authorizer

package module
v0.0.0-...-51768c5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 23, 2026 License: Apache-2.0 Imports: 20 Imported by: 0

README

authorizer-go

Go SDK for authorizer.dev — self-hosted authentication & authorization. Current version: 2.0.0.

Use this SDK to add auth middleware to your Go services and to call any Authorizer API method. For full API docs see pkg.go.dev/github.com/authorizerdev/authorizer-go.

Getting Started

Pre-requisite: A running Authorizer instance. See the deployment guide.

Once deployed, get your Client ID from the Authorizer dashboard.

Step 1: Install the SDK
go get github.com/authorizerdev/authorizer-go
Step 2: Initialize the client

Parameters

Key Type Required Description
clientID string Yes Client ID from the Authorizer dashboard
authorizerURL string Yes Base URL of your Authorizer instance
redirectURL string No Default redirect URL for signup / login / forgot-password flows
extraHeaders map[string]string No Headers sent on every request (e.g. Origin)

Example

package main

import (
    authorizer "github.com/authorizerdev/authorizer-go"
)

func main() {
    client, err := authorizer.NewAuthorizerClient(
        "YOUR_CLIENT_ID",
        "https://your-instance.example.com",
        "https://your-app.example.com", // optional redirect URL
        map[string]string{},
    )
    if err != nil {
        panic(err)
    }
    _ = client
}

Note (Authorizer >= v2.3.0): the server's CSRF guard requires an Origin header on state-changing requests. The client sends the Authorizer server's own origin by default, which always passes. If your instance restricts ALLOWED_ORIGINS, pass your app's origin instead via extraHeaders: map[string]string{"Origin": "https://your-app.com"}.

Step 3: Use the SDK
response, err := client.Login(&authorizer.LoginInput{
    Email:    "user@example.com",
    Password: "Abc@123",
})
if err != nil {
    panic(err)
}
fmt.Println("access_token:", response.AccessToken)

Admin API

The SDK exposes admin methods for server-side user management. Admin operations require the admin secret; supply it via extraHeaders:

adminClient, err := authorizer.NewAuthorizerClient(
    "YOUR_CLIENT_ID",
    "https://your-instance.example.com",
    "",
    map[string]string{"x-authorizer-admin-secret": "YOUR_ADMIN_SECRET"},
)

See admin_methods.go for the full list of available admin operations.

Fine-grained authorization (FGA)

Authorizer ships an embedded OpenFGA engine for relationship-based access control (ReBAC). You model your domain as object types with relations (viewer, editor, owner…), grant access by writing relationship tuples, and ask the engine whether access is allowed.

Authoring the model and tuples is an admin task — do it once in the dashboard under Authorization, or via the _fga_* admin GraphQL API. The SDK exposes only the read-side checks an application needs at request time. The subject defaults to the authenticated caller and is pinned server-side from the request headers. The optional User field overrides the subject but is honored only for super-admins or when it equals the caller's own token subject.

Check permissions — evaluates one or more relation checks in a single round trip:

res, err := client.CheckPermissions(&authorizer.CheckPermissionsRequest{
    Checks: []*authorizer.PermissionCheckInput{
        {Relation: "can_view", Object: "document:1"},
        {Relation: "can_edit", Object: "document:1"},
    },
}, map[string]string{
    "Authorization": "Bearer " + token,
})
if err != nil {
    panic(err)
}
for _, r := range res.Results {
    fmt.Println(r.Relation, r.Object, r.Allowed)
}

List accessible objects — returns the ids of every object of a type the caller holds a relation on:

res, err := client.ListPermissions(&authorizer.ListPermissionsRequest{
    Relation:   "can_view",
    ObjectType: "document",
}, map[string]string{"Authorization": "Bearer " + token})
if err != nil {
    panic(err)
}
fmt.Println(res.Objects) // ["document:1", "document:7", ...]

API gateway example (gin)

package main

import (
    "net/http"
    "strings"

    authorizer "github.com/authorizerdev/authorizer-go"
    "github.com/gin-gonic/gin"
)

func AuthorizeMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        authHeader := c.Request.Header.Get("Authorization")
        tokenSplit := strings.Split(authHeader, " ")

        client, err := authorizer.NewAuthorizerClient(
            "YOUR_CLIENT_ID",
            "YOUR_AUTHORIZER_URL",
            "",
            map[string]string{},
        )
        if err != nil || len(tokenSplit) < 2 || tokenSplit[1] == "" {
            c.AbortWithStatusJSON(401, "unauthorized")
            return
        }

        res, err := client.ValidateJWTToken(&authorizer.ValidateJWTTokenInput{
            TokenType: authorizer.TokenTypeIDToken,
            Token:     tokenSplit[1],
        })
        if err != nil || !res.IsValid {
            c.AbortWithStatusJSON(401, "unauthorized")
            return
        }

        c.Next()
    }
}

func main() {
    router := gin.New()
    router.Use(AuthorizeMiddleware())

    router.GET("/ping", func(c *gin.Context) {
        c.JSON(http.StatusOK, gin.H{"message": "pong"})
    })

    router.Run(":8090")
}

Test the protected endpoint:

curl -H 'Authorization: Bearer JWT_TOKEN' http://localhost:8090/ping

Release

  1. Tag the commit: git tag v<version>
  2. Push with tags: git push origin main --tags

The GitHub Actions release workflow handles the GitHub Release creation automatically. Go modules are versioned by tags — no additional publish step is needed.

Documentation

Overview

Package authorizer provides client and methods using which you can perform various graphql operations to your authorizer instance

Index

Constants

View Source 
const (
	// GrantTypeAuthorizationCode is used for authorization_code grant type
	GrantTypeAuthorizationCode = "authorization_code"

	// GrantTypeRefreshToken is used for refresh_token grant type
	GrantTypeRefreshToken = "refresh_token"

	// GrantTypeClientCredentials is used for the client_credentials grant type
	// (machine-to-machine tokens for registered clients / service accounts).
	GrantTypeClientCredentials = "client_credentials"

	// GrantTypeTokenExchange is the RFC 8693 token-exchange grant type
	// (delegation / impersonation via subject_token + optional actor_token).
	GrantTypeTokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange"

	// UserFragment defines graphql fragment for all the user attributes
	UserFragment = `` /* 307-byte string literal not displayed */

)

Variables

View Source 
var AuthTokenResponseFragment = fmt.Sprintf(`message access_token expires_in refresh_token id_token should_show_email_otp_screen should_show_mobile_otp_screen should_show_totp_screen should_offer_webauthn_mfa_verify should_offer_webauthn_mfa_setup should_offer_email_otp_mfa_setup should_offer_sms_otp_mfa_setup authenticator_scanner_image authenticator_secret authenticator_recovery_codes user { 	%s }`, UserFragment)

AuthTokenResponseFragment defines graphql response for auth token type, which is common across various authorizer operations

Functions

func CreateRandomString 

func CreateRandomString() string

CreateRandomString returns a random string 43 characters

func EncodeB64 

func EncodeB64(message string) string

EncodeB64 returns string which is base64 encoded

func NewStringRef 

func NewStringRef(v string) *string

NewStringRef returns a reference to a string with given value

func StringValue 

func StringValue(r *string, defaultValue ...string) string

StringValue returns the value of the given string ref

Types

type AddOrgMemberRequest 

type AddOrgMemberRequest struct {
	OrgID  string   `json:"org_id"`
	UserID string   `json:"user_id"`
	Roles  []string `json:"roles,omitempty"`
}

AddOrgMemberRequest is the request for AddOrgMember. Roles defaults to an empty set when omitted.

type AddVerifiedOrgDomainRequest 

type AddVerifiedOrgDomainRequest struct {
	OrgID  string `json:"org_id"`
	Domain string `json:"domain"`
}

AddVerifiedOrgDomainRequest is the request for AddVerifiedOrgDomain.

type AdminClientOption 

type AdminClientOption func(*AuthorizerAdminClient)

AdminClientOption customizes an AuthorizerAdminClient at construction time.

func WithAdminExtraHeaders 

func WithAdminExtraHeaders(headers map[string]string) AdminClientOption

WithAdminExtraHeaders sets default headers added to every admin HTTP request.

func WithAdminGRPCEndpoint 

func WithAdminGRPCEndpoint(addr string) AdminClientOption

WithAdminGRPCEndpoint sets the host:port dialed for grpc calls. The authorizer server's gRPC listener runs on its own port (default 9091), separate from the HTTP port in AuthorizerURL. When unset, the endpoint is derived from AuthorizerURL's host with the default gRPC port (9091).

func WithAdminProtocol 

func WithAdminProtocol(p Protocol) AdminClientOption

WithAdminProtocol sets the wire transport the admin client uses.

type AdminSignupRequest 

type AdminSignupRequest struct {
	AdminSecret string `json:"admin_secret"`
}

AdminSignupRequest is the request for AdminSignup.

type AuthTokenResponse 

type AuthTokenResponse struct {
	Message                   *string `json:"message,omitempty"`
	AccessToken               *string `json:"access_token,omitempty"`
	ExpiresIn                 *int64  `json:"expires_in,omitempty"`
	IdToken                   *string `json:"id_token,omitempty"`
	RefreshToken              *string `json:"refresh_token,omitempty"`
	ShouldShowEmailOtpScreen  *bool   `json:"should_show_email_otp_screen"`
	ShouldShowMobileOtpScreen *bool   `json:"should_show_mobile_otp_screen"`
	ShouldShowTotpScreen      *bool   `json:"should_show_totp_screen"`
	// ShouldOfferWebauthnMfaVerify is true when the authenticated-with-password
	// user has a registered passkey and MFA verification (not enrollment) is
	// required before a token is issued.
	ShouldOfferWebauthnMfaVerify *bool `json:"should_offer_webauthn_mfa_verify"`
	// ShouldOfferWebauthnMfaSetup / ShouldOfferEmailOtpMfaSetup /
	// ShouldOfferSmsOtpMfaSetup are true, alongside ShouldShowTotpScreen, when
	// this is a first-time optional-MFA offer and that method is available.
	// AccessToken is NOT populated alongside these flags; it is withheld until
	// the user completes a method or skips (see SkipMfaSetup).
	ShouldOfferWebauthnMfaSetup *bool     `json:"should_offer_webauthn_mfa_setup"`
	ShouldOfferEmailOtpMfaSetup *bool     `json:"should_offer_email_otp_mfa_setup"`
	ShouldOfferSmsOtpMfaSetup   *bool     `json:"should_offer_sms_otp_mfa_setup"`
	AuthenticatorScannerImage   *string   `json:"authenticator_scanner_image"`
	AuthenticatorSecret         *string   `json:"authenticator_secret"`
	AuthenticatorRecoveryCodes  []*string `json:"authenticator_recovery_codes"`
	User                        *User     `json:"user,omitempty"`
}

