API V3 Documentation – ACM

Endpoints

POST /API/V3/ACM/ApiToken/:tokenId/Unauthorize

Removes a previously authorized API token

HTTP syntax

POST /API/V3/ACM/ApiToken/:tokenId/Unauthorize?userId=...

JavaScript syntax

Pqf.acm.apiTokenUnauthorize(tokenId, userId) // returns Number - the return code (HTTP 2xx code) of the call

// Overloads for optional parameters
Pqf.acm.apiTokenUnauthorize(tokenId) // returns Number - the return code (HTTP 2xx code) of the call

Required permission

The usage of the optional parameter userId requires the permission 6792463473795FBCBFF0FB61EB7D28F2.

Parameters

Name	Type	Description	Required	Assertion	Required permission
tokenId	UUID	The ID (not the key) of the API token	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
userId	UUID	The user ID if not token of logged in user		matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)	6792463473795FBCBFF0FB61EB7D28F2

POST /API/V3/ACM/ApiToken/Create

API V3 authentication Step 1: Get new API token if no valid key present

HTTP syntax

POST /API/V3/ACM/ApiToken/Create?tenantAlias=...
-> application/json : ApiClientInfo
<- application/json : ApiTokenWithAuthUrl

Parameters

Name	Type	Description	Required	Assertion
tenantAlias	string	The alias of the tenant
requestJson	ApiClientInfo	JSON object of type ApiClientInfo	✔️

Result

This endpoint returns the following data: ApiTokenWithAuthUrl

GET /API/V3/ACM/ApiToken/Info

Gets the application info of an API token in use

HTTP syntax

GET /API/V3/ACM/ApiToken/Info
<- application/json : ApiClientInfo

Hint: This endpoint is available only in public API access.

Result

This endpoint returns the following data: ApiClientInfo

PUT /API/V3/ACM/ApiToken/Info

Updates the application info of an API token in use

HTTP syntax

PUT /API/V3/ACM/ApiToken/Info
-> application/json : ApiClientInfo

Hint: This endpoint is available only in public API access.

Parameters

Name	Type	Description	Required	Assertion
requestJson	ApiClientInfo	JSON object of type ApiClientInfo	✔️

GET /API/V3/ACM/AuthorizedApiToken/:tokenId

Returns an API token authorized by current (or specified) user

HTTP syntax

GET /API/V3/ACM/AuthorizedApiToken/:tokenId?userId=...
<- application/json : ApiTokenLog

JavaScript syntax

Pqf.acm.getAuthorizedApiToken(tokenId, userId) // returns ApiTokenLog

// Overloads for optional parameters
Pqf.acm.getAuthorizedApiToken(tokenId) // returns ApiTokenLog

Required permission

The usage of the optional parameter userId requires the permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion	Required permission
tokenId	UUID	The ID (not the key) of the API token	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
userId	UUID	The user ID if not token of logged in user		matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)	E8B12C24CCF05980BAF3348BE3A0D5B3

Result

This endpoint returns the following data: ApiTokenLog

GET /API/V3/ACM/AuthorizedApiTokens

Returns API tokens authorized by current (or specified) user

HTTP syntax

GET /API/V3/ACM/AuthorizedApiTokens?userId=...
<- application/json

JavaScript syntax

Pqf.acm.getAuthorizedApiTokens(userId) // returns ApiTokenLog[]

// Overloads for optional parameters
Pqf.acm.getAuthorizedApiTokens() // returns ApiTokenLog[]

Required permission

The usage of the optional parameter userId requires the permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion	Required permission
userId	UUID	The user ID if not token of logged in user		matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)	E8B12C24CCF05980BAF3348BE3A0D5B3

Result

This endpoint returns the following data: array of ApiTokenLog

GET /API/V3/ACM/Confidentiality/:objectType/:objectId

Determine whether object is confidential

HTTP syntax

GET /API/V3/ACM/Confidentiality/:objectType/:objectId
<- application/json : Confidentiality

JavaScript syntax

Pqf.acm.getConfidentiality(objectType, objectId) // returns Confidentiality

Required permission

Requires permission IDENTIFY on object of type specified in parameter objectType and ID specified in parameter objectId.

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	The object's type	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The object's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: Confidentiality

PUT /API/V3/ACM/Confidentiality/:objectType/:objectId

Sets the confidentiality level of an object

HTTP syntax

PUT /API/V3/ACM/Confidentiality/:objectType/:objectId
-> application/json : Confidentiality

JavaScript syntax

Pqf.acm.putConfidentiality(objectType, objectId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required permission

Requires permission 0F1CCCEAA24645C4BEE944F3E4B6B31E.

Requires permission UPDATE on object of type specified in parameter objectType and ID specified in parameter objectId.

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	The object's type	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The object's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
requestJson	Confidentiality	JSON object of type Confidentiality	✔️

GET /API/V3/ACM/CurrentUser

Returns the user currently logged in (HTTP code 401 indicates that no user is logged in)

HTTP syntax

GET /API/V3/ACM/CurrentUser
<- application/json : User

JavaScript syntax

Pqf.acm.getCurrentUser() // returns User

Result

This endpoint returns the following data: User

GET /API/V3/ACM/CurrentUser/Authorization/:objectType/:objectId

Returns the current user's authorizations for a transition or an action on a given object

HTTP syntax

GET /API/V3/ACM/CurrentUser/Authorization/:objectType/:objectId?action=...&transition=...
<- application/json : PF.Authorization

JavaScript syntax

Pqf.acm.getAuthorizationByObj(objectType, objectId, action, transition) // returns PF.Authorization

// Overloads for optional parameters
Pqf.acm.getAuthorizationByObj(objectType, objectId, action) // returns PF.Authorization
Pqf.acm.getAuthorizationByObj(objectType, objectId) // returns PF.Authorization

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	The object's type	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The object's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
action	string	The action to be performed (specify either action or transition)
transition	UUID	The transition to be performed (specify either action or transition)		matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: PF.Authorization

GET /API/V3/ACM/CurrentUser/Authorization/:objectType/:objectId/Create/:createObjectType

Returns the current user's authorization for creating a sub object on a given object

HTTP syntax

GET /API/V3/ACM/CurrentUser/Authorization/:objectType/:objectId/Create/:createObjectType
<- application/json : PF.Authorization

JavaScript syntax

Pqf.acm.getCreateAuthorizationByObj(objectType, objectId, createObjectType) // returns PF.Authorization

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	The object's type	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The object's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
createObjectType	UUID	The object type to create	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)

Result

This endpoint returns the following data: PF.Authorization

GET /API/V3/ACM/CurrentUser/Authorization/:permissionId

Returns the current user's authorization for a given permission

HTTP syntax

GET /API/V3/ACM/CurrentUser/Authorization/:permissionId
<- application/json : UserAuthorization

JavaScript syntax

Pqf.acm.getAuthorizationByPerm(permissionId) // returns UserAuthorization

Parameters

Name	Type	Description	Required	Assertion
permissionId	UUID	The permission ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: UserAuthorization

GET /API/V3/ACM/CurrentUser/Authorizations

Returns all authorizations of the current user

HTTP syntax

GET /API/V3/ACM/CurrentUser/Authorizations
<- application/json

JavaScript syntax

Pqf.acm.getCurrentUserAuthorizations() // returns UserAuthorization[]

Result

This endpoint returns the following data: array of UserAuthorization

GET /API/V3/ACM/CurrentUser/Authorizations/:objectType/:objectId

Returns all of the current user's authorizations for actions and transitions on a given object

HTTP syntax

GET /API/V3/ACM/CurrentUser/Authorizations/:objectType/:objectId
<- application/json

