallenger
- A configured `WWW-Authenticate: UMA` challenge emitter (CONTRACT.md §20.3, emit half).
- WebauthnChallenge
- A started ceremony: the server's options plus the token binding a response to them
(CONTRACT.md §24.1).
- WebauthnCredential
- A credential the user just enrolled — the `201` body of `register/finish`
(CONTRACT.md §24.1).
- WebauthnLoginResult
- A completed authentication ceremony (CONTRACT.md §24.3).
- WebauthnWorkspace
- The workspace a usernameless ceremony runs in (CONTRACT.md §24.1).
- AxiamWebhooks
- Verifies the `X-Axiam-Signature` HMAC-SHA256 header AXIAM attaches to every webhook
delivery (CONTRACT.md §13, T-145). Mirrors the server's signer
(`crates/axiam-api-rest/src/webhook.rs`'s `compute_signature_v2`): the MAC covers the
ASCII string `<t>.<raw_body>`, keyed with the webhook secret's raw UTF-8 bytes.
- WebhookEvent
- A webhook delivery whose `X-Axiam-Signature` has already been verified by
{@see AxiamWebhooks::verify()} (CONTRACT.md §13). {@see self::$eventType} and
{@see self::$deliveryId} are a best-effort parse of the verified body's `event`/`id`
JSON fields — a non-JSON or differently-shaped body still verifies successfully (the
MAC only covers the raw bytes, not their JSON shape), it simply leaves those two
properties `null`. Callers that need the delivery id for at-least-once dedup (§13.3
rule 7) should prefer the `X-Axiam-Delivery` header over relying solely on this parse.
- WebhookVerificationException
- Thrown by {@see AxiamWebhooks::verify()} when a webhook delivery fails signature
verification (CONTRACT.md §13.3 rule 6: "fail closed and quiet").
Enums
- ChangeAction
- What a plan intends to do to one declared entity (CONTRACT.md §27.6).
- ManifestKind
- The entity kinds a §27.6 manifest can declare.
- ActorType
- The `ActorType` enumeration from the server's OpenAPI document.
- AttestationMode
- What attestation conveyance a registration ceremony requests, and whether the policy is
enforced at all. `None` is the default and reproduces today's behavior byte-for-byte:
`evaluate` allows every registration unconditionally, with no MDS lookup (D8 step 1).
- AuditOutcome
- The `AuditOutcome` enumeration from the server's OpenAPI document.
- CertificateStatus
- Status of a certificate in its lifecycle.
- CertificateType
- The purpose for which a certificate was issued.
- CertificationLevel
- FIDO certification level, as recorded in an MDS `statusReports` entry's `FIDO_CERTIFIED*`
status. Variant order is significant: `derive(PartialOrd, Ord)` gives `L1 < L1Plus < L2 <
L2Plus < L3 < L3Plus`, which `WebauthnAttestationPolicy::evaluate` (D8 step 9) relies on
directly for the `min_certification` boundary check (`entry_level >= policy_min`).
- ClientAuthMethod
- How a client proves its identity at the token endpoint (RFC 8705 §2, OIDC Core §9 naming).
- ClientProfile
- Which security posture a client is registered under (X5.1). This is the FAPI "one switch".
- FailurePolicy
- What the server does when an interceptor does not produce a usable reply — timeout,
transport failure, bad signature, stale nonce, or a patch the allow-list rejects.
- KeyAlgorithm
- The type of key algorithm used for a certificate.
- MfaMethodType
- Type of MFA method.
- NotificationEventType
- Events that can trigger an admin notification.
- PermissionEffect
- Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default
deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant
refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny
wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in
full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one
checkable property — **adding a deny rule can never widen access, and can never be undone by
adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X
denied?" unanswerable without enumerating every other rule that might out-specify it.
- PgpKeyAlgorithm
- Key algorithm for OpenPGP keys.
- PgpKeyPurpose
- The purpose of an OpenPGP key.
- PgpKeyStatus
- Status of an OpenPGP key.
- ReactorMode
- How a reactor participates in an event.
- ScimTokenStatus
- Why a token is or is not currently usable — for display only. The authentication path never
surfaces this distinction on the wire.
- SettingsScope
- Whether a settings row belongs to an organization or a tenant.
- TenantKind
- What a tenant *is*, as distinct from what state it is in. Reserved rather than inferred: an
organization has exactly one tenant of kind [`Self::Organization`], enforced by a unique
index rather than by convention. Deriving it from a magic slug or from "the oldest tenant"
would make the organization scope something an operator could rename or delete by accident,
and it is the scope the super-admin lives in.
- TenantStatus
- Lifecycle status of a tenant. A `Suspended` tenant remains stored and its data isolated, but
is treated as administratively disabled. New tenants are `Active` by default.
- UnknownAaguidAction
- What to do with an AAGUID that has no MDS entry (i.e. FIDO Alliance has no metadata for it —
not necessarily malicious, MDS coverage is incomplete for some legitimate authenticators).
- UserStatus
- The `UserStatus` enumeration from the server's OpenAPI document.
- WebauthnFailure
- A ceremony failure a caller can say something useful about (CONTRACT.md §24.6b rule 5).