AuthTokenResponse defines attribute for auth token response, which is common across various authorizer operations

type AuthorizerAdminClient 

type AuthorizerAdminClient struct {
	AuthorizerURL string
	AdminSecret   string
	ExtraHeaders  map[string]string
	// Protocol selects the wire transport. Defaults to ProtocolGraphQL.
	Protocol Protocol
	// GRPCEndpoint overrides the host:port dialed when Protocol is grpc. When
	// empty it is derived from AuthorizerURL using the gRPC default port.
	GRPCEndpoint string
}

AuthorizerAdminClient is the admin surface of the SDK. It mirrors the AuthorizerAdminService proto and carries the admin secret plus the selected wire protocol. The request/response types are the generated proto messages (authorizerv1.*), the canonical signatures shared across all three SDKs.

func NewAuthorizerAdminClient 

func NewAuthorizerAdminClient(authorizerURL, adminSecret string, opts ...AdminClientOption) (*AuthorizerAdminClient, error)

NewAuthorizerAdminClient creates an admin client instance authenticated with the admin secret. Default protocol is graphql; override with WithAdminProtocol.

func (*AuthorizerAdminClient) AddEmailTemplate 

func (c *AuthorizerAdminClient) AddEmailTemplate(req *authorizerv1.AddEmailTemplateRequest) (*authorizerv1.AddEmailTemplateResponse, error)

AddEmailTemplate creates a new email template.

func (*AuthorizerAdminClient) AddOrgMember 

func (c *AuthorizerAdminClient) AddOrgMember(req *AddOrgMemberRequest) (*OrgMember, error)

AddOrgMember adds a user to an organization (gql only).

func (*AuthorizerAdminClient) AddTrustedIssuer 

func (c *AuthorizerAdminClient) AddTrustedIssuer(req *authorizerv1.AddTrustedIssuerRequest) (*authorizerv1.AddTrustedIssuerResponse, error)

AddTrustedIssuer registers an external token issuer (K8s SA, SPIFFE, OIDC) that may authenticate as the given service account via JWT-bearer assertions.

func (*AuthorizerAdminClient) AddVerifiedOrgDomain 

func (c *AuthorizerAdminClient) AddVerifiedOrgDomain(req *AddVerifiedOrgDomainRequest) (*OrgDomain, error)

AddVerifiedOrgDomain directly registers a verified domain, bypassing the DNS TXT challenge. Super-admin only (gql only).

func (*AuthorizerAdminClient) AddWebhook 

func (c *AuthorizerAdminClient) AddWebhook(req *authorizerv1.AddWebhookRequest) (*authorizerv1.AddWebhookResponse, error)

AddWebhook registers a new webhook endpoint.

func (*AuthorizerAdminClient) AdminLogin 

func (c *AuthorizerAdminClient) AdminLogin(req *authorizerv1.AdminLoginRequest) (*Response, error)

AdminLogin validates the admin secret and establishes an admin session.

func (*AuthorizerAdminClient) AdminLogout 

func (c *AuthorizerAdminClient) AdminLogout() (*authorizerv1.AdminLogoutResponse, error)

AdminLogout clears the admin session.

func (*AuthorizerAdminClient) AdminMeta 

func (c *AuthorizerAdminClient) AdminMeta() (*authorizerv1.AdminMetaResponse, error)

AdminMeta returns admin-only configuration metadata (roles, default roles, protected roles).

func (*AuthorizerAdminClient) AdminSession 

func (c *AuthorizerAdminClient) AdminSession() (*authorizerv1.AdminSessionResponse, error)

AdminSession refreshes the admin session.

func (*AuthorizerAdminClient) AdminSignup 

func (c *AuthorizerAdminClient) AdminSignup(req *AdminSignupRequest) (*Response, error)

AdminSignup sets the admin secret for a fresh instance (gql only).

func (*AuthorizerAdminClient) AuditLogs 

func (c *AuthorizerAdminClient) AuditLogs(req *authorizerv1.AuditLogsRequest) (*authorizerv1.AuditLogsResponse, error)

AuditLogs returns a paginated list of audit log entries.

func (*AuthorizerAdminClient) Clients 

func (c *AuthorizerAdminClient) Clients(req *authorizerv1.ClientsRequest) (*authorizerv1.ClientsResponse, error)

Clients returns a paginated list of clients.

func (*AuthorizerAdminClient) CreateClient 

func (c *AuthorizerAdminClient) CreateClient(req *authorizerv1.CreateClientRequest) (*authorizerv1.CreateClientResponse, error)

CreateClient provisions a new machine/workload identity (service account). The client_secret in the response is returned ONCE and can never be retrieved again.

func (*AuthorizerAdminClient) CreateOrgOIDCConnection 

func (c *AuthorizerAdminClient) CreateOrgOIDCConnection(req *CreateOrgOIDCConnectionRequest) (*OrgOIDCConnection, error)

CreateOrgOIDCConnection creates an org OIDC SSO connection (gql only).

func (*AuthorizerAdminClient) CreateOrgSAMLConnection 

func (c *AuthorizerAdminClient) CreateOrgSAMLConnection(req *CreateOrgSAMLConnectionRequest) (*OrgSAMLConnection, error)

CreateOrgSAMLConnection creates an org SAML SSO connection (gql only).

func (*AuthorizerAdminClient) CreateOrganization 

func (c *AuthorizerAdminClient) CreateOrganization(req *CreateOrganizationRequest) (*Organization, error)

CreateOrganization creates an organization (gql only).

func (*AuthorizerAdminClient) CreateSamlServiceProvider 

func (c *AuthorizerAdminClient) CreateSamlServiceProvider(req *authorizerv1.CreateSamlServiceProviderRequest) (*authorizerv1.CreateSamlServiceProviderResponse, error)

CreateSamlServiceProvider registers a downstream SAML 2.0 SP that Authorizer (acting as the IdP) issues signed assertions to.

func (*AuthorizerAdminClient) CreateScimEndpoint 

func (c *AuthorizerAdminClient) CreateScimEndpoint(req *CreateScimEndpointRequest) (*CreateScimEndpointResponse, error)

CreateScimEndpoint provisions a SCIM endpoint for an organization (gql only).

func (*AuthorizerAdminClient) DeleteClient 

func (c *AuthorizerAdminClient) DeleteClient(req *authorizerv1.DeleteClientRequest) (*authorizerv1.DeleteClientResponse, error)

DeleteClient deletes a client. DESTRUCTIVE: permanently removes the client; tokens already issued to it stop being honoured.

func (*AuthorizerAdminClient) DeleteEmailTemplate 

func (c *AuthorizerAdminClient) DeleteEmailTemplate(req *authorizerv1.DeleteEmailTemplateRequest) (*authorizerv1.DeleteEmailTemplateResponse, error)

DeleteEmailTemplate deletes an email template. DESTRUCTIVE: permanently removes the template.

func (*AuthorizerAdminClient) DeleteOrgDomain 

func (c *AuthorizerAdminClient) DeleteOrgDomain(req *DeleteOrgDomainRequest) (*Response, error)

DeleteOrgDomain removes a verified domain (gql only). DESTRUCTIVE: logins relying on this domain for home-realm discovery stop resolving to the org.

func (*AuthorizerAdminClient) DeleteOrgOIDCConnection 

func (c *AuthorizerAdminClient) DeleteOrgOIDCConnection(req *OrgOIDCConnectionRequest) (*Response, error)

DeleteOrgOIDCConnection deletes an org OIDC SSO connection (gql only). DESTRUCTIVE: SSO logins through this connection stop working immediately.

func (*AuthorizerAdminClient) DeleteOrgSAMLConnection 

func (c *AuthorizerAdminClient) DeleteOrgSAMLConnection(req *OrgSAMLConnectionRequest) (*Response, error)

DeleteOrgSAMLConnection deletes an org SAML SSO connection (gql only). DESTRUCTIVE: SSO logins through this connection stop working immediately.

func (*AuthorizerAdminClient) DeleteOrganization 

func (c *AuthorizerAdminClient) DeleteOrganization(req *OrganizationRequest) (*Response, error)

DeleteOrganization deletes an organization (gql only). DESTRUCTIVE: permanently removes the organization and its memberships/connections.

func (*AuthorizerAdminClient) DeleteSamlServiceProvider 

func (c *AuthorizerAdminClient) DeleteSamlServiceProvider(req *authorizerv1.DeleteSamlServiceProviderRequest) (*authorizerv1.DeleteSamlServiceProviderResponse, error)

DeleteSamlServiceProvider deletes a downstream SP by id. DESTRUCTIVE: SSO assertions to this SP stop being issued immediately.

func (*AuthorizerAdminClient) DeleteScimEndpoint 

func (c *AuthorizerAdminClient) DeleteScimEndpoint(req *ScimEndpointRequest) (*Response, error)

DeleteScimEndpoint deletes an organization's SCIM endpoint (gql only). DESTRUCTIVE: the IdP's provisioning token stops working immediately.

func (*AuthorizerAdminClient) DeleteTrustedIssuer 

func (c *AuthorizerAdminClient) DeleteTrustedIssuer(req *authorizerv1.DeleteTrustedIssuerRequest) (*authorizerv1.DeleteTrustedIssuerResponse, error)

DeleteTrustedIssuer removes a trusted issuer. DESTRUCTIVE: assertions from this issuer stop authenticating immediately.

func (*AuthorizerAdminClient) DeleteUser 

func (c *AuthorizerAdminClient) DeleteUser(req *authorizerv1.DeleteUserRequest) (*authorizerv1.DeleteUserResponse, error)

DeleteUser deletes a user. DESTRUCTIVE: permanently removes the user account.

func (*AuthorizerAdminClient) DeleteWebhook 

func (c *AuthorizerAdminClient) DeleteWebhook(req *authorizerv1.DeleteWebhookRequest) (*authorizerv1.DeleteWebhookResponse, error)

DeleteWebhook deletes a webhook. DESTRUCTIVE: permanently removes the webhook and its logs.

func (*AuthorizerAdminClient) EmailTemplates 

func (c *AuthorizerAdminClient) EmailTemplates(req *authorizerv1.EmailTemplatesRequest) (*authorizerv1.EmailTemplatesResponse, error)

EmailTemplates returns a paginated list of email templates.

func (*AuthorizerAdminClient) EnableAccess 

func (c *AuthorizerAdminClient) EnableAccess(req *authorizerv1.EnableAccessRequest) (*authorizerv1.EnableAccessResponse, error)