JavaScript syntax

Pqf.acm.getAuthorizationsByObj(objectType, objectId) // returns PF.Authorization[]

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	The object's type	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The object's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: array of PF.Authorization

GET /API/V3/ACM/CurrentUser/Certificate

Requests a user certificate for usage with other PQFORCE components

HTTP syntax

GET /API/V3/ACM/CurrentUser/Certificate
<- application/json : UserCertificate

JavaScript syntax

Pqf.acm.getCurrentUserCertificate() // returns UserCertificate

Result

This endpoint returns the following data: UserCertificate

GET /API/V3/ACM/CurrentUser/Certificate/Binary

Requests a user certificate for usage with other PQFORCE components as binary data

HTTP syntax

GET /API/V3/ACM/CurrentUser/Certificate/Binary
<- application/octet-stream

JavaScript syntax

Pqf.acm.getCurrentUserCertificateBinary() // returns Object

Result

This endpoint returns the following data: binary

GET /API/V3/ACM/CurrentUser/Preferences

Returns the current user preferences, not specified fields are transmitted as null or filled with default / current value depending on optional parameter

HTTP syntax

GET /API/V3/ACM/CurrentUser/Preferences?allowUnspecified=...
<- application/json : UserPreferences

JavaScript syntax

Pqf.acm.getCurrentUserPreferences(allowUnspecified) // returns UserPreferences

// Overloads for optional parameters
Pqf.acm.getCurrentUserPreferences() // returns UserPreferences

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
allowUnspecified	boolean	return not specified values as null, if set			false

Result

This endpoint returns the following data: UserPreferences

PUT /API/V3/ACM/CurrentUser/Preferences

Stores the current user preferences, defaults, if none set

HTTP syntax

PUT /API/V3/ACM/CurrentUser/Preferences
-> application/json : UserPreferences

JavaScript syntax

Pqf.acm.putCurrentUserPreferences(requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Parameters

Name	Type	Description	Required	Assertion
requestJson	UserPreferences	JSON object of type UserPreferences	✔️

GET /API/V3/ACM/FirstFactorAuthorities

Returns all first factor authorities

HTTP syntax

GET /API/V3/ACM/FirstFactorAuthorities?lang=...&timezone=...
<- application/json

JavaScript syntax

Pqf.acm.getFirstFactorAuthorities(lang, timezone) // returns FirstFactorAuthority[]

// Overloads for optional parameters
Pqf.acm.getFirstFactorAuthorities(lang) // returns FirstFactorAuthority[]
Pqf.acm.getFirstFactorAuthorities() // returns FirstFactorAuthority[]

Parameters

Name	Type	Description	Required	Assertion
lang	string	The language for communication (will be included into login URL)		matches '[a-zA-Z]{2}(?:-[a-zA-Z]+)*' (The value, if present, must be a language tag such as "de" or "en-GB".)
timezone	string	The user's timezone (will be included into login URL)		matches '(Z\|UTC\|GMT\|UT\|(UTC\|GMT\|UT)?[+-](2[0-3]\|[01]?[0-9])(:[0-5][0-9]){0,2}\|[A-Za-z]+/[A-Za-z_]+(/[A-Za-z_]+)?)' (The value, if present, must be a time zone: "Z", "UTC", a UTC offset such as "+02:00", or a region such as "Europe/Zurich".)

Result

This endpoint returns the following data: array of FirstFactorAuthority

GET /API/V3/ACM/FirstFactorAuthority/:authorityId

Returns a specific first factor authority

HTTP syntax

GET /API/V3/ACM/FirstFactorAuthority/:authorityId?lang=...&timezone=...
<- application/json : FirstFactorAuthority

JavaScript syntax

Pqf.acm.getFirstFactorAuthority(authorityId, lang, timezone) // returns FirstFactorAuthority

// Overloads for optional parameters
Pqf.acm.getFirstFactorAuthority(authorityId, lang) // returns FirstFactorAuthority
Pqf.acm.getFirstFactorAuthority(authorityId) // returns FirstFactorAuthority

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	the ID of the authority	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
lang	string	The language for communication (will be included into login URL)		matches '[a-zA-Z]{2}(?:-[a-zA-Z]+)*' (The value, if present, must be a language tag such as "de" or "en-GB".)
timezone	string	The user's timezone (will be included into login URL)		matches '(Z\|UTC\|GMT\|UT\|(UTC\|GMT\|UT)?[+-](2[0-3]\|[01]?[0-9])(:[0-5][0-9]){0,2}\|[A-Za-z]+/[A-Za-z_]+(/[A-Za-z_]+)?)' (The value, if present, must be a time zone: "Z", "UTC", a UTC offset such as "+02:00", or a region such as "Europe/Zurich".)

Result

This endpoint returns the following data: FirstFactorAuthority

GET /API/V3/ACM/FirstFactorAuthority/:authorityId/Users

Returns the users of a specific first factor authority

HTTP syntax

GET /API/V3/ACM/FirstFactorAuthority/:authorityId/Users?sort=...
<- application/json

JavaScript syntax

Pqf.acm.getFirstFactorAuthorityUsers(authorityId, sort) // returns PF.Reference[]

// Overloads for optional parameters
Pqf.acm.getFirstFactorAuthorityUsers(authorityId) // returns PF.Reference[]

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	the ID of the authority	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
sort	array of string	Array which defines ordering. Syntax of an element: propertyname, propertyname:asc or propertyname:desc. Possible properties: type, id, createdAt, modifiedAt, firstAuthority, secondAuthority, login, email, lastLogin, passwordExpiry, accountExpiry, active, resource		pqforce.performance.sort.max >= length > 0;non-null & matches '[\x21-\x7F\p{IsLatin}](?:[\x20-\x7F\p{IsLatin}]{0,30}?[\x21-\x7F\p{IsLatin}])??(?::(?:asc\|desc))?' (The array, if present, must contain at least one element and at most the configured "pqforce.performance.sort.max" elements. Each element must not be null and must be a property name of at most 32 characters, optionally followed by ":asc" or ":desc".)

Result

This endpoint returns the following data: array of PF.Reference

GET /API/V3/ACM/Permission/:permissionId

Returns a specific permission

HTTP syntax

GET /API/V3/ACM/Permission/:permissionId
<- application/json : Permission

JavaScript syntax

Pqf.acm.getPermission(permissionId) // returns Permission

Parameters

Name	Type	Description	Required	Assertion
permissionId	UUID	The permission ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: Permission

GET /API/V3/ACM/PermissionCube/:objectType/:objectId

Returns a permission cube for a given object that describes which users may access it in what manner

HTTP syntax

GET /API/V3/ACM/PermissionCube/:objectType/:objectId?includeAllStates=...
<- application/json : CubeViewForObject

JavaScript syntax

Pqf.acm.getPermissionCubeForObject(objectType, objectId, includeAllStates) // returns CubeViewForObject

// Overloads for optional parameters
Pqf.acm.getPermissionCubeForObject(objectType, objectId) // returns CubeViewForObject

Required permission

Requires permission 0581623E09D15D9A87281063264D60BF.

