Skip to main content
API docs by Redocly

Latch Vector SSO API (v1)

Download OpenAPI specification:Download

Public API reference for the Latch Vector SSO / identity service. Operator-only internal and platform endpoints are intentionally excluded.

API clients

Register and list machine-to-machine clients (the client_credentials grant). Requires the CLIENT_MANAGE permission on a user token.

List an organization's API clients

Returns client ids, names and scopes — never secrets.

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>

Responses

Register a new API client

Creates a machine client for an organization. The response carries the plaintext secret EXACTLY ONCE — it is stored only as a hash and cannot be retrieved again. The client then authenticates at POST /oauth2/token.

Authorizations:
bearerAuth
Request Body schema: application/json
required
name
required
string non-empty
orgId
required
integer <int64>
applicationId
integer <int64>
scopes
Array of strings

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "orgId": 0,
  • "applicationId": 0,
  • "scopes": [
    ]
}

webhook-controller

update

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>
Request Body schema: application/json
required
url
string
eventTypes
Array of strings
active
boolean

Responses

Request samples

Content type
application/json
{
  • "url": "string",
  • "eventTypes": [
    ],
  • "active": true
}

delete

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

list

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>

Responses

register

Authorizations:
bearerAuth
Request Body schema: application/json
required
organizationId
required
integer <int64>
applicationId
required
integer <int64>
url
required
string non-empty
eventTypes
Array of strings

Responses

Request samples

Content type
application/json
{
  • "organizationId": 0,
  • "applicationId": 0,
  • "url": "string",
  • "eventTypes": [
    ]
}

rotateSecret

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

user-controller

update_1

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>
Request Body schema: application/json
required
fullName
string
organizationId
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "fullName": "string",
  • "organizationId": 0
}

list_1

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>
size
integer <int32>
Default: 200

Responses

create

Authorizations:
bearerAuth
Request Body schema: application/json
required
organizationId
required
integer <int64>
email
required
string non-empty
fullName
required
string non-empty
password
string
roleId
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "organizationId": 0,
  • "email": "string",
  • "fullName": "string",
  • "password": "string",
  • "roleId": 0
}

enable

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

disable

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

role-controller

updatePermissions

Authorizations:
bearerAuth
path Parameters
roleId
required
integer <int64>
Request Body schema: application/json
required
permissionCodes
Array of strings
permissionIds
Array of integers <int64> [ items <int64 > ]

Responses

Request samples

Content type
application/json
{
  • "permissionCodes": [
    ],
  • "permissionIds": [
    ]
}

list_2

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>
size
integer <int32>
Default: 200

Responses

create_1

Authorizations:
bearerAuth
Request Body schema: application/json
required
organizationId
integer <int64>
name
required
string non-empty
description
string
permissionCodes
Array of strings
permissionIds
Array of integers <int64> [ items <int64 > ]
scope
string

Responses

Request samples

Content type
application/json
{
  • "organizationId": 0,
  • "name": "string",
  • "description": "string",
  • "permissionCodes": [
    ],
  • "permissionIds": [
    ],
  • "scope": "string"
}

revoke

Authorizations:
bearerAuth
path Parameters
roleId
required
integer <int64>
Request Body schema: application/json
required
userId
required
integer <int64>
organizationId
required
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "organizationId": 0
}

assign

Authorizations:
bearerAuth
path Parameters
roleId
required
integer <int64>
Request Body schema: application/json
required
userId
required
integer <int64>
organizationId
required
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "organizationId": 0
}

organization-controller

update_2

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>
Request Body schema: application/json
required
name
string
type
string

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "type": "string"
}

list_3

Authorizations:
bearerAuth
query Parameters
after
string
size
integer <int32>
Default: 100

Responses

create_2

Authorizations:
bearerAuth
Request Body schema: application/json
required
name
required
string non-empty
slug
required
string non-empty
parentId
integer <int64>
type
string

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "slug": "string",
  • "parentId": 0,
  • "type": "string"
}

suspend_1

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

activate_1

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

search

Authorizations:
bearerAuth
query Parameters
q
string
Default: ""
status
string
Enum: "ACTIVE" "SUSPENDED"
size
integer <int32>
Default: 50

Responses

application-controller

update_3

Authorizations:
bearerAuth
path Parameters
applicationId
required
integer <int64>
Request Body schema: application/json
required
name
required
string non-empty
webRefreshTtlDays
integer <int32> [ 1 .. 180 ]
deviceRefreshTtlDays
integer <int32> [ 1 .. 180 ]

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "webRefreshTtlDays": 1,
  • "deviceRefreshTtlDays": 1
}

list_5

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>

Responses

create_3

Authorizations:
bearerAuth
Request Body schema: application/json
required
organizationId
required
integer <int64>
identifier
required
string non-empty
name
required
string non-empty
webRefreshTtlDays
integer <int32> [ 1 .. 180 ]
deviceRefreshTtlDays
integer <int32> [ 1 .. 180 ]

Responses

Request samples

Content type
application/json
{
  • "organizationId": 0,
  • "identifier": "string",
  • "name": "string",
  • "webRefreshTtlDays": 1,
  • "deviceRefreshTtlDays": 1
}

listPermissions

Authorizations:
bearerAuth
path Parameters
applicationId
required
integer <int64>

Responses

addPermission

Authorizations:
bearerAuth
path Parameters
applicationId
required
integer <int64>
Request Body schema: application/json
required
code
required
string non-empty
description
string