EnableAccess re-enables a previously revoked user's access.

func (*AuthorizerAdminClient) FgaDeleteTuples 

func (c *AuthorizerAdminClient) FgaDeleteTuples(req *authorizerv1.FgaDeleteTuplesRequest) (*authorizerv1.FgaDeleteTuplesResponse, error)

FgaDeleteTuples deletes relationship tuples from the authorization store. DESTRUCTIVE: permanently removes the specified tuples.

func (*AuthorizerAdminClient) FgaExpand 

func (c *AuthorizerAdminClient) FgaExpand(req *authorizerv1.FgaExpandRequest) (*authorizerv1.FgaExpandResponse, error)

FgaExpand expands the relationship tree for a given object and relation.

func (*AuthorizerAdminClient) FgaGetModel 

func (c *AuthorizerAdminClient) FgaGetModel() (*authorizerv1.FgaGetModelResponse, error)

FgaGetModel returns the active fine-grained authorization model as DSL.

func (*AuthorizerAdminClient) FgaListUsers 

func (c *AuthorizerAdminClient) FgaListUsers(req *authorizerv1.FgaListUsersRequest) (*authorizerv1.FgaListUsersResponse, error)

FgaListUsers lists users that have a given relation to an object.

func (*AuthorizerAdminClient) FgaReadTuples 

func (c *AuthorizerAdminClient) FgaReadTuples(req *authorizerv1.FgaReadTuplesRequest) (*authorizerv1.FgaReadTuplesResponse, error)

FgaReadTuples reads relationship tuples from the authorization store.

func (*AuthorizerAdminClient) FgaReset 

func (c *AuthorizerAdminClient) FgaReset() (*authorizerv1.FgaResetResponse, error)

FgaReset deletes the entire fine-grained authorization store. DESTRUCTIVE: permanently removes the model and all relationship tuples.

func (*AuthorizerAdminClient) FgaWriteModel 

func (c *AuthorizerAdminClient) FgaWriteModel(req *authorizerv1.FgaWriteModelRequest) (*authorizerv1.FgaWriteModelResponse, error)

FgaWriteModel replaces the fine-grained authorization model. DESTRUCTIVE: overwrites the existing authorization model.

func (*AuthorizerAdminClient) FgaWriteTuples 

func (c *AuthorizerAdminClient) FgaWriteTuples(req *authorizerv1.FgaWriteTuplesRequest) (*authorizerv1.FgaWriteTuplesResponse, error)

FgaWriteTuples writes relationship tuples to the authorization store.

func (*AuthorizerAdminClient) GenerateJWTKeys 

func (c *AuthorizerAdminClient) GenerateJWTKeys(req *GenerateJWTKeysRequest) (*GenerateJWTKeysResponse, error)

GenerateJWTKeys generates a new set of JWT signing keys (gql only).

func (*AuthorizerAdminClient) GetClient 

func (c *AuthorizerAdminClient) GetClient(req *authorizerv1.GetClientRequest) (*authorizerv1.GetClientResponse, error)

GetClient returns a single client by id. The client_secret is never returned.

func (*AuthorizerAdminClient) GetOrgOIDCConnection 

func (c *AuthorizerAdminClient) GetOrgOIDCConnection(req *OrgOIDCConnectionRequest) (*OrgOIDCConnection, error)

GetOrgOIDCConnection returns an org OIDC SSO connection by id or org id (gql only).

func (*AuthorizerAdminClient) GetOrgSAMLConnection 

func (c *AuthorizerAdminClient) GetOrgSAMLConnection(req *OrgSAMLConnectionRequest) (*OrgSAMLConnection, error)

GetOrgSAMLConnection returns an org SAML SSO connection by id or org id (gql only).

func (*AuthorizerAdminClient) GetOrganization 

func (c *AuthorizerAdminClient) GetOrganization(req *OrganizationRequest) (*Organization, error)

GetOrganization returns a single organization by id (gql only).

func (*AuthorizerAdminClient) GetSamlServiceProvider 

func (c *AuthorizerAdminClient) GetSamlServiceProvider(req *authorizerv1.GetSamlServiceProviderRequest) (*authorizerv1.GetSamlServiceProviderResponse, error)

GetSamlServiceProvider returns a single downstream SP by id.

func (*AuthorizerAdminClient) GetScimEndpoint 

func (c *AuthorizerAdminClient) GetScimEndpoint(req *ScimEndpointRequest) (*ScimEndpoint, error)

GetScimEndpoint returns an organization's SCIM endpoint (gql only). The bearer token is never returned.

func (*AuthorizerAdminClient) GetTrustedIssuer 

func (c *AuthorizerAdminClient) GetTrustedIssuer(req *authorizerv1.GetTrustedIssuerRequest) (*authorizerv1.GetTrustedIssuerResponse, error)

GetTrustedIssuer returns a single trusted issuer by id.

func (*AuthorizerAdminClient) GetWebhook 

func (c *AuthorizerAdminClient) GetWebhook(req *authorizerv1.GetWebhookRequest) (*authorizerv1.GetWebhookResponse, error)

GetWebhook returns a single webhook by id.

func (*AuthorizerAdminClient) ImportSamlSpMetadata 

func (c *AuthorizerAdminClient) ImportSamlSpMetadata(req *authorizerv1.ImportSamlSpMetadataRequest) (*authorizerv1.ImportSamlSpMetadataResponse, error)

ImportSamlSpMetadata parses pasted SP metadata XML and returns the fields to prefill a create call. It does NOT create a record and performs no remote fetch.

func (*AuthorizerAdminClient) InviteMembers 

func (c *AuthorizerAdminClient) InviteMembers(req *authorizerv1.InviteMembersRequest) (*authorizerv1.InviteMembersResponse, error)

InviteMembers sends invitations to one or more email addresses.

func (*AuthorizerAdminClient) ListSamlIdpKeys 

func (c *AuthorizerAdminClient) ListSamlIdpKeys(req *authorizerv1.ListSamlIdpKeysRequest) (*authorizerv1.ListSamlIdpKeysResponse, error)

ListSamlIdpKeys returns all SAML IdP signing keys for an org.

func (*AuthorizerAdminClient) ListSamlServiceProviders 

func (c *AuthorizerAdminClient) ListSamlServiceProviders(req *authorizerv1.ListSamlServiceProvidersRequest) (*authorizerv1.ListSamlServiceProvidersResponse, error)

ListSamlServiceProviders returns a paginated list of downstream SPs for an org.

func (*AuthorizerAdminClient) OrgDomains 

func (c *AuthorizerAdminClient) OrgDomains(req *ListOrgDomainsRequest) (*OrgDomains, error)

OrgDomains returns an organization's verified domains (gql only).

func (*AuthorizerAdminClient) OrgMembers 

func (c *AuthorizerAdminClient) OrgMembers(req *ListOrgMembersRequest) (*OrgMembers, error)

OrgMembers returns a paginated list of an organization's members (gql only).

func (*AuthorizerAdminClient) Organizations 

func (c *AuthorizerAdminClient) Organizations(req *ListOrganizationsRequest) (*Organizations, error)

Organizations returns a paginated list of organizations (gql only).

func (*AuthorizerAdminClient) RemoveOrgMember 

func (c *AuthorizerAdminClient) RemoveOrgMember(req *RemoveOrgMemberRequest) (*Response, error)

RemoveOrgMember removes a user from an organization (gql only).

func (*AuthorizerAdminClient) RequestOrgDomain 

func (c *AuthorizerAdminClient) RequestOrgDomain(req *RequestOrgDomainRequest) (*OrgDomainChallenge, error)

RequestOrgDomain starts domain verification for home-realm discovery, returning the DNS TXT record the tenant must publish to prove control of the domain (gql only).

func (*AuthorizerAdminClient) RetireSamlIdpKey 

func (c *AuthorizerAdminClient) RetireSamlIdpKey(req *authorizerv1.RetireSamlIdpKeyRequest) (*authorizerv1.RetireSamlIdpKeyResponse, error)

RetireSamlIdpKey retires a published-but-not-signing SAML IdP key by id. DESTRUCTIVE: the key stops being published in IdP metadata.

func (*AuthorizerAdminClient) RevokeAccess 

func (c *AuthorizerAdminClient) RevokeAccess(req *authorizerv1.RevokeAccessRequest) (*authorizerv1.RevokeAccessResponse, error)

RevokeAccess revokes a user's access to the application.

func (*AuthorizerAdminClient) RotateClientSecret 

func (c *AuthorizerAdminClient) RotateClientSecret(req *authorizerv1.RotateClientSecretRequest) (*authorizerv1.CreateClientResponse, error)

RotateClientSecret issues a new secret for a client. The new secret is returned ONCE; the old secret keeps validating during the server's grace window.

func (*AuthorizerAdminClient) RotateSamlIdpCert 

func (c *AuthorizerAdminClient) RotateSamlIdpCert(req *authorizerv1.RotateSamlIdpCertRequest) (*authorizerv1.RotateSamlIdpCertResponse, error)

RotateSamlIdpCert generates a new current signing keypair for an org's SAML IdP, demoting the previous current key.

func (*AuthorizerAdminClient) RotateScimToken 

func (c *AuthorizerAdminClient) RotateScimToken(req *ScimEndpointRequest) (*CreateScimEndpointResponse, error)

RotateScimToken rotates the SCIM endpoint's bearer token (gql only). The new token is returned ONCE; the old token stops validating.

func (*AuthorizerAdminClient) TestEndpoint 

func (c *AuthorizerAdminClient) TestEndpoint(req *authorizerv1.TestEndpointRequest) (*authorizerv1.TestEndpointResponse, error)

TestEndpoint sends a test event to a webhook endpoint.

func (*AuthorizerAdminClient) TrustedIssuers 

func (c *AuthorizerAdminClient) TrustedIssuers(req *authorizerv1.TrustedIssuersRequest) (*authorizerv1.TrustedIssuersResponse, error)

TrustedIssuers returns a paginated list of trusted issuers, optionally filtered by service account.

func (*AuthorizerAdminClient) UpdateClient 

func (c *AuthorizerAdminClient) UpdateClient(req *authorizerv1.UpdateClientRequest) (*authorizerv1.UpdateClientResponse, error)

UpdateClient updates an existing client's metadata, scopes or active flag.

func (*AuthorizerAdminClient) UpdateEmailTemplate 

func (c *AuthorizerAdminClient) UpdateEmailTemplate(req *authorizerv1.UpdateEmailTemplateRequest) (*authorizerv1.UpdateEmailTemplateResponse, error)

UpdateEmailTemplate updates an existing email template.