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
objectType	UUID	The type of the object	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
objectId	UUID	The ID of the object	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
includeAllStates	boolean	Get permissions for all possible lifecycle states			false

Result

This endpoint returns the following data: CubeViewForObject

GET /API/V3/ACM/PermissionCubeMappings/:objectType

Returns a mapping between actions or transitions on an object and the corresponding permissions

HTTP syntax

GET /API/V3/ACM/PermissionCubeMappings/:objectType?includeNonCore=...
<- application/json : CubeMappingForType

JavaScript syntax

Pqf.acm.getPermissionCubeMappingsForType(objectType, includeNonCore) // returns CubeMappingForType

// Overloads for optional parameters
Pqf.acm.getPermissionCubeMappingsForType(objectType) // returns CubeMappingForType

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
objectType	UUID	The type of object	✔️	matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
includeNonCore	boolean	Include permissions with wildcards			false

Result

This endpoint returns the following data: CubeMappingForType

GET /API/V3/ACM/PermissionGraph

Returns a permission graph that describes the inheritance between permissions (directed acyclic graph)

HTTP syntax

GET /API/V3/ACM/PermissionGraph?objectType=...
<- application/json

JavaScript syntax

Pqf.acm.getPermissionGraph(objectType) // returns PermissionWithParents[]

// Overloads for optional parameters
Pqf.acm.getPermissionGraph() // returns PermissionWithParents[]

Parameters

Name	Type	Description	Required	Assertion
objectType	UUID	Show graph for a given type with cube		matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value, if present, must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)

Result

This endpoint returns the following data: array of PermissionWithParents

GET /API/V3/ACM/Permissions

Returns all permissions available on the system

HTTP syntax

GET /API/V3/ACM/Permissions
<- application/json

JavaScript syntax

Pqf.acm.getPermissions() // returns Permission[]

Result

This endpoint returns the following data: array of Permission

GET /API/V3/ACM/Saml2/IdP/:authorityId

Gets a SAML 2 identity provider specified by its ID

HTTP syntax

GET /API/V3/ACM/Saml2/IdP/:authorityId
<- application/json : Saml2IdentityProvider

JavaScript syntax

Pqf.acm.getSaml2IdentityProvider(authorityId) // returns Saml2IdentityProvider

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	The SAML 2 identity provider's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: Saml2IdentityProvider

PUT /API/V3/ACM/Saml2/IdP/:authorityId

Stores a SAML 2 identity provider specified by its ID

HTTP syntax

PUT /API/V3/ACM/Saml2/IdP/:authorityId
-> application/json : Saml2IdentityProvider

JavaScript syntax

Pqf.acm.putSaml2IdentityProvider(authorityId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	The SAML 2 identity provider's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
requestJson	Saml2IdentityProvider	JSON object of type Saml2IdentityProvider	✔️

DELETE /API/V3/ACM/Saml2/IdP/:authorityId

Deletes a SAML 2 identity provider specified by its ID

HTTP syntax

DELETE /API/V3/ACM/Saml2/IdP/:authorityId

JavaScript syntax

Pqf.acm.delSaml2IdentityProvider(authorityId) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	The SAML 2 identity provider's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

GET /API/V3/ACM/Saml2/IdP/:authorityId/RequestSignCertificate

Gets a SAML 2 identity provider request signing certificate specified by the provider's ID

HTTP syntax

GET /API/V3/ACM/Saml2/IdP/:authorityId/RequestSignCertificate?format=...
<- application/octet-stream

JavaScript syntax

Pqf.acm.getSaml2IdentityProviderRequestSignCertificate(authorityId, format) // returns Object

// Overloads for optional parameters
Pqf.acm.getSaml2IdentityProviderRequestSignCertificate(authorityId) // returns Object

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
authorityId	UUID	The SAML 2 identity provider's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
format	string	the format to get (DER or PEM)			DER

Result

This endpoint returns the following data: Binary

POST /API/V3/ACM/Saml2/IdP/:authorityId/RequestSignCertificate/Renew

Renews a SAML 2 identity provider request signing certificate specified by the provider's ID

HTTP syntax

POST /API/V3/ACM/Saml2/IdP/:authorityId/RequestSignCertificate/Renew?algorithm=...&keySize=...&expiry=...

JavaScript syntax

Pqf.acm.renewSaml2IdentityProviderRequestSignCertificate(authorityId, algorithm, keySize, expiry) // returns Number - the return code (HTTP 2xx code) of the call

// Overloads for optional parameters
Pqf.acm.renewSaml2IdentityProviderRequestSignCertificate(authorityId, algorithm, keySize) // returns Number - the return code (HTTP 2xx code) of the call
Pqf.acm.renewSaml2IdentityProviderRequestSignCertificate(authorityId, algorithm) // returns Number - the return code (HTTP 2xx code) of the call
Pqf.acm.renewSaml2IdentityProviderRequestSignCertificate(authorityId) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	The SAML 2 identity provider's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
algorithm	string	the algorithm to use (SHA256withECDSA, SHA256withRSA, SHA384withECDSA, SHA384withRSA, SHA512withECDSA or SHA512withRSA)
keySize	int?	the key size to use
expiry	datetime	the point in time of expiry

GET /API/V3/ACM/Saml2/IdPs

Gets all SAML 2 identity providers

HTTP syntax

GET /API/V3/ACM/Saml2/IdPs?sort=...
<- application/json

JavaScript syntax

Pqf.acm.getAllSaml2IdentityProviders(sort) // returns PF.Reference[]

// Overloads for optional parameters
Pqf.acm.getAllSaml2IdentityProviders() // returns PF.Reference[]

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
sort	array of string	Array which defines ordering. Syntax of an element: propertyname, propertyname:asc or propertyname:desc. Possible properties: type, id, name, code, description, color, createdAt, modifiedAt, signInUrl, signOutUrl		pqforce.performance.sort.max >= length > 0;non-null & matches '[\x21-\x7F\p{IsLatin}](?:[\x20-\x7F\p{IsLatin}]{0,30}?[\x21-\x7F\p{IsLatin}])??(?::(?:asc\|desc))?' (The array, if present, must contain at least one element and at most the configured "pqforce.performance.sort.max" elements. Each element must not be null and must be a property name of at most 32 characters, optionally followed by ":asc" or ":desc".)

Result

This endpoint returns the following data: array of PF.Reference

GET /API/V3/ACM/Saml2/IdPs/:authorityIds

Gets some SAML 2 identity providers specified by their IDs

HTTP syntax

GET /API/V3/ACM/Saml2/IdPs/:authorityIds
<- application/json

JavaScript syntax

Pqf.acm.getSaml2IdentityProviders(authorityIds) // returns Saml2IdentityProvider[]

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
authorityIds	array of UUID	The SAML 2 identity provider's IDs	✔️	pqforce.performance.bulk.max >= length > 0;non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The array must contain at least one element and at most the configured "pqforce.performance.bulk.max" elements. Each element must not be null and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: array of Saml2IdentityProvider

POST /API/V3/ACM/Saml2/IdPs/Add

Create a new SAML 2 identity provider

HTTP syntax

POST /API/V3/ACM/Saml2/IdPs/Add
<- application/json : PF.Reference

JavaScript syntax

Pqf.acm.addSaml2IdentityProvider() // returns PF.Reference

Required license

This endpoint requires the following licenses:

• sso

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Result

This endpoint returns the following data: PF.Reference

GET /API/V3/ACM/SecondFactorAuthorities

Returns all second factor authorities

HTTP syntax

GET /API/V3/ACM/SecondFactorAuthorities
<- application/json

JavaScript syntax

Pqf.acm.getSecondFactorAuthorities() // returns PF.Identification[]

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Result

This endpoint returns the following data: array of PF.Identification

GET /API/V3/ACM/SecondFactorAuthority/:authorityId

Returns a specific second factor authority

HTTP syntax

GET /API/V3/ACM/SecondFactorAuthority/:authorityId
<- application/json : PF.Identification

JavaScript syntax

Pqf.acm.getSecondFactorAuthority(authorityId) // returns PF.Identification

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion
authorityId	UUID	the ID of the authority	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: PF.Identification