Responses

Request samples

Content type
application/json
{
  • "code": "string",
  • "description": "string"
}

quota

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>

Responses

deletePermission

Authorizations:
bearerAuth
path Parameters
applicationId
required
integer <int64>
permissionId
required
integer <int64>

Responses

data-subject-controller

eraseUser

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

exportUserData

Authorizations:
bearerAuth
path Parameters
id
required
integer <int64>

Responses

exportOwnData

Authorizations:
bearerAuth

Responses

mfa-setup-controller

confirmSetup

Authorizations:
bearerAuth
Request Body schema: application/json
required
code
required
string non-empty

Responses

Request samples

Content type
application/json
{
  • "code": "string"
}

beginSetup

Authorizations:
bearerAuth

Responses

disable_1

Authorizations:
bearerAuth

Responses

import-controller

validate

Authorizations:
bearerAuth
Request Body schema: application/json
required
rootParentOrgId
integer <int64>
object (NewTenant)
Array of objects (Org)
Array of objects (App)
Array of objects (Perm)
Array of objects (RoleDef)
Array of objects (UserDef)
Array of objects (Assignment)

Responses

Request samples

Content type
application/json
{
  • "rootParentOrgId": 0,
  • "rootTenant": {
    },
  • "organizations": [
    ],
  • "applications": [
    ],
  • "permissions": [
    ],
  • "roles": [
    ],
  • "users": [
    ],
  • "assignments": [
    ]
}

commit

Authorizations:
bearerAuth
Request Body schema: application/json
required
rootParentOrgId
integer <int64>
object (NewTenant)
Array of objects (Org)
Array of objects (App)
Array of objects (Perm)
Array of objects (RoleDef)
Array of objects (UserDef)
Array of objects (Assignment)

Responses

Request samples

Content type
application/json
{
  • "rootParentOrgId": 0,
  • "rootTenant": {
    },
  • "organizations": [
    ],
  • "applications": [
    ],
  • "permissions": [
    ],
  • "roles": [
    ],
  • "users": [
    ],
  • "assignments": [
    ]
}

jobs

Authorizations:
bearerAuth
query Parameters
limit
integer <int32>
Default: 50

Responses

auth-controller

socialLogin

Authorizations:
bearerAuth
path Parameters
provider
required
string
query Parameters
web
boolean
Default: false
Request Body schema: application/json
required
idToken
required
string non-empty
audience
string
object (DeviceInfo)

Responses

Request samples

Content type
application/json
{
  • "idToken": "string",
  • "audience": "string",
  • "device": {
    }
}

refresh

Authorizations:
bearerAuth
Request Body schema: application/json
refreshToken
required
string non-empty
audience
string

Responses

Request samples

Content type
application/json
{
  • "refreshToken": "string",
  • "audience": "string"
}

verifyMfa

Authorizations:
bearerAuth
query Parameters
web
boolean
Default: false
Request Body schema: application/json
required
pendingToken
required
string non-empty
code
required
string non-empty
audience
string
object (DeviceInfo)

Responses

Request samples

Content type
application/json
{
  • "pendingToken": "string",
  • "code": "string",
  • "audience": "string",
  • "device": {
    }
}

logout

Authorizations:
bearerAuth
Request Body schema: application/json
refreshToken
required
string non-empty

Responses

Request samples

Content type
application/json
{
  • "refreshToken": "string"
}

login

Authorizations:
bearerAuth
query Parameters
web
boolean
Default: false
Request Body schema: application/json
required
email
required
string non-empty
password
required
string non-empty
audience
string
object (DeviceInfo)

Responses

Request samples

Content type
application/json
{
  • "email": "string",
  • "password": "string",
  • "audience": "string",
  • "device": {
    }
}

password-controller

reset

Authorizations:
bearerAuth
Request Body schema: application/json
required
token
required
string non-empty
newPassword
required
string [ 8 .. 200 ] characters

Responses

Request samples

Content type
application/json
{
  • "token": "string",
  • "newPassword": "stringst"
}

forgot

Authorizations:
bearerAuth
Request Body schema: application/json
required
email
required
string non-empty

Responses

Request samples

Content type
application/json
{
  • "email": "string"
}

device-controller

myDevices

Authorizations:
bearerAuth

Responses

revoke_1

Authorizations:
bearerAuth
path Parameters
deviceId
required
string

Responses

tenant-hierarchy-controller

visibleOrgs

Authorizations:
bearerAuth
path Parameters
parentOrgId
required
integer <int64>
query Parameters
after
string
size
integer <int32>
Default: 100

Responses

audit-controller

list_6

Authorizations:
bearerAuth
query Parameters
organizationId
required
integer <int64>
action
string
userId
integer <int64>
q
string
from
string <date-time>
to
string <date-time>
size
integer <int32>
Default: 100

Responses

OAuth2 (machine tokens)

Exchange client credentials for an access token

The client_credentials grant. Authenticate with HTTP Basic using the clientId as username and the client secret as password, and post grant_type=client_credentials. Returns a short-lived access token whose sub/aud is the client id and which carries the client's org_id and tenant_id. No uid, no user permissions.

Authorizations:
clientBasicAuth
Request Body schema: application/x-www-form-urlencoded
required
grant_type
required
string
Default: "client_credentials"

Must be client_credentials for machine-to-machine.

scope
string

Optional. Space-separated, a subset of the client's registered scopes. Omit to receive all of them.

Responses

Response samples

Content type
application/json
{
  • "access_token": "string",
  • "token_type": "Bearer",
  • "expires_in": 0,
  • "scope": "string"
}