func (*AuthorizerAdminClient) UpdateEnv 

func (c *AuthorizerAdminClient) UpdateEnv(req *UpdateEnvRequest) (*Response, error)

UpdateEnv updates the instance environment configuration (gql only).

func (*AuthorizerAdminClient) UpdateOrgOIDCConnection 

func (c *AuthorizerAdminClient) UpdateOrgOIDCConnection(req *UpdateOrgOIDCConnectionRequest) (*OrgOIDCConnection, error)

UpdateOrgOIDCConnection updates an org OIDC SSO connection (gql only).

func (*AuthorizerAdminClient) UpdateOrgSAMLConnection 

func (c *AuthorizerAdminClient) UpdateOrgSAMLConnection(req *UpdateOrgSAMLConnectionRequest) (*OrgSAMLConnection, error)

UpdateOrgSAMLConnection updates an org SAML SSO connection (gql only).

func (*AuthorizerAdminClient) UpdateOrganization 

func (c *AuthorizerAdminClient) UpdateOrganization(req *UpdateOrganizationRequest) (*Organization, error)

UpdateOrganization updates an organization (gql only).

func (*AuthorizerAdminClient) UpdateSamlServiceProvider 

func (c *AuthorizerAdminClient) UpdateSamlServiceProvider(req *authorizerv1.UpdateSamlServiceProviderRequest) (*authorizerv1.UpdateSamlServiceProviderResponse, error)

UpdateSamlServiceProvider updates a downstream SP's name, endpoints, certificate, attribute mapping, or active state.

func (*AuthorizerAdminClient) UpdateTrustedIssuer 

func (c *AuthorizerAdminClient) UpdateTrustedIssuer(req *authorizerv1.UpdateTrustedIssuerRequest) (*authorizerv1.UpdateTrustedIssuerResponse, error)

UpdateTrustedIssuer updates an existing trusted issuer.

func (*AuthorizerAdminClient) UpdateUser 

func (c *AuthorizerAdminClient) UpdateUser(req *authorizerv1.UpdateUserRequest) (*authorizerv1.UpdateUserResponse, error)

UpdateUser updates an existing user.

func (*AuthorizerAdminClient) UpdateWebhook 

func (c *AuthorizerAdminClient) UpdateWebhook(req *authorizerv1.UpdateWebhookRequest) (*authorizerv1.UpdateWebhookResponse, error)

UpdateWebhook updates an existing webhook.

func (*AuthorizerAdminClient) User 

func (c *AuthorizerAdminClient) User(req *authorizerv1.UserRequest) (*authorizerv1.UserResponse, error)

User returns a single user by id or email.

func (*AuthorizerAdminClient) UserOrganizations 

func (c *AuthorizerAdminClient) UserOrganizations(req *UserOrganizationsRequest) (*UserOrganizations, error)

UserOrganizations returns the organizations a user belongs to, with the roles held per org (gql only).

func (*AuthorizerAdminClient) Users 

func (c *AuthorizerAdminClient) Users(req *authorizerv1.UsersRequest) (*authorizerv1.UsersResponse, error)

Users returns a paginated list of users.

func (*AuthorizerAdminClient) VerificationRequests 

func (c *AuthorizerAdminClient) VerificationRequests(req *authorizerv1.VerificationRequestsRequest) (*authorizerv1.VerificationRequestsResponse, error)

VerificationRequests returns a paginated list of pending verification requests.

func (*AuthorizerAdminClient) VerifyOrgDomain 

func (c *AuthorizerAdminClient) VerifyOrgDomain(req *VerifyOrgDomainRequest) (*OrgDomain, error)

VerifyOrgDomain checks the DNS TXT challenge and, if satisfied, verifies the domain (gql only).

func (*AuthorizerAdminClient) WebhookLogs 

func (c *AuthorizerAdminClient) WebhookLogs(req *authorizerv1.WebhookLogsRequest) (*authorizerv1.WebhookLogsResponse, error)

WebhookLogs returns a paginated list of webhook delivery logs.

func (*AuthorizerAdminClient) Webhooks 

func (c *AuthorizerAdminClient) Webhooks(req *authorizerv1.WebhooksRequest) (*authorizerv1.WebhooksResponse, error)

Webhooks returns a paginated list of webhooks.

type AuthorizerClient 

type AuthorizerClient struct {
	ClientID      string
	AuthorizerURL string
	RedirectURL   string
	ExtraHeaders  map[string]string
	// Protocol selects the wire transport (graphql, rest or grpc). Defaults to
	// ProtocolGraphQL when unset, keeping the SDK backward compatible.
	Protocol Protocol
	// GRPCEndpoint overrides the host:port dialed when Protocol is grpc. When
	// empty it is derived from AuthorizerURL using the gRPC default port.
	GRPCEndpoint string
}

AuthorizerClient defines the attributes required to initiate authorizer client

func NewAuthorizerClient 

func NewAuthorizerClient(clientID, authorizerURL, redirectURL string, extraHeaders map[string]string, opts ...ClientOption) (*AuthorizerClient, error)

NewAuthorizerClient creates an authorizer client instance. It returns reference to authorizer client instance or error. The optional functional options (e.g. WithProtocol) tweak behavior while keeping the original positional signature backward compatible.

func (*AuthorizerClient) CheckPermissions 

func (c *AuthorizerClient) CheckPermissions(req *CheckPermissionsRequest, headers map[string]string) (*CheckPermissionsResponse, error)

CheckPermissions performs the check_permissions query, evaluating one or more relation/object checks for the authenticated caller in a single round trip. Results come back in the same order as the supplied Checks, each echoing its relation/object pair. headers must carry the caller's bearer token or session cookie so the server can pin the subject.

func (*AuthorizerClient) DeactivateAccount 

func (c *AuthorizerClient) DeactivateAccount(headers map[string]string) (*Response, error)

DeactivateAccount is method attached to AuthorizerClient. It performs deactivate_account mutation on the authorizer instance over the client's selected protocol (graphql, rest or grpc). It returns Response reference or error. For implementation details check DeactivateAccountExample examples/deactivate_account.go

func (*AuthorizerClient) EmailOtpMfaSetup 

func (c *AuthorizerClient) EmailOtpMfaSetup(req *EmailOtpMfaSetupRequest, headers map[string]string) (*Response, error)

EmailOtpMfaSetup is method attached to AuthorizerClient. It performs email_otp_mfa_setup mutation on authorizer instance, sending a one-time code to the caller's own email and creating an unverified email-OTP MFA enrollment. Verify the code with VerifyOTP. It returns Response reference or error.

func (*AuthorizerClient) ExecuteGraphQL 

func (c *AuthorizerClient) ExecuteGraphQL(req *GraphQLRequest, headers map[string]string) ([]byte, error)

func (*AuthorizerClient) ForgotPassword 

func (c *AuthorizerClient) ForgotPassword(req *ForgotPasswordRequest) (*ForgotPasswordResponse, error)

ForgotPassword is method attached to AuthorizerClient. It performs forgot_password mutation on authorizer instance. It takes ForgotPasswordRequest reference as parameter and returns ForgotPasswordResponse reference or error.

func (*AuthorizerClient) GetMetaData 

func (c *AuthorizerClient) GetMetaData() (*MetaDataResponse, error)

GetMetaData is method attached to AuthorizerClient. It performs meta query on authorizer instance. It returns MetaResponse reference or error.

func (*AuthorizerClient) GetProfile 

func (c *AuthorizerClient) GetProfile(headers map[string]string) (*User, error)

GetProfile is method attached to AuthorizerClient. It performs profile query on authorizer instance. It returns User reference or error. For implementation details check GetProfileExample examples/get_profile.go

func (*AuthorizerClient) GetSession 

func (c *AuthorizerClient) GetSession(req *SessionQueryRequest, headers map[string]string) (*AuthTokenResponse, error)

GetSession is method attached to AuthorizerClient. It performs session query on authorizer instance. It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) GetToken 

func (c *AuthorizerClient) GetToken(req *GetTokenRequest) (*TokenResponse, error)

GetToken is method attached to AuthorizerClient. It performs a form-encoded POST to `/oauth/token` on the authorizer instance (OAuth endpoints stay REST regardless of the client's selected protocol). It returns TokenResponse reference or error.

func (*AuthorizerClient) ListPermissions 

func (c *AuthorizerClient) ListPermissions(req *ListPermissionsRequest, headers map[string]string) (*ListPermissionsResponse, error)

ListPermissions performs the list_permissions query, returning the fully-qualified ids of objects of ObjectType the authenticated caller holds Relation on (or, with filters omitted, everything the caller holds). headers must carry the caller's credentials.

func (*AuthorizerClient) LockMfa 

func (c *AuthorizerClient) LockMfa(req *LockMfaRequest) (*Response, error)

LockMfa is method attached to AuthorizerClient. It performs lock_mfa mutation on authorizer instance, recording that the caller lost access to their only MFA factor(s). Only allowed when the caller has no verified email/SMS OTP fallback enrolled. Does not issue a token; the account requires admin recovery afterward. It returns Response reference or error.

func (*AuthorizerClient) Login 

func (c *AuthorizerClient) Login(req *LoginRequest) (*AuthTokenResponse, error)

Login is method attached to AuthorizerClient. It performs login on the authorizer instance over the client's selected protocol (graphql, rest or grpc). It takes LoginRequest reference as parameter and returns AuthTokenResponse reference or error.

func (*AuthorizerClient) Logout 

func (c *AuthorizerClient) Logout(headers map[string]string) (*Response, error)

Logout is method attached to AuthorizerClient. It performs Logout mutation on authorizer instance. It takes LogoutInput reference as parameter and returns Response reference or error. For implementation details check LogoutExample examples/Logout.go

func (*AuthorizerClient) MagicLinkLogin 

func (c *AuthorizerClient) MagicLinkLogin(req *MagicLinkLoginRequest) (*Response, error)

MagicLinkLogin is method attached to AuthorizerClient. It performs magic_link_login mutation on the authorizer instance over the client's selected protocol (graphql, rest or grpc). It takes MagicLinkLoginRequest reference as parameter and returns Response reference or error.

func (*AuthorizerClient) ResendOTP 

func (c *AuthorizerClient) ResendOTP(req *ResendOTPRequest) (*Response, error)

ResendOTP is method attached to AuthorizerClient. It performs resend_otp mutation on authorizer instance. It takes ResendOTPRequest reference as parameter and returns Response reference or error.

func (*AuthorizerClient) ResendVerifyEmail 

func (c *AuthorizerClient) ResendVerifyEmail(req *ResendVerifyEmailRequest) (*Response, error)