GET /API/V3/ACM/User/:userId

Get a User

HTTP syntax

GET /API/V3/ACM/User/:userId
<- application/json : User

JavaScript syntax

Pqf.acm.getUser(userId) // returns User

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/Users/:userIds: Get multiple Users
• PUT /API/V3/ACM/User/:userId: Create or update a User
• DELETE /API/V3/ACM/User/:userId: Delete a User
• GET /API/V3/ACM/User/:userId/Identification: Get a User identification
• GET /API/V3/ACM/Users/:userIds/Identification: Get multiple User identifications

Required permission

Requires permission READ on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The User's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: User

PUT /API/V3/ACM/User/:userId

Create or update a User

HTTP syntax

PUT /API/V3/ACM/User/:userId
-> application/json : User

JavaScript syntax

Pqf.acm.putUser(userId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/User/:userId: Get a User
• GET /API/V3/ACM/Users/:userIds: Get multiple Users
• DELETE /API/V3/ACM/User/:userId: Delete a User
• GET /API/V3/ACM/User/:userId/Identification: Get a User identification
• GET /API/V3/ACM/Users/:userIds/Identification: Get multiple User identifications

Required permission

Requires permission UPDATE or CREATE on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The User's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
requestJson	User	JSON object of type User	✔️

DELETE /API/V3/ACM/User/:userId

Delete a User

HTTP syntax

DELETE /API/V3/ACM/User/:userId

JavaScript syntax

Pqf.acm.delUser(userId) // returns Number - the return code (HTTP 2xx code) of the call

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/User/:userId: Get a User
• GET /API/V3/ACM/Users/:userIds: Get multiple Users
• PUT /API/V3/ACM/User/:userId: Create or update a User
• GET /API/V3/ACM/User/:userId/Identification: Get a User identification
• GET /API/V3/ACM/Users/:userIds/Identification: Get multiple User identifications

Required permission

Requires permission DELETE on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The User's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

GET /API/V3/ACM/User/:userId/Authorizations

Returns all authorizations of a specific user

HTTP syntax

GET /API/V3/ACM/User/:userId/Authorizations
<- application/json

JavaScript syntax

Pqf.acm.getUserAuthorizations(userId) // returns UserAuthorization[]

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: array of UserAuthorization

GET /API/V3/ACM/User/:userId/Identification

Get a User identification

HTTP syntax

GET /API/V3/ACM/User/:userId/Identification?deleted=...
<- application/json : PF.IdentificationExtended

JavaScript syntax

Pqf.acm.getUserIdentification(userId, deleted) // returns PF.IdentificationExtended

// Overloads for optional parameters
Pqf.acm.getUserIdentification(userId) // returns PF.IdentificationExtended

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/User/:userId: Get a User
• GET /API/V3/ACM/Users/:userIds: Get multiple Users
• PUT /API/V3/ACM/User/:userId: Create or update a User
• DELETE /API/V3/ACM/User/:userId: Delete a User
• GET /API/V3/ACM/Users/:userIds/Identification: Get multiple User identifications

Required permission

Requires permission IDENTIFY on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
userId	UUID	The User's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
deleted	boolean	Allow deleted objects to be returned			false

Result

This endpoint returns the following data: PF.IdentificationExtended

GET /API/V3/ACM/User/:userId/Preferences

Returns a user's preferences, not specified fields are transmitted as null or filled with default / current value depending on optional parameter

HTTP syntax

GET /API/V3/ACM/User/:userId/Preferences?allowUnspecified=...
<- application/json : UserPreferences

JavaScript syntax

Pqf.acm.getUserPreferences(userId, allowUnspecified) // returns UserPreferences

// Overloads for optional parameters
Pqf.acm.getUserPreferences(userId) // returns UserPreferences

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
allowUnspecified	boolean	return not specified values as null, if set			false

Result

This endpoint returns the following data: UserPreferences

PUT /API/V3/ACM/User/:userId/Preferences

Stores a specific user's preferences, defaults, if none set

HTTP syntax

PUT /API/V3/ACM/User/:userId/Preferences
-> application/json : UserPreferences

JavaScript syntax

Pqf.acm.putUserPreferences(userId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
requestJson	UserPreferences	JSON object of type UserPreferences	✔️

GET /API/V3/ACM/User/:userId/Roles

Returns the user roles assigned to a specific user

HTTP syntax

GET /API/V3/ACM/User/:userId/Roles
<- application/json

JavaScript syntax

Pqf.acm.getUserRoleAssignments(userId) // returns PF.Reference[]

Required permission

Requires permission READ on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: array of PF.Reference

PUT /API/V3/ACM/User/:userId/Roles

Updates the user roles assignments of a specific user

HTTP syntax

PUT /API/V3/ACM/User/:userId/Roles
-> application/json

JavaScript syntax

Pqf.acm.putUserRoleAssignments(userId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• rolemanagement

Required permission

Requires permission UPDATE on object of type User and ID specified in parameter userId.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
requestJson	array of PF.Reference	JSON object of type array of Reference	✔️

GET /API/V3/ACM/User/:userId/SecondFactor/Status

Returns the status of the second factor of the two factor authentication

HTTP syntax

GET /API/V3/ACM/User/:userId/SecondFactor/Status
<- application/json : PF.Identification

JavaScript syntax

Pqf.acm.getUserSecondFactorStatus(userId) // returns PF.Identification

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion
userId	UUID	The user's ID	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: PF.Identification

GET /API/V3/ACM/UserRole/:userRoleId

Returns a specific role that may be assigned to a user

HTTP syntax

GET /API/V3/ACM/UserRole/:userRoleId
<- application/json : UserRole

JavaScript syntax

Pqf.acm.getUserRole(userRoleId) // returns UserRole

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	the user role ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: UserRole

GET /API/V3/ACM/UserRole/:userRoleId/Authorizations

Returns the authorizations of a specific role that may be assigned to a user

HTTP syntax

GET /API/V3/ACM/UserRole/:userRoleId/Authorizations
<- application/json

JavaScript syntax

Pqf.acm.getUserRoleAuthorizations(userRoleId) // returns UserRoleAuthorization[]

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	the user role ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: array of UserRoleAuthorization

PUT /API/V3/ACM/UserRole/:userRoleId/Authorizations

Updates the authorizations of a specific role that may be assigned to a user

HTTP syntax

PUT /API/V3/ACM/UserRole/:userRoleId/Authorizations
-> application/json

JavaScript syntax

Pqf.acm.putUserRoleAuthorizations(userRoleId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	the user role ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
requestJson	array of UserRoleAuthorization	JSON object of type array of UserRoleAuthorization	✔️

DELETE /API/V3/ACM/UserRole/:userRoleId/Authorizations

Deletes all the authorizations of a specific role that may be assigned to a user

HTTP syntax

DELETE /API/V3/ACM/UserRole/:userRoleId/Authorizations

JavaScript syntax

Pqf.acm.delUserRoleAuthorizations(userRoleId) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	The user role's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

GET /API/V3/ACM/UserRole/:userRoleId/WithTranslations

Returns a specific role that may be assigned to a user with translations

HTTP syntax

GET /API/V3/ACM/UserRole/:userRoleId/WithTranslations
<- application/json : UserRoleTranslated

JavaScript syntax

Pqf.acm.getUserRoleTranslated(userRoleId) // returns UserRoleTranslated

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	The user role's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: UserRoleTranslated

PUT /API/V3/ACM/UserRole/:userRoleId/WithTranslations

Sets a specific role that may be assigned to a user with translations

HTTP syntax

PUT /API/V3/ACM/UserRole/:userRoleId/WithTranslations
-> application/json : UserRoleTranslated

JavaScript syntax

Pqf.acm.putUserRoleTranslated(userRoleId, requestJson) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	The user role's ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
requestJson	UserRoleTranslated	JSON object of type UserRoleTranslated	✔️

DELETE /API/V3/ACM/UserRole/:userRoleId/WithTranslations

Deletes a specific role that may be assigned to a user with translations

HTTP syntax

DELETE /API/V3/ACM/UserRole/:userRoleId/WithTranslations

JavaScript syntax

Pqf.acm.delUserRoleTranslated(userRoleId) // returns Number - the return code (HTTP 2xx code) of the call

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
userRoleId	UUID	The user's role ID	✔️	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

GET /API/V3/ACM/UserRoles

Returns all roles that may be assigned to a user

HTTP syntax

GET /API/V3/ACM/UserRoles
<- application/json

JavaScript syntax

Pqf.acm.getUserRoles() // returns UserRole[]

Required permission

Requires permission E8B12C24CCF05980BAF3348BE3A0D5B3.