ResendVerifyEmail is method attached to AuthorizerClient. It performs resend_verify_email mutation on authorizer instance. It takes ResendVerifyEmailRequest reference as parameter and returns Response reference or error.

func (*AuthorizerClient) ResetPassword 

func (c *AuthorizerClient) ResetPassword(req *ResetPasswordRequest) (*Response, error)

ResetPassword is method attached to AuthorizerClient. It performs reset_password mutation on authorizer instance. It takes ResetPasswordRequest reference as parameter and returns Response reference or error.

func (*AuthorizerClient) Revoke 

func (c *AuthorizerClient) Revoke(req *RevokeRequest) (*Response, error)

Revoke is method attached to AuthorizerClient. It performs the revoke mutation/RPC (/v1/revoke) on authorizer instance over the client's selected protocol (graphql, rest or grpc). For the OAuth2-standard token revocation endpoint (/oauth/revoke), use RevokeToken. It returns Response reference or error.

func (*AuthorizerClient) RevokeToken 

func (c *AuthorizerClient) RevokeToken(req *RevokeTokenInput) (*Response, error)

RevokeToken is method attached to AuthorizerClient. It performs /oauth/revoke api call on authorizer instance. It takes RevokeTokenInput reference as parameter and returns Response reference or error.

func (*AuthorizerClient) SignUp 

func (c *AuthorizerClient) SignUp(req *SignUpRequest) (*AuthTokenResponse, error)

SignUp is method attached to AuthorizerClient. It performs signup mutation on authorizer instance. It takes SignUpRequest reference as parameter and returns AuthTokenResponse reference or error.

func (*AuthorizerClient) SkipMfaSetup 

func (c *AuthorizerClient) SkipMfaSetup(req *SkipMfaSetupRequest) (*AuthTokenResponse, error)

SkipMfaSetup is method attached to AuthorizerClient. It performs skip_mfa_setup mutation on authorizer instance, completing an in-progress, token-withheld MFA offer by recording that the caller explicitly declined it, then issuing the access token that was withheld. Fails if MFA is organization-enforced (enforcement is never skippable). It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) SmsOtpMfaSetup 

func (c *AuthorizerClient) SmsOtpMfaSetup(req *SmsOtpMfaSetupRequest, headers map[string]string) (*Response, error)

SmsOtpMfaSetup is method attached to AuthorizerClient. It performs sms_otp_mfa_setup mutation on authorizer instance, sending a one-time code to the caller's own phone number and creating an unverified SMS-OTP MFA enrollment. Verify the code with VerifyOTP. It returns Response reference or error.

func (*AuthorizerClient) TotpMfaSetup 

func (c *AuthorizerClient) TotpMfaSetup(req *TotpMfaSetupRequest, headers map[string]string) (*AuthTokenResponse, error)

TotpMfaSetup is method attached to AuthorizerClient. It performs totp_mfa_setup mutation on authorizer instance, generating a fresh TOTP secret/QR/recovery-codes for the caller to scan and confirm via VerifyOTP(is_totp: true). GraphQL only: the server has no gRPC/REST RPC for this operation. It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) UpdateProfile 

func (c *AuthorizerClient) UpdateProfile(req *UpdateProfileRequest, headers map[string]string) (*Response, error)

UpdateProfile is method attached to AuthorizerClient. It performs update_profile mutation on authorizer instance. It returns Response reference or error.

func (*AuthorizerClient) ValidateJWTToken 

func (c *AuthorizerClient) ValidateJWTToken(req *ValidateJWTTokenRequest) (*ValidateJWTTokenResponse, error)

ValidateJWTToken is method attached to AuthorizerClient. It performs validate_jwt_token query on authorizer instance. It returns ValidateJWTTokenResponse reference or error.

func (*AuthorizerClient) ValidateSession 

func (c *AuthorizerClient) ValidateSession(req *ValidateSessionRequest) (*ValidateSessionResponse, error)

ValidateSession is method attached to AuthorizerClient. It performs validate_session query on authorizer instance. It returns ValidateSessionResponse reference or error.

func (*AuthorizerClient) VerifyEmail 

func (c *AuthorizerClient) VerifyEmail(req *VerifyEmailRequest) (*AuthTokenResponse, error)

VerifyEmail is method attached to AuthorizerClient. It performs verify_email mutation on authorizer instance. It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) VerifyOTP 

func (c *AuthorizerClient) VerifyOTP(req *VerifyOTPRequest) (*AuthTokenResponse, error)

VerifyOTP is method attached to AuthorizerClient. It performs verify_otp mutation on authorizer instance. It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) WebauthnCredentials 

func (c *AuthorizerClient) WebauthnCredentials(headers map[string]string) ([]*WebauthnCredentialInfo, error)

WebauthnCredentials is method attached to AuthorizerClient. It performs the webauthn_credentials query on authorizer instance, listing the authenticated caller's own registered passkeys.

func (*AuthorizerClient) WebauthnDeleteCredential 

func (c *AuthorizerClient) WebauthnDeleteCredential(id string, headers map[string]string) (*Response, error)

WebauthnDeleteCredential is method attached to AuthorizerClient. It performs webauthn_delete_credential mutation on authorizer instance, removing one of the authenticated caller's own registered passkeys. DESTRUCTIVE: the passkey can no longer be used to log in.

func (*AuthorizerClient) WebauthnLoginOptions 

func (c *AuthorizerClient) WebauthnLoginOptions(email *string) (*WebauthnLoginOptionsResponse, error)

WebauthnLoginOptions is method attached to AuthorizerClient. It performs webauthn_login_options mutation on authorizer instance, returning the passkey assertion challenge. Email is optional: omit for discoverable-credential (usernameless) login.

func (*AuthorizerClient) WebauthnLoginVerify 

func (c *AuthorizerClient) WebauthnLoginVerify(req *WebauthnLoginVerifyRequest) (*AuthTokenResponse, error)

WebauthnLoginVerify is method attached to AuthorizerClient. It performs webauthn_login_verify mutation on authorizer instance, completing passkey login. It returns AuthTokenResponse reference or error.

func (*AuthorizerClient) WebauthnRegistrationOptions 

func (c *AuthorizerClient) WebauthnRegistrationOptions(req *WebauthnRegistrationOptionsRequest, headers map[string]string) (*WebauthnRegistrationOptionsResponse, error)

WebauthnRegistrationOptions is method attached to AuthorizerClient. It performs webauthn_registration_options mutation on authorizer instance, returning the passkey creation challenge.

func (*AuthorizerClient) WebauthnRegistrationVerify 

func (c *AuthorizerClient) WebauthnRegistrationVerify(req *WebauthnRegistrationVerifyRequest, headers map[string]string) (*AuthTokenResponse, error)

WebauthnRegistrationVerify is method attached to AuthorizerClient. It performs webauthn_registration_verify mutation on authorizer instance, completing passkey enrollment. Returns AuthTokenResponse with an access_token set only on the MFA-session-cookie path (nil, message-only, for the ordinary authenticated-settings-page caller).

type CheckPermissionsRequest 

type CheckPermissionsRequest struct {
	Checks []*PermissionCheckInput `json:"checks"`
	// User optionally overrides the subject ("type:id" or bare id → "user:id").
	// Honored only for super-admin callers or when it equals the caller's own
	// token subject; rejected otherwise.
	User string `json:"user,omitempty"`
}

CheckPermissionsRequest evaluates one or more permission checks in a single call. The subject defaults to the authenticated caller.

type CheckPermissionsResponse 

type CheckPermissionsResponse struct {
	Results []*PermissionCheckResult `json:"results"`
}

CheckPermissionsResponse carries one result per supplied check, in order.

type ClientOption 

type ClientOption func(*AuthorizerClient)

ClientOption customizes an AuthorizerClient at construction time.

func WithGRPCEndpoint 

func WithGRPCEndpoint(addr string) ClientOption

WithGRPCEndpoint sets the host:port dialed for grpc calls. The authorizer server's gRPC listener runs on its own port (default 9091), separate from the HTTP port in AuthorizerURL. When unset, the endpoint is derived from AuthorizerURL's host with the default gRPC port (9091).

func WithProtocol 

func WithProtocol(p Protocol) ClientOption

WithProtocol sets the wire transport the client uses (graphql, rest or grpc).

type CreateOrgOIDCConnectionRequest 

type CreateOrgOIDCConnectionRequest struct {
	OrgID        string  `json:"org_id"`
	Name         string  `json:"name"`
	IssuerURL    string  `json:"issuer_url"`
	ClientID     string  `json:"client_id"`
	ClientSecret string  `json:"client_secret"`
	Scopes       *string `json:"scopes,omitempty"`
	RedirectURI  *string `json:"redirect_uri,omitempty"`
}

CreateOrgOIDCConnectionRequest is the request for CreateOrgOIDCConnection. ClientID/ClientSecret are the credentials Authorizer holds at the upstream IdP; the secret is stored encrypted and never returned.

type CreateOrgSAMLConnectionRequest 

type CreateOrgSAMLConnectionRequest struct {
	OrgID             string  `json:"org_id"`
	Name              string  `json:"name"`
	IdpEntityID       string  `json:"idp_entity_id"`
	IdpSSOURL         string  `json:"idp_sso_url"`
	IdpCertificate    string  `json:"idp_certificate"`
	SpEntityID        *string `json:"sp_entity_id,omitempty"`
	AcsURL            *string `json:"acs_url,omitempty"`
	AttributeMapping  *string `json:"attribute_mapping,omitempty"`
	AllowIdpInitiated *bool   `json:"allow_idp_initiated,omitempty"`
}

CreateOrgSAMLConnectionRequest is the request for CreateOrgSAMLConnection. IdpCertificate is the IdP X.509 signing certificate (PEM); assertion signatures are validated only against it.

type CreateOrganizationRequest 

type CreateOrganizationRequest struct {
	Name        string  `json:"name"`
	DisplayName *string `json:"display_name,omitempty"`
}

CreateOrganizationRequest is the request for CreateOrganization. Name must be a unique, URL-safe slug.

type CreateScimEndpointRequest 

type CreateScimEndpointRequest struct {
	OrgID string `json:"org_id"`
}

CreateScimEndpointRequest is the request for CreateScimEndpoint.

type CreateScimEndpointResponse 

type CreateScimEndpointResponse struct {
	ScimEndpoint *ScimEndpoint `json:"scim_endpoint"`
	Token        string        `json:"token"`
}

CreateScimEndpointResponse carries the SCIM endpoint plus its bearer token. The token is returned ONCE at creation and ONCE at rotation; it can never be retrieved again.

type DeleteOrgDomainRequest 

type DeleteOrgDomainRequest struct {
	Domain string `json:"domain"`
}

DeleteOrgDomainRequest is the request for DeleteOrgDomain.