Result

This endpoint returns the following data: array of UserRole

GET /API/V3/ACM/UserRoles/WithTranslations

Returns all roles that may be assigned to a user with translations

HTTP syntax

GET /API/V3/ACM/UserRoles/WithTranslations
<- application/json

JavaScript syntax

Pqf.acm.getUserRolesTranslated() // returns UserRoleTranslated[]

Required license

This endpoint requires the following licenses:

• config-permissions

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Result

This endpoint returns the following data: array of UserRoleTranslated

GET /API/V3/ACM/Users

Returns references to all users

HTTP syntax

GET /API/V3/ACM/Users?sort=...
<- application/json

JavaScript syntax

Pqf.acm.getAllUsers(sort) // returns PF.Reference[]

// Overloads for optional parameters
Pqf.acm.getAllUsers() // returns PF.Reference[]

Required permission

Requires permission 105D1AD65BC5405AA93607A0A20D3703.

Parameters

Name	Type	Description	Required	Assertion
sort	array of string	Array which defines ordering. Syntax of an element: propertyname, propertyname:asc or propertyname:desc. Possible properties: type, id, createdAt, modifiedAt, firstAuthority, secondAuthority, login, email, lastLogin, passwordExpiry, accountExpiry, active, resource		pqforce.performance.sort.max >= length > 0;non-null & matches '[\x21-\x7F\p{IsLatin}](?:[\x20-\x7F\p{IsLatin}]{0,30}?[\x21-\x7F\p{IsLatin}])??(?::(?:asc\|desc))?' (The array, if present, must contain at least one element and at most the configured "pqforce.performance.sort.max" elements. Each element must not be null and must be a property name of at most 32 characters, optionally followed by ":asc" or ":desc".)

Result

This endpoint returns the following data: array of PF.Reference

GET /API/V3/ACM/Users/:userIds

Get multiple Users

HTTP syntax

GET /API/V3/ACM/Users/:userIds
<- application/json

JavaScript syntax

Pqf.acm.getUsers(userIds) // returns User[]

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/User/:userId: Get a User
• PUT /API/V3/ACM/User/:userId: Create or update a User
• DELETE /API/V3/ACM/User/:userId: Delete a User
• GET /API/V3/ACM/User/:userId/Identification: Get a User identification
• GET /API/V3/ACM/Users/:userIds/Identification: Get multiple User identifications

Required permission

Requires permission READ on object of type User and ID in specified in parameter userIds.

Parameters

Name	Type	Description	Required	Assertion
userIds	array of UUID	The User IDs	✔️	pqforce.performance.bulk.max >= length > 0;non-null & matches '[0-9A-F]{32}' (The array must contain at least one element and at most the configured "pqforce.performance.bulk.max" elements. Each element must not be null and must be a UUID written as 32 upper-case hexadecimal digits.)

Result

This endpoint returns the following data: array of User

GET /API/V3/ACM/Users/:userIds/Identification

Get multiple User identifications

HTTP syntax

GET /API/V3/ACM/Users/:userIds/Identification?deleted=...
<- application/json

JavaScript syntax

Pqf.acm.getUserIdentifications(userIds, deleted) // returns PF.IdentificationExtended[]

// Overloads for optional parameters
Pqf.acm.getUserIdentifications(userIds) // returns PF.IdentificationExtended[]

Other endpoints for objects of type user

This endpoint is part of a group of endpoints manipulating objects of type user. The following endpoints belong to the same group:

• GET /API/V3/ACM/User/:userId: Get a User
• GET /API/V3/ACM/Users/:userIds: Get multiple Users
• PUT /API/V3/ACM/User/:userId: Create or update a User
• DELETE /API/V3/ACM/User/:userId: Delete a User
• GET /API/V3/ACM/User/:userId/Identification: Get a User identification

Required permission

Requires permission IDENTIFY on object of type User and ID in specified in parameter userIds.

Parameters

Name	Type	Description	Required	Assertion	Default, if omitted
userIds	array of UUID	The User IDs	✔️	pqforce.performance.bulk.max >= length > 0;non-null & matches '[0-9A-F]{32}' (The array must contain at least one element and at most the configured "pqforce.performance.bulk.max" elements. Each element must not be null and must be a UUID written as 32 upper-case hexadecimal digits.)
deleted	boolean	Allow deleted objects to be returned			false

Result

This endpoint returns the following data: array of PF.IdentificationExtended

POST /API/V3/ACM/Users/Add/:firstAuthorityId

Creates a new user with specified first authority

HTTP syntax

POST /API/V3/ACM/Users/Add/:firstAuthorityId?resourceId=...
<- application/json : PF.Reference

JavaScript syntax

Pqf.acm.addUser(firstAuthorityId, resourceId) // returns PF.Reference

// Overloads for optional parameters
Pqf.acm.addUser(firstAuthorityId) // returns PF.Reference

Required permission

Requires permission 1A2310048F935BA190F82281C36AA4E8.

Parameters

Name	Type	Description	Required	Assertion
firstAuthorityId	UUID	ID of the user's first authority	✔️	matches '[0-9A-F]{32}' (The value must be a UUID written as 32 upper-case hexadecimal digits.)
resourceId	UUID	ID of a resource connected to user		matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

Result

This endpoint returns the following data: PF.Reference

GET /API/V3/ACM/Welcome

Returns a welcome message. This message may just welcome a user or may inform about special things like expiring passwords

HTTP syntax

GET /API/V3/ACM/Welcome
<- application/json : WelcomeMessage

JavaScript syntax

Pqf.acm.getWelcomeMessage() // returns WelcomeMessage

Result

This endpoint returns the following data: WelcomeMessage

Data types

ACM.ApiClientInfo

This is a structure data contract.

Describes an API client

Members

Name	Type	Inherited	Description	Assertion
application	string		The name of the application that wants to access PQFORCE
appVersion	string		The version of the application that wants to access PQFORCE
appCompany	string		The company that is responsible for the development of the application

ACM.ApiTokenAuthorizationRequest

This is a structure data contract.

Contains information about an API token that is requested to be authorized

Members

Name	Type	Inherited	Description	Assertion
tokenId	UUID		The ID of the token that was created	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
clientInfoProvided	ApiClientInfo		The information about the software that was provided
requestedFromAddress	string		The address of the machine that requested a new API token
yourAddress	string		The address of the machine that is doing the current request as seen by the server for comparison
requestedAt	datetime		The point in time when the token was requested

ACM.ApiTokenLog

This is a structure data contract.

Contains information about an API token that is authorized

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
clientInfoProvided	ApiClientInfo		The information about the software that was provided
authorizedAt	datetime		The point in time when the token was authorized	non-null (The value is required.)
lastAccessAddress	string		The address from which the token was last used
lastAccessAt	datetime		The last time the token was used
expiry	datetime		The point in time when the token expires	non-null (The value is required.)

ACM.ApiTokenWithAuthUrl

This is a structure data contract.

Contains the secret token and the URL to be called with the browser to authorize the API client for PQFORCE access

Members

Name	Type	Inherited	Description	Assertion
apiToken	string		The secret token to access the PQFORCE API	non-null (The value is required.)
authorizationUrl	string		This URL must be shown in the browser to follow the steps to authorize the API client for PQFORCE access	non-null (The value is required.)
authorizationDeadline	datetime		The point in time when the authorization process must be finished	non-null (The value is required.)

ACM.AuthenticationState

This is a structure data contract.

Contains information about the authentication state of the current session

Members

Name	Type	Inherited	Description	Assertion
tenant	boolean		true, if tenant is known
preAuthenticated	boolean		true, if user was specified, but not yet authenticated
fullyAuthenticated	boolean		true, if user was specified and fully authenticated

ACM.Challenge

This is a structure data contract.

Describes a challenge that has to be fulfilled by user logging in

Members

Name	Type	Inherited	Description	Assertion
challengeText	string		Contains the task to perform for solving the challenge in the user's language
challengeImageUrl	URI		An image (i.e.) a barcode to be shown
challengeType	ChallengeType		The type of challenge
challengeRegex	string		Describes the rules for the answer to be entered
challengeHint	string		A hint that describes the format of the answer (corresponding to the RegEx)

ACM.ChallengeAnswer

This is a structure data contract.

The answer to a challenge

Members

Name	Type	Inherited	Description	Assertion
answer	string		The answer that was entered by the user	non-null (The value is required.)

ACM.ChallengeType

This is an enumeration data contract.

The kind of challenge to be fulfilled

Enum values

ID	Description
ANSWER	A simple answer from the user is expected
EXTERNAL	The user has to do something on a different channel
NEW_PASSWORD	The user has to change his/her password

ACM.ChangePassword

This is a structure data contract.

A change password request

Members

Name	Type	Inherited	Description	Assertion
oldPassword	string		The old password
newPassword	string		The new password

ACM.Confidentiality

This is a structure data contract.

Describes confidentiality of an object and some metadata

Based on

• PF.Reference
• PF.VersionReference
• PF.VersionedReference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
versionId	UUID	✔️	A unique identifier for the version, a UUID	matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)
historic	boolean	✔️	true, if there is a more recent version of this object; false, if this is the most recent version of this object
createdAt	datetime	✔️	The point in time when the object was created
createdBy	PF.Reference	✔️	Reference to the user that created this object
modifiedAt	datetime	✔️	The point in time when the object was modified
modifiedBy	PF.Reference	✔️	Reference to the user that modified this object
confidentiality	ConfidentialityLevel		The confidentiality level	non-null (The value is required.)

ACM.ConfidentialityLevel

This is an enumeration data contract.

Describes confidentiality of an object

Enum values

ID	Description
Normal	Normal confidentiality
High	High confidentiality

ACM.CubeMappingForType

This is a structure data contract.

Contains the relations between actions, lifecycle transitions, states, relations and the resulting permissions for a given object type

Members

Name	Type	Inherited	Description	Assertion
relationIds	array of UUID		Contains relations between objects and a user's resource	null;matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The array is optional. Each element, if not null, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
stateIds	array of UUID		The possible states of an object of given type	null;matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The array is optional. Each element, if not null, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
actions	array of string		The different actions that may be performed on the given type of object
byRelationState	array of array of CubeMappingItem		The 2-dimensional array containing the permission mappings by relation and by state	null;non-null;non-null (The array is optional. Each element must not be null. Each element at nesting level 2 must not be null.)

ACM.CubeMappingItem

This is a structure data contract.

Contains the relations between actions, lifecycle transitions, relations and the resulting permissions for a given object type and a given lifecycle state

Members

Name	Type	Inherited	Description	Assertion
byAction	array of string		The different permission IDs for the given actions (specified in outer object)	non-null;non-null (The array is required. Each element must not be null.)
transitions	array of TransitionPermission		The different mappings for transitions that are possible starting from given state	null;non-null (The array is optional. Each element must not be null.)

ACM.CubeViewForObject

This is a structure data contract.

Contains the authorizations between a given object and the users who have access depending on different possible lifecycle states

Members

Name	Type	Inherited	Description	Assertion
users	array of PF.Reference		The different users that have access	null;non-null (The array is optional. Each element must not be null.)
stateIds	array of UUID		The different lifecycle states the given object may be in	null;matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The array is optional. Each element, if not null, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
actions	array of string		The different actions that may be performed on the given object	null;non-null (The array is optional. Each element must not be null.)
byUserState	array of array of CubeViewForObjectItem		The 2-dimensional array containing the grants by user and by state	null;non-null;non-null (The array is optional. Each element must not be null. Each element at nesting level 2 must not be null.)

ACM.CubeViewForObjectItem

This is a structure data contract.

Contains the relations between actions, lifecycle transitions, relations and the resulting authorizations for a given object or object type, a given lifecycle state and a given user or user role

Members

Name	Type	Inherited	Description	Assertion
byAction	array of PF.Grant		The grants for the given actions (specified in outer object)
transitions	array of TransitionGrant		The grants for the transitions that are possible starting from given state	null;non-null (The array is optional. Each element must not be null.)

ACM.FirstFactorAuthority

This is a structure data contract.

An instance that identifies and authorizes users

Based on

• PF.Reference
• PF.Identification

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
name	string	✔️	The name of the object (in the user's language, if translations are available)
code	string	✔️	A short code which may be unique over all objects of the same type	matches '.{0,32}' (The value, if present, must be a single line of at most 32 characters.)
description	string	✔️	A descriptive text about the object, may contain HTML
color	color	✔️	A color or any identifier of a color
iconRef	URI	✔️	value for HTML attribute image/@src, Examples: "/images/.../....png" for images on the server, "/API/V3/PF/Icon/[id]" for an uploaded icon, "data:image/png;base64,[base64data]" for inline data, "mdi:[name]" for a Material Design icon	matches '(?:/\|\.\./)images/(?:[A-Za-z0-9_-]+/)*[A-Za-z0-9_-]+\.(?:png\|jpg\|svg)\|(?:/\|\.\./)API/V3/PF/Icon/(?:[0-9A-Z]{52}\|[0-9a-zA-Z]{43})\|data:image/(?:png\|jpeg\|jpg\|gif);base64,(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==\|[A-Za-z0-9+/]{3}=\|[A-Za-z0-9+/]{4})\|mdi:[a-z0-9-]+' (The value, if present, must match the regular expression shown.)
loginRedirectUrl	string		If not null, the client must redirect the browser to an external login page instead of the internal login page

ACM.InteractiveLoginRequest

This is a structure data contract.

The request for interactive login

Members

Name	Type	Inherited	Description	Assertion
username	string		The username for the login	non-null & matches '[\x21-\x7F\p{IsLatin}](?:[\x20-\x7F\p{IsLatin}]*[\x21-\x7F\p{IsLatin}])?' (The value is required and must be a text of printable ASCII characters or Latin letters, neither starting nor ending with a space.)
password	string		The password for the login	non-null (The value is required.)
language	string		The language code, according to ISO 639-1	matches '[a-zA-Z]{2}(?:-[a-zA-Z]+)*' (The value, if present, must be a language tag such as "de" or "en-GB".)
timezone	string		The time zone of the user according to tz database name	matches '(Z\|UTC\|GMT\|UT\|(UTC\|GMT\|UT)?[+-](2[0-3]\|[01]?[0-9])(:[0-5][0-9]){0,2}\|[A-Za-z]+/[A-Za-z_]+(/[A-Za-z_]+)?)' (The value, if present, must be a time zone: "Z", "UTC", a UTC offset such as "+02:00", or a region such as "Europe/Zurich".)