type EmailOtpMfaSetupRequest 

type EmailOtpMfaSetupRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
}

EmailOtpMfaSetupRequest defines attributes for email_otp_mfa_setup request. Email/PhoneNumber are only used in the MFA-session-cookie mode (a caller in the withheld first-time-offer state, with no bearer token yet); ignored when the caller has a valid bearer token/session, which already identifies the user.

type FgaTupleInput 

type FgaTupleInput struct {
	User     string `json:"user"`
	Relation string `json:"relation"`
	Object   string `json:"object"`
}

FgaTupleInput is a single relationship tuple: User is related to Object via Relation. Used to pass contextual tuples that are evaluated for one check only and never persisted.

type ForgotPasswordInput 

type ForgotPasswordInput = ForgotPasswordRequest

ForgotPasswordInput is deprecated: Use ForgotPasswordRequest instead

type ForgotPasswordRequest 

type ForgotPasswordRequest struct {
	Email       *string `json:"email,omitempty"`
	PhoneNumber *string `json:"phone_number,omitempty"`
	State       *string `json:"state,omitempty"`
	RedirectURI *string `json:"redirect_uri,omitempty"`
}

ForgotPasswordRequest defines attributes for forgot_password request

type ForgotPasswordResponse 

type ForgotPasswordResponse struct {
	Message                   string `json:"message"`
	ShouldShowMobileOtpScreen *bool  `json:"should_show_mobile_otp_screen"`
}

ForgotPasswordResponse defines attribute for forgot_password response

type GenerateJWTKeysRequest 

type GenerateJWTKeysRequest struct {
	Type string `json:"type"`
}

GenerateJWTKeysRequest is the request for GenerateJWTKeys.

type GenerateJWTKeysResponse 

type GenerateJWTKeysResponse struct {
	Secret     *string `json:"secret"`
	PublicKey  *string `json:"public_key"`
	PrivateKey *string `json:"private_key"`
}

GenerateJWTKeysResponse is the response for GenerateJWTKeys.

type GetTokenRequest 

type GetTokenRequest struct {
	Code         *string `json:"code"`
	GrantType    *string `json:"grant_type"`
	RefreshToken *string `json:"refresh_token"`
	// CodeVerifier is the PKCE verifier for public clients using the
	// authorization_code grant (RFC 7636).
	CodeVerifier *string `json:"code_verifier"`
	// ClientSecret authenticates confidential clients (client_credentials grant).
	ClientSecret *string `json:"client_secret"`
	// Scope is the space-delimited OAuth2 scope parameter (RFC 6749 §3.3).
	Scope *string `json:"scope"`
	// ClientAssertion / ClientAssertionType carry the RFC 7523 JWT-bearer client
	// credential (secretless workload-identity path).
	ClientAssertion     *string `json:"client_assertion"`
	ClientAssertionType *string `json:"client_assertion_type"`
	// RFC 8693 token-exchange parameters. SubjectToken carries the authority
	// being exercised; ActorToken carries the acting party.
	SubjectToken     *string `json:"subject_token"`
	SubjectTokenType *string `json:"subject_token_type"`
	ActorToken       *string `json:"actor_token"`
	ActorTokenType   *string `json:"actor_token_type"`
	// Resource is the RFC 8707 resource indicator (target audience).
	Resource *string `json:"resource"`
}

GetTokenRequest defines attributes for token request. Only the set (non-nil) parameters are sent to the server.

type GraphQLError 

type GraphQLError struct {
	Message string   `json:"message"`
	Path    []string `json:"path"`
}

type GraphQLRequest 

type GraphQLRequest struct {
	Query     string                 `json:"query"`
	Variables map[string]interface{} `json:"variables,omitempty"`
}

GraphQLRequest is object used to make graphql queries

type GraphQLResponse 

type GraphQLResponse struct {
	Errors []*GraphQLError `json:"errors"`
	Data   interface{}     `json:"data"`
}

type ListOrgDomainsRequest 

type ListOrgDomainsRequest struct {
	OrgID      string            `json:"org_id"`
	Pagination *PaginatedRequest `json:"pagination,omitempty"`
}

ListOrgDomainsRequest is the request for OrgDomains.

type ListOrgMembersRequest 

type ListOrgMembersRequest struct {
	OrgID      string            `json:"org_id"`
	Pagination *PaginatedRequest `json:"pagination,omitempty"`
}

ListOrgMembersRequest is the request for OrgMembers.

type ListOrganizationsRequest 

type ListOrganizationsRequest struct {
	Pagination *PaginatedRequest `json:"pagination,omitempty"`
}

ListOrganizationsRequest is the request for Organizations.

type ListPermissionsRequest 

type ListPermissionsRequest struct {
	Relation   string `json:"relation,omitempty"`
	ObjectType string `json:"object_type,omitempty"`
	// User optionally overrides the subject; same trust rules as
	// CheckPermissionsRequest.User.
	User string `json:"user,omitempty"`
}

ListPermissionsRequest enumerates what the subject can access. With both Relation and ObjectType set it answers "which <ObjectType>s can I <Relation>?". Either or both filters may be omitted: every matching (type, relation) pair of the active model is then enumerated, so an empty request returns ALL permissions the subject holds. Subject resolution follows the same rules as CheckPermissionsRequest.User.

type ListPermissionsResponse 

type ListPermissionsResponse struct {
	Objects     []string      `json:"objects"`
	Permissions []*Permission `json:"permissions"`
	Truncated   bool          `json:"truncated"`
}

ListPermissionsResponse lists what the subject can access. Objects is the distinct fully-qualified object ids (e.g. "document:1"); Permissions carries the (object, relation) detail — relevant when no Relation filter was supplied. Truncated is true when the result was capped (1000 entries) and more permissions exist.

type LockMfaRequest 

type LockMfaRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
}

LockMfaRequest defines attributes for lock_mfa request

type LoginInput 

type LoginInput = LoginRequest

LoginInput is deprecated: Use LoginRequest instead

type LoginRequest 

type LoginRequest struct {
	Email       *string   `json:"email,omitempty"`
	PhoneNumber *string   `json:"phone_number,omitempty"`
	Password    string    `json:"password"`
	Roles       []*string `json:"roles,omitempty"`
	Scope       []*string `json:"scope,omitempty"`
	State       *string   `json:"state,omitempty"`
}

LoginRequest defines attributes for login request

type MagicLinkLoginInput 

type MagicLinkLoginInput = MagicLinkLoginRequest

MagicLinkLoginInput is deprecated: Use MagicLinkLoginRequest instead

type MagicLinkLoginRequest 

type MagicLinkLoginRequest struct {
	Email       string    `json:"email"`
	Roles       []*string `json:"roles,omitempty"`
	Scope       []*string `json:"scope,omitempty"`
	State       *string   `json:"state"`
	RedirectURI *string   `json:"redirect_uri"`
}

MagicLinkLoginRequest defines attributes for magic link login request

type MetaDataResponse 

type MetaDataResponse struct {
	Version                            string `json:"version"`
	ClientID                           string `json:"client_id"`
	IsGoogleLoginEnabled               bool   `json:"is_google_login_enabled"`
	IsFacebookLoginEnabled             bool   `json:"is_facebook_login_enabled"`
	IsGithubLoginEnabled               bool   `json:"is_github_login_enabled"`
	IsLinkedinLoginEnabled             bool   `json:"is_linkedin_login_enabled"`
	IsAppleLoginEnabled                bool   `json:"is_apple_login_enabled"`
	IsTwitterLoginEnabled              bool   `json:"is_twitter_login_enabled"`
	IsDiscordLoginEnabled              bool   `json:"is_discord_login_enabled"`
	IsMicrosoftLoginEnabled            bool   `json:"is_microsoft_login_enabled"`
	IsTwitchLoginEnabled               bool   `json:"is_twitch_login_enabled"`
	IsRobloxLoginEnabled               bool   `json:"is_roblox_login_enabled"`
	IsEmailVerificationEnabled         bool   `json:"is_email_verification_enabled"`
	IsBasicAuthenticationEnabled       bool   `json:"is_basic_authentication_enabled"`
	IsMagicLinkLoginEnabled            bool   `json:"is_magic_link_login_enabled"`
	IsSignUpEnabled                    bool   `json:"is_sign_up_enabled"`
	IsStrongPasswordEnabled            bool   `json:"is_strong_password_enabled"`
	IsMultiFactorAuthEnabled           bool   `json:"is_multi_factor_auth_enabled"`
	IsMobileBasicAuthenticationEnabled bool   `json:"is_mobile_basic_authentication_enabled"`
	IsPhoneVerificationEnabled         bool   `json:"is_phone_verification_enabled"`
	IsOrgDiscoveryEnabled              bool   `json:"is_org_discovery_enabled"`
	IsTotpMfaEnabled                   bool   `json:"is_totp_mfa_enabled"`
	IsEmailOtpMfaEnabled               bool   `json:"is_email_otp_mfa_enabled"`
	IsSmsOtpMfaEnabled                 bool   `json:"is_sms_otp_mfa_enabled"`
	IsWebauthnEnabled                  bool   `json:"is_webauthn_enabled"`
	IsMfaEnforced                      bool   `json:"is_mfa_enforced"`
}

MetaDataResponse defines attributes for MetaData response query

type OrgDomain 

type OrgDomain struct {
	Domain     string `json:"domain"`
	OrgID      string `json:"org_id"`
	VerifiedAt *int64 `json:"verified_at"`
	CreatedAt  *int64 `json:"created_at"`
	UpdatedAt  *int64 `json:"updated_at"`
}

OrgDomain is a verified mapping from a DNS domain to exactly one organization, used for home-realm discovery.

type OrgDomainChallenge 

type OrgDomainChallenge struct {
	Domain      string `json:"domain"`
	RecordType  string `json:"record_type"`
	RecordName  string `json:"record_name"`
	RecordValue string `json:"record_value"`
}

OrgDomainChallenge is the DNS TXT record a tenant must publish to prove control of a domain. Returned by RequestOrgDomain; no durable row exists until the domain is verified.

type OrgDomains 

type OrgDomains struct {
	Pagination *Pagination  `json:"pagination"`
	OrgDomains []*OrgDomain `json:"org_domains"`
}

OrgDomains is a paginated list of an organization's verified domains.

type OrgMember 

type OrgMember struct {
	ID         string   `json:"id"`
	OrgID      string   `json:"org_id"`
	UserID     string   `json:"user_id"`
	Email      *string  `json:"email"`
	GivenName  *string  `json:"given_name"`
	FamilyName *string  `json:"family_name"`
	Roles      []string `json:"roles"`
	CreatedAt  int64    `json:"created_at"`
	UpdatedAt  int64    `json:"updated_at"`
}