ACM.LoginLog

This is a structure data contract.

Contains the description of a login attempt event

Members

Name	Type	Inherited	Description	Assertion
timestamp	datetime		The point in time when the attempt happened
loginLogType	LoginLogType		The type of log
message	string		Describes to the system administrator what has happened

ACM.LoginLogType

This is an enumeration data contract.

This enum helps for the differentiation of SAML 2.0 login logs

Enum values

ID	Description
AccessGranted	Access was granted
AccessDenied	Access was denied
AssertionLog	Log of the assertions, for debug purpose

ACM.LogoutResponse

This is a structure data contract.

The response of the server after logout

Members

Name	Type	Inherited	Description	Assertion
redirectUrl	string		The URL to which the client should be redirected (SAML 2.0), if not null

ACM.Permission

This is a structure data contract.

Describes a permission with its ID

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
description	string		A description of the permission in the user's language

ACM.PermissionWithParents

This is a structure data contract.

Describes a permission with its ID and parent permissions

Based on

• PF.Reference
• Permission

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
description	string	✔️	A description of the permission in the user's language
parentIds	array of UUID		The IDs of the parent permissions	non-null;non-null & matches '[0-9A-F]{32}' (The array is required. Each element must not be null and must be a UUID written as 32 upper-case hexadecimal digits.)

ACM.Saml2IdentityProvider

This is a structure data contract.

Contains all necessary information for using an external identity provider (IdP) with SAML protocol

Based on

• PF.Reference
• PF.Identification

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
name	string	✔️	The name of the object (in the user's language, if translations are available)
code	string	✔️	A short code which may be unique over all objects of the same type	matches '.{0,32}' (The value, if present, must be a single line of at most 32 characters.)
description	string	✔️	A descriptive text about the object, may contain HTML
color	color	✔️	A color or any identifier of a color
iconRef	URI	✔️	value for HTML attribute image/@src, Examples: "/images/.../....png" for images on the server, "/API/V3/PF/Icon/[id]" for an uploaded icon, "data:image/png;base64,[base64data]" for inline data, "mdi:[name]" for a Material Design icon	matches '(?:/\|\.\./)images/(?:[A-Za-z0-9_-]+/)*[A-Za-z0-9_-]+\.(?:png\|jpg\|svg)\|(?:/\|\.\./)API/V3/PF/Icon/(?:[0-9A-Z]{52}\|[0-9a-zA-Z]{43})\|data:image/(?:png\|jpeg\|jpg\|gif);base64,(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==\|[A-Za-z0-9+/]{3}=\|[A-Za-z0-9+/]{4})\|mdi:[a-z0-9-]+' (The value, if present, must match the regular expression shown.)
primaryCertificateFingerprint	string		The fingerprint (SHA 256 hash in hex format) of the customer's identity provider's primary certificate (spaces between groups are optional)
secondaryCertificateFingerprint	string		A secondary (spare) fingerprint (SHA 256 hash in hex format) of an optional customer's identity provider's secondary/spare certificate (spaces between groups are optional)
signInUrl	string		The URL that is used by the customer's identity provider to sign in
signOutUrl	string		The URL that is used by the customer's identity provider to sign out (not yet in use)
emailField	string		Where to find email in the customer's identity provider's response
userIdField	string		Where to find the user ID in the customer's identity provider's response
realNameField	string		Where to find real name in the customer's identity provider's response (not yet in use)
mobileNumberField	string		Where to find the mobile number in the customer's identity provider's response
groupsField	string		Where to find group information in the customer's identity provider's response
userRoleMapping	array of Saml2UserRoleMapping		The mappings of user roles: user role --> required group.	null;non-null (The array is optional. Each element must not be null.)
issuerUrl	string		Informational (read-only) for the admin: The issuer URL to be configured in the customer's identity provider
assertionConsumerServiceUrl	string		Informational (read-only) for the admin: The ACS URL to be configured in the customer's identity provider
directLoginUrl	string		Informational (read-only) for the admin: The direct login URL
defaultSecondAuthorityId	UUID		The default second authority (2nd factor) for new users that are created automatically	matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)
receiveNotificationsDefault	boolean		The default notification setting for new users that are created automatically
logAssertions	boolean		Enables or disables the logging of assertions for debug / config purpose
allowInsecureSignatureAlgorithm	boolean		Maintains compatibility to some outdated, insecure SAML2 identity providers. Make sure to update or reconfigure your identity provider for the usage of a secure algorithm.
logs	array of LoginLog		Contains logs about the last few login attempts with the customer's identity provider for the system admin (read-only)	null;non-null (The array is optional. Each element must not be null.)
signRequest	boolean		Specifies whether to sign the requests
sendAcsUrl	boolean		Specifies whether to send the ACS URL with the request (request needs also to be signed, if true)
apiVersion	PF.ApiVersion		The generation (version) of the PQFORCE API whose issuer and assertion consumer service URLs are used with this identity provider	non-null (The value is required.)
tenantSpecificIssuer	boolean		Uses a tenant specific issuer URL to distinguish different tenants on the same system
requestPersistentId	boolean		Whether to explicitly request a persistent ID (recommended, disable only for compatibility reasons)
certificateInfo	PF.CertificateInfo		Contains information about the signing certificate, if signing is enabled (read-only)

ACM.Saml2UserRoleMapping

This is a structure data contract.

Describes a mapping between a PQFORCE user role and any required external group (i.e. AD group). If group is null, all users will be assigned to that user role

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
userRoleId	UUID		The ID of the user role in PQFORCE	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
mode	Saml2UserRoleMappingMode		Describes the way PQFORCE assigns the mentioned user role to a user with given IdP groups
group	string		The name of the external group (i.e. AD group)

ACM.Saml2UserRoleMappingMode

This is an enumeration data contract.

Describes the way PQFORCE assigns a user role to a user with given IdP groups

Enum values

ID	Description
Never	Never assigns the user role
Individual	Lets the PQFORCE administrator enable this role individually, independent of any IdP
MapGroup	Assigns the user role if and only if the user belongs to the given IdP group
Always	Always assigns the user role

ACM.TransitionGrant

This is a structure data contract.

Describes whether a lifecycle transition is allowed to be performed by a given user

Members

Name	Type	Inherited	Description	Assertion
transitionId	UUID		The lifecycle transition	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
grant	PF.Grant		Whether it is granted

ACM.TransitionPermission

This is a structure data contract.

Describes a permission that is required for performing a lifecycle transition

Members

Name	Type	Inherited	Description	Assertion
transitionId	UUID		The lifecycle transition	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
permissionId	UUID		The permission ID	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)

ACM.User

This is a structure data contract.

A PQFORCE user

Based on

• PF.Reference
• PF.VersionReference
• PF.VersionedReference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
versionId	UUID	✔️	A unique identifier for the version, a UUID	matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)
historic	boolean	✔️	true, if there is a more recent version of this object; false, if this is the most recent version of this object
createdAt	datetime	✔️	The point in time when the object was created
createdBy	PF.Reference	✔️	Reference to the user that created this object
modifiedAt	datetime	✔️	The point in time when the object was modified
modifiedBy	PF.Reference	✔️	Reference to the user that modified this object
firstAuthorityId	UUID		The ID of the first user authority that identified the user	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)
secondAuthorityId	UUID		The ID of the second user authority that identified the user	matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)
login	string		Name of the user	matches '[\x21-\x7F\p{IsLatin}](?:[\x20-\x7F\p{IsLatin}]*[\x21-\x7F\p{IsLatin}])?' (The value, if present, must be a text of printable ASCII characters or Latin letters, neither starting nor ending with a space.)
resource	PF.Reference		Resource tied to the user
email	string		Email of the user	matches '\|[\w-\.]+@(?:[\w-]+\.)+[\w-]{2,}' (The value, if present, must be empty or an e-mail address.)
mobile	string		Mobile phone number of the user
receiveNotifications	boolean		Determines if the user should receive email notifications
language	string		Contains the language that is set for a given user, overrides browser / login language if set
timezone	string		Contains the timezone that is set for a given user, overrides browser timezone if set	matches '(Z\|UTC\|GMT\|UT\|(UTC\|GMT\|UT)?[+-](2[0-3]\|[01]?[0-9])(:[0-5][0-9]){0,2}\|[A-Za-z]+/[A-Za-z_]+(/[A-Za-z_]+)?)' (The value, if present, must be a time zone: "Z", "UTC", a UTC offset such as "+02:00", or a region such as "Europe/Zurich".)
lastLogin	datetime		Last login of user
passwordExpiry	datetime		Expiry of password
accountExpiry	datetime		Expiry of user account
autoLogout	boolean		Determines if the user should be automatically logged out after a period of inactivity
active	boolean		A flag indicating whether the user is active (read-only)

ACM.UserAuthorization

This is a structure data contract.

Describes the different authorizations a given PQFORCE user has

Members

Name	Type	Inherited	Description	Assertion
permissionId	UUID		The permission ID	matches '[0-9A-F]{32}' (The value, if present, must be a UUID written as 32 upper-case hexadecimal digits.)
grantLevel	PF.GrantLevel		Whether it is allowed or not	non-null (The value is required.)

ACM.UserCertificate

This is a structure data contract.

Contains a user certificate whose raw part may be used to sign in to other systems

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
raw	string		Contains the certificate string that may be used to sign in to other systems	non-null (The value is required.)
server	URI		The PQFORCE server on which this user is logged in	non-null (The value is required.)
tenantId	UUID		The tenant this user belongs to	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)
edition	string		The edition the tenant runs on	non-null (The value is required.)
authorityId	UUID		The user authority that identified the user	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)
userId	UUID		The user's ID	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)
userName	string		The user's name
email	string		The user's email	matches '\|[\w-\.]+@(?:[\w-]+\.)+[\w-]{2,}' (The value, if present, must be empty or an e-mail address.)
logonUrl	URI		The URL that is used for logon (may be used to direct the user back to PQFORCE)	non-null (The value is required.)
expiry	datetime		The validity of the certificate	non-null (The value is required.)
fingerprint	string		The fingerprint of this certificate	non-null (The value is required.)

ACM.UserPreferences

This is a structure data contract.

Stores user preferences in a structured way

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
language	string		Contains the language that is set for a given user, overrides browser / login language if set	matches '[a-zA-Z]{2}(?:-[a-zA-Z]+)*' (The value, if present, must be a language tag such as "de" or "en-GB".)
timezone	string		Contains the timezone that is set for a given user, overrides browser timezone if set	matches '(Z\|UTC\|GMT\|UT\|(UTC\|GMT\|UT)?[+-](2[0-3]\|[01]?[0-9])(:[0-5][0-9]){0,2}\|[A-Za-z]+/[A-Za-z_]+(/[A-Za-z_]+)?)' (The value, if present, must be a time zone: "Z", "UTC", a UTC offset such as "+02:00", or a region such as "Europe/Zurich".)
currencyId	UUID		Contains the preferred home currency that is set for a given user, overrides tenant home currency if set	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
receiveNotifications	boolean		A flag specifying whether a user receives notifications by mail

ACM.UserRole

This is a structure data contract.

Describes a user role

Based on

• PF.Reference
• PF.Identification

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
name	string	✔️	The name of the object (in the user's language, if translations are available)
code	string	✔️	A short code which may be unique over all objects of the same type	matches '.{0,32}' (The value, if present, must be a single line of at most 32 characters.)
description	string	✔️	A descriptive text about the object, may contain HTML
color	color	✔️	A color or any identifier of a color
iconRef	URI	✔️	value for HTML attribute image/@src, Examples: "/images/.../....png" for images on the server, "/API/V3/PF/Icon/[id]" for an uploaded icon, "data:image/png;base64,[base64data]" for inline data, "mdi:[name]" for a Material Design icon	matches '(?:/\|\.\./)images/(?:[A-Za-z0-9_-]+/)*[A-Za-z0-9_-]+\.(?:png\|jpg\|svg)\|(?:/\|\.\./)API/V3/PF/Icon/(?:[0-9A-Z]{52}\|[0-9a-zA-Z]{43})\|data:image/(?:png\|jpeg\|jpg\|gif);base64,(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==\|[A-Za-z0-9+/]{3}=\|[A-Za-z0-9+/]{4})\|mdi:[a-z0-9-]+' (The value, if present, must match the regular expression shown.)
parentId	UUID		A reference to another user role if the current role should be shown as child of the other	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

ACM.UserRoleAuthorization

This is a structure data contract.

Describes the different authorizations (grants / denies) for a given user role

Members

Name	Type	Inherited	Description	Assertion
permissionId	UUID		The permission ID	non-null & matches '[0-9A-F]{32}' (The value is required and must be a UUID written as 32 upper-case hexadecimal digits.)
grantLevel	PF.GrantLevel		Whether it is allowed or not with different confidentiality levels	non-null (The value is required.)

ACM.UserRoleTranslated

This is a structure data contract.

Describes a user role with translations

Based on

• PF.Reference
• PF.IdentificationTranslated

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
name	array of PF.TextTranslation	✔️	The name of the object in different languages	length > 0;non-null (The array, if present, must contain at least one element. Each element must not be null.)
code	string	✔️	A short code which may be unique over all objects of the same type	matches '.{0,32}' (The value, if present, must be a single line of at most 32 characters.)
description	array of PF.TextTranslation	✔️	A descriptive text about the object, may contain HTML (in different languages)	length > 0;non-null (The array, if present, must contain at least one element. Each element must not be null.)
color	color	✔️	A color or any identifier of a color (which does not necessarily correspond to the W3C definitions)
iconRef	array of PF.IconTranslation	✔️	value for HTML attribute image/@src, Examples: "/images/.../....png" for images on the server, "/API/V3/PF/Icon/[id]" for an uploaded icon, "data:image/png;base64,[base64data]" for inline data, "mdi:[name]" for a Material Design icon (in different languages)	length > 0;non-null (The array, if present, must contain at least one element. Each element must not be null.)
parentId	UUID		A reference to another user role if the current role should be shown as child of the other	matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value, if present, must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)

ACM.WelcomeMessage

This is a structure data contract.

Contains a welcome message which may inform the user about special things

Based on

• PF.Reference

Members

Name	Type	Inherited	Description	Assertion
type	UUID	✔️	The type of the object (used for change notifications)	non-null & matches '[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?(?:/[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x2E\x30-\x3B\x3D\x3F-\x7E\p{IsLatin}])?)?' (The value is required and must be a type: a UUID written as 32 upper-case hexadecimal digits, or a name of 1 to 32 printable ASCII characters or Latin letters other than "/", "&", "<" and ">", neither starting nor ending with a space, optionally followed by "/" and a sub-type of the same form.)
id	UUID	✔️	The ID of the object (often a UUID, but not necessarily)	non-null & matches '[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}](?:[\x20-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}]{0,30}[\x21-\x25\x27-\x3B\x3D\x3F-\x7E\p{IsLatin}])?' (The value is required and must be an ID: a UUID written as 32 upper-case hexadecimal digits, or a key of 1 to 32 printable ASCII characters or Latin letters other than "&", "<" and ">", neither starting nor ending with a space.)
sticky	boolean		true, if message must be discarded manually
subject	string		The subject in the user's language
message	string		The message in the user's language