OrgMember defines a user's membership in an organization.

type OrgMembers 

type OrgMembers struct {
	Pagination *Pagination  `json:"pagination"`
	OrgMembers []*OrgMember `json:"org_members"`
}

OrgMembers is a paginated list of organization members.

type OrgOIDCConnection 

type OrgOIDCConnection struct {
	ID          string  `json:"id"`
	OrgID       string  `json:"org_id"`
	Name        string  `json:"name"`
	IssuerURL   string  `json:"issuer_url"`
	SSOClientID string  `json:"sso_client_id"`
	Scopes      *string `json:"scopes"`
	RedirectURI *string `json:"redirect_uri"`
	IsActive    bool    `json:"is_active"`
	CreatedAt   int64   `json:"created_at"`
	UpdatedAt   int64   `json:"updated_at"`
}

OrgOIDCConnection defines an organization's upstream OIDC SSO connection.

type OrgOIDCConnectionRequest 

type OrgOIDCConnectionRequest struct {
	ID    *string `json:"id,omitempty"`
	OrgID *string `json:"org_id,omitempty"`
}

OrgOIDCConnectionRequest looks a connection up by id OR by org id (supply exactly one).

type OrgSAMLConnection 

type OrgSAMLConnection struct {
	ID                string  `json:"id"`
	OrgID             string  `json:"org_id"`
	Name              string  `json:"name"`
	IdpEntityID       string  `json:"idp_entity_id"`
	IdpSSOURL         *string `json:"idp_sso_url"`
	SpEntityID        *string `json:"sp_entity_id"`
	AcsURL            *string `json:"acs_url"`
	AttributeMapping  *string `json:"attribute_mapping"`
	AllowIdpInitiated bool    `json:"allow_idp_initiated"`
	IsActive          bool    `json:"is_active"`
	CreatedAt         int64   `json:"created_at"`
	UpdatedAt         int64   `json:"updated_at"`
}

OrgSAMLConnection defines an organization's upstream SAML SSO connection.

type OrgSAMLConnectionRequest 

type OrgSAMLConnectionRequest struct {
	ID    *string `json:"id,omitempty"`
	OrgID *string `json:"org_id,omitempty"`
}

OrgSAMLConnectionRequest looks a connection up by id OR by org id (supply exactly one).

type Organization 

type Organization struct {
	ID          string  `json:"id"`
	Name        string  `json:"name"`
	DisplayName *string `json:"display_name"`
	Enabled     bool    `json:"enabled"`
	CreatedAt   int64   `json:"created_at"`
	UpdatedAt   int64   `json:"updated_at"`
}

Organization defines attributes of an organization.

type OrganizationRequest 

type OrganizationRequest struct {
	ID string `json:"id"`
}

OrganizationRequest identifies an organization by id.

type Organizations 

type Organizations struct {
	Pagination    *Pagination     `json:"pagination"`
	Organizations []*Organization `json:"organizations"`
}

Organizations is a paginated list of organizations.

type PaginatedRequest 

type PaginatedRequest struct {
	Pagination *PaginationRequest `json:"pagination,omitempty"`
}

PaginatedRequest mirrors the GraphQL PaginatedRequest input.

type Pagination 

type Pagination struct {
	Limit  int64 `json:"limit"`
	Page   int64 `json:"page"`
	Offset int64 `json:"offset"`
	Total  int64 `json:"total"`
}

Pagination mirrors the GraphQL Pagination response type.

type PaginationRequest 

type PaginationRequest struct {
	Limit int64 `json:"limit,omitempty"`
	Page  int64 `json:"page,omitempty"`
}

PaginationRequest mirrors the GraphQL PaginationRequest input.

type Permission 

type Permission struct {
	Object   string `json:"object"`
	Relation string `json:"relation"`
}

Permission is one (object, relation) pair the subject holds.

type PermissionCheckInput 

type PermissionCheckInput struct {
	Relation string `json:"relation"`
	Object   string `json:"object"`
	// ContextualTuples are evaluated for this check only and not persisted.
	ContextualTuples []*FgaTupleInput `json:"contextual_tuples,omitempty"`
}

PermissionCheckInput is one permission to evaluate: "does the subject have Relation on Object?".

type PermissionCheckResult 

type PermissionCheckResult struct {
	Relation string `json:"relation"`
	Object   string `json:"object"`
	Allowed  bool   `json:"allowed"`
}

PermissionCheckResult is the outcome of one permission check, echoing the checked Relation/Object pair so batch results are self-describing (and positionally aligned with the request's Checks).

type Protocol 

type Protocol string

Protocol selects the wire transport a client uses to talk to authorizer. 

const (
	// ProtocolGraphQL routes calls through POST /graphql. This is the default
	// and keeps the SDK 100% backward compatible.
	ProtocolGraphQL Protocol = "graphql"

	// ProtocolREST routes calls through the typed REST endpoints
	// (POST/GET /v1/<snake>) generated from the proto google.api.http
	// annotations.
	ProtocolREST Protocol = "rest"

	// ProtocolGRPC routes calls through the generated gRPC service stub by
	// dialing AuthorizerURL.
	ProtocolGRPC Protocol = "grpc"
)

type RemoveOrgMemberRequest 

type RemoveOrgMemberRequest struct {
	OrgID  string `json:"org_id"`
	UserID string `json:"user_id"`
}

RemoveOrgMemberRequest is the request for RemoveOrgMember.

type RequestOrgDomainRequest 

type RequestOrgDomainRequest struct {
	OrgID  string `json:"org_id"`
	Domain string `json:"domain"`
}

RequestOrgDomainRequest is the request for RequestOrgDomain.

type ResendOTPInput 

type ResendOTPInput = ResendOTPRequest

ResendOTPInput is deprecated: Use ResendOTPRequest instead

type ResendOTPRequest 

type ResendOTPRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
	State       *string `json:"state,omitempty"`
}

ResendOTPRequest defines attributes for resend_otp request

type ResendVerifyEmailRequest 

type ResendVerifyEmailRequest struct {
	Email      string  `json:"email"`
	Identifier *string `json:"identifier,omitempty"`
}

ResendVerifyEmailRequest defines attributes for resend_verify_email request

type ResetPasswordInput 

type ResetPasswordInput = ResetPasswordRequest

ResetPasswordInput is deprecated: Use ResetPasswordRequest instead

type ResetPasswordRequest 

type ResetPasswordRequest struct {
	Token           *string `json:"token,omitempty"`
	Password        string  `json:"password"`
	ConfirmPassword string  `json:"confirm_password"`
	OTP             *string `json:"otp,omitempty"`
	PhoneNumber     *string `json:"phone_number,omitempty"`
}

ResetPasswordRequest defines attributes for reset_password request

type Response 

type Response struct {
	Message string `json:"message"`
}

Response defines attribute for Response graphql type it is common across various authorizer operations

type RevokeRequest 

type RevokeRequest struct {
	RefreshToken string `json:"refresh_token"`
}

RevokeRequest defines attributes for the revoke mutation/RPC (distinct from the OAuth2-standard RevokeToken, which targets /oauth/revoke directly).

type RevokeTokenInput 

type RevokeTokenInput struct {
	RefreshToken string `json:"refresh_token"`
}

RevokeTokenInput defines attributes for /oauth/revoke request

type ScimEndpoint 

type ScimEndpoint struct {
	ID        string `json:"id"`
	OrgID     string `json:"org_id"`
	Enabled   bool   `json:"enabled"`
	CreatedAt int64  `json:"created_at"`
	UpdatedAt int64  `json:"updated_at"`
}

ScimEndpoint defines an organization's SCIM provisioning endpoint.

type ScimEndpointRequest 

type ScimEndpointRequest struct {
	OrgID string `json:"org_id"`
}

ScimEndpointRequest identifies an organization's SCIM endpoint by org id.

type SessionQueryInput 

type SessionQueryInput = SessionQueryRequest

SessionQueryInput is deprecated: Use SessionQueryRequest instead

type SessionQueryRequest 

type SessionQueryRequest struct {
	Roles []*string `json:"roles"`
	Scope []*string `json:"scope,omitempty"`
}

SessionQueryRequest defines attributes for session query request

type SignUpInput 

type SignUpInput = SignUpRequest

SignUpInput is deprecated: Use SignUpRequest instead

type SignUpRequest 

type SignUpRequest struct {
	Email           *string                `json:"email,omitempty"`
	Password        string                 `json:"password"`
	ConfirmPassword string                 `json:"confirm_password"`
	GivenName       *string                `json:"given_name,omitempty"`
	FamilyName      *string                `json:"family_name,omitempty"`
	MiddleName      *string                `json:"middle_name,omitempty"`
	NickName        *string                `json:"nickname,omitempty"`
	Picture         *string                `json:"picture,omitempty"`
	Gender          *string                `json:"gender,omitempty"`
	BirthDate       *string                `json:"birthdate,omitempty"`
	PhoneNumber     *string                `json:"phone_number,omitempty"`
	Roles           []*string              `json:"roles,omitempty"`
	Scope           []*string              `json:"scope,omitempty"`
	RedirectURI     *string                `json:"redirect_uri,omitempty"`
	AppData         map[string]interface{} `json:"app_data,omitempty"`
	State           *string                `json:"state,omitempty"`
}

SignUpRequest defines attributes for signup request

is_multi_factor_auth_enabled is intentionally NOT a field here: the server removed it from SignUpRequest (security fix — letting a signup caller self-enable/disable MFA enforcement was an auth bypass). Use UpdateProfile or the admin UpdateUser API to change a user's MFA enrollment after signup.

type SkipMfaSetupRequest 

type SkipMfaSetupRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
	State       *string `json:"state,omitempty"`
}

SkipMfaSetupRequest defines attributes for skip_mfa_setup request

type SmsOtpMfaSetupRequest 

type SmsOtpMfaSetupRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
}

SmsOtpMfaSetupRequest defines attributes for sms_otp_mfa_setup request. Same dual-mode identification semantics as EmailOtpMfaSetupRequest.

type TokenQueryInput 

type TokenQueryInput = GetTokenRequest

TokenQueryInput is deprecated: Use GetTokenRequest instead

type TokenResponse 

type TokenResponse struct {
	AccessToken  string  `json:"access_token"`
	TokenType    string  `json:"token_type"`
	ExpiresIn    int64   `json:"expires_in"`
	IdToken      string  `json:"id_token"`
	RefreshToken *string `json:"refresh_token"`
	Scope        string  `json:"scope"`
	// IssuedTokenType is set for RFC 8693 token-exchange responses.
	IssuedTokenType string `json:"issued_token_type"`
}

TokenResponse defines attributes for token request

type TokenType 

type TokenType string
const (
	// Token type access_token
	TokenTypeAccessToken TokenType = "access_token"
	// Token type id_token
	TokenTypeIDToken TokenType = "id_token"
	// Token type refresh_token
	TokenTypeRefreshToken TokenType = "refresh_token"
)

type TotpMfaSetupRequest 

type TotpMfaSetupRequest struct {
	Email       *string `json:"email"`
	PhoneNumber *string `json:"phone_number"`
}

TotpMfaSetupRequest defines attributes for totp_mfa_setup request. Same dual-mode identification semantics as EmailOtpMfaSetupRequest: Email/ PhoneNumber are only used in the MFA-session-cookie mode; ignored when the caller has a valid bearer token/session.

type UpdateEnvRequest 

type UpdateEnvRequest map[string]interface{}

UpdateEnvRequest is a flexible map of environment keys to update.

type UpdateOrgOIDCConnectionRequest 

type UpdateOrgOIDCConnectionRequest struct {
	ID           string  `json:"id"`
	Name         *string `json:"name,omitempty"`
	IssuerURL    *string `json:"issuer_url,omitempty"`
	ClientID     *string `json:"client_id,omitempty"`
	ClientSecret *string `json:"client_secret,omitempty"`
	Scopes       *string `json:"scopes,omitempty"`
	RedirectURI  *string `json:"redirect_uri,omitempty"`
	IsActive     *bool   `json:"is_active,omitempty"`
}

UpdateOrgOIDCConnectionRequest is the request for UpdateOrgOIDCConnection. Supplying ClientSecret rotates it; omitting leaves the stored secret intact.

type UpdateOrgSAMLConnectionRequest 

type UpdateOrgSAMLConnectionRequest struct {
	ID                string  `json:"id"`
	Name              *string `json:"name,omitempty"`
	IdpEntityID       *string `json:"idp_entity_id,omitempty"`
	IdpSSOURL         *string `json:"idp_sso_url,omitempty"`
	IdpCertificate    *string `json:"idp_certificate,omitempty"`
	SpEntityID        *string `json:"sp_entity_id,omitempty"`
	AcsURL            *string `json:"acs_url,omitempty"`
	AttributeMapping  *string `json:"attribute_mapping,omitempty"`
	AllowIdpInitiated *bool   `json:"allow_idp_initiated,omitempty"`
	IsActive          *bool   `json:"is_active,omitempty"`
}

UpdateOrgSAMLConnectionRequest is the request for UpdateOrgSAMLConnection. Supplying IdpCertificate replaces it; omitting leaves the stored cert intact.

type UpdateOrganizationRequest 

type UpdateOrganizationRequest struct {
	ID          string  `json:"id"`
	Name        *string `json:"name,omitempty"`
	DisplayName *string `json:"display_name,omitempty"`
	Enabled     *bool   `json:"enabled,omitempty"`
}

UpdateOrganizationRequest is the request for UpdateOrganization.

type UpdateProfileInput 

type UpdateProfileInput = UpdateProfileRequest

UpdateProfileInput is deprecated: Use UpdateProfileRequest instead

type UpdateProfileRequest 

type UpdateProfileRequest struct {
	Email                    *string                `json:"email,omitempty"`
	NewPassword              *string                `json:"new_password,omitempty"`
	ConfirmNewPassword       *string                `json:"confirm_new_password,omitempty"`
	OldPassword              *string                `json:"old_password,omitempty"`
	GivenName                *string                `json:"given_name,omitempty"`
	FamilyName               *string                `json:"family_name,omitempty"`
	MiddleName               *string                `json:"middle_name,omitempty"`
	NickName                 *string                `json:"nickname,omitempty"`
	Picture                  *string                `json:"picture,omitempty"`
	Gender                   *string                `json:"gender,omitempty"`
	BirthDate                *string                `json:"birthdate,omitempty"`
	PhoneNumber              *string                `json:"phone_number,omitempty"`
	Roles                    []*string              `json:"roles,omitempty"`
	Scope                    []*string              `json:"scope,omitempty"`
	RedirectURI              *string                `json:"redirect_uri,omitempty"`
	IsMultiFactorAuthEnabled *bool                  `json:"is_multi_factor_auth_enabled,omitempty"`
	AppData                  map[string]interface{} `json:"app_data,omitempty"`
}

UpdateProfileRequest defines attributes for update_profile request

type User 

type User struct {
	ID                       string    `json:"id"`
	Email                    string    `json:"email"`
	PreferredUsername        string    `json:"preferred_username"`
	EmailVerified            bool      `json:"email_verified"`
	SignupMethods            string    `json:"signup_methods"`
	GivenName                *string   `json:"given_name"`
	FamilyName               *string   `json:"family_name"`
	MiddleName               *string   `json:"middle_name"`
	Nickname                 *string   `json:"nickname"`
	Picture                  *string   `json:"picture"`
	Gender                   *string   `json:"gender"`
	Birthdate                *string   `json:"birthdate"`
	PhoneNumber              *string   `json:"phone_number"`
	PhoneNumberVerified      *bool     `json:"phone_number_verified"`
	Roles                    []*string `json:"roles"`
	CreatedAt                int64     `json:"created_at"`
	UpdatedAt                int64     `json:"updated_at"`
	IsMultiFactorAuthEnabled *bool     `json:"is_multi_factor_auth_enabled"`
	// HasSkippedMfaSetupAt is set once the user explicitly skips the optional
	// MFA setup prompt shown at login. Nil means never skipped.
	HasSkippedMfaSetupAt *int64 `json:"has_skipped_mfa_setup_at"`
	// MfaLockedAt is set once the user reports losing access to their only MFA
	// factor(s) with no OTP fallback enrolled. Nil means not locked.
	MfaLockedAt *int64 `json:"mfa_locked_at"`
	// EnrolledMfaMethods lists the MFA factors this user has actually
	// verified/enrolled: any of "totp", "webauthn", "email_otp", "sms_otp".
	EnrolledMfaMethods []string               `json:"enrolled_mfa_methods"`
	AppData            map[string]interface{} `json:"app_data,omitempty"`
	RevokedTimestamp   *int64                 `json:"revoked_timestamp"`
}

User defines attributes for user instance

type UserOrganization 

type UserOrganization struct {
	Organization *Organization `json:"organization"`
	Roles        []string      `json:"roles"`
}

UserOrganization pairs an organization with the roles a user holds in it.

type UserOrganizations 

type UserOrganizations struct {
	Pagination        *Pagination         `json:"pagination"`
	UserOrganizations []*UserOrganization `json:"user_organizations"`
}

UserOrganizations is a paginated list of a user's organizations.

type UserOrganizationsRequest 

type UserOrganizationsRequest struct {
	UserID     string             `json:"user_id"`
	Pagination *PaginationRequest `json:"pagination,omitempty"`
}

UserOrganizationsRequest is the request for UserOrganizations.

type ValidateJWTTokenInput 

type ValidateJWTTokenInput = ValidateJWTTokenRequest

ValidateJWTTokenInput is deprecated: Use ValidateJWTTokenRequest instead

type ValidateJWTTokenRequest 

type ValidateJWTTokenRequest struct {
	TokenType TokenType `json:"token_type"`
	Token     string    `json:"token"`
	Roles     []*string `json:"roles,omitempty"`
}

ValidateJWTTokenRequest defines attributes for validate_jwt_token request

type ValidateJWTTokenResponse 

type ValidateJWTTokenResponse struct {
	IsValid bool                   `json:"is_valid"`
	Claims  map[string]interface{} `json:"claims"`
}

ValidateJWTTokenResponse defines attributes for validate_jwt_token response

type ValidateSessionInput 

type ValidateSessionInput = ValidateSessionRequest

ValidateSessionInput is deprecated: Use ValidateSessionRequest instead

type ValidateSessionRequest 

type ValidateSessionRequest struct {
	Cookie string    `json:"cookie,omitempty"`
	Roles  []*string `json:"roles,omitempty"`
}

ValidateSessionRequest defines attributes for validate_session request

type ValidateSessionResponse 

type ValidateSessionResponse struct {
	IsValid bool  `json:"is_valid"`
	User    *User `json:"user,omitempty"`
}

ValidateSessionResponse defines attributes for validate_session response

type VerifyEmailInput 

type VerifyEmailInput = VerifyEmailRequest

VerifyEmailInput is deprecated: Use VerifyEmailRequest instead

type VerifyEmailRequest 

type VerifyEmailRequest struct {
	Token string  `json:"token"`
	State *string `json:"state,omitempty"`
}

VerifyEmailRequest defines attributes for verify_email request

type VerifyOTPInput 

type VerifyOTPInput = VerifyOTPRequest

VerifyOTPInput is deprecated: Use VerifyOTPRequest instead

type VerifyOTPRequest 

type VerifyOTPRequest struct {
	Email       *string `json:"email"`
	OTP         string  `json:"otp"`
	PhoneNumber *string `json:"phone_number"`
	IsTotp      *bool   `json:"is_totp,omitempty"`
	State       *string `json:"state,omitempty"`
}

VerifyOTPRequest defines attributes for verify_otp request

type VerifyOrgDomainRequest 

type VerifyOrgDomainRequest struct {
	OrgID  string `json:"org_id"`
	Domain string `json:"domain"`
}

VerifyOrgDomainRequest is the request for VerifyOrgDomain.

type WebauthnCredentialInfo 

type WebauthnCredentialInfo struct {
	ID         string    `json:"id"`
	Name       string    `json:"name"`
	Transports []*string `json:"transports"`
	CreatedAt  *int64    `json:"created_at"`
	UpdatedAt  *int64    `json:"updated_at"`
	LastUsedAt *int64    `json:"last_used_at"`
}

WebauthnCredentialInfo defines attributes for a registered passkey.

type WebauthnLoginOptionsResponse 

type WebauthnLoginOptionsResponse struct {
	// Options is JSON-encoded PublicKeyCredentialRequestOptions to pass to
	// navigator.credentials.get().
	Options string `json:"options"`
}

WebauthnLoginOptionsResponse defines attributes for webauthn_login_options response.

type WebauthnLoginVerifyRequest 

type WebauthnLoginVerifyRequest struct {
	// State is the OAuth authorize state to continue an in-progress
	// authorization, if any.
	State *string `json:"state,omitempty"`
	// Credential is the JSON-encoded PublicKeyCredential assertion response
	// from navigator.credentials.get().
	Credential string `json:"credential"`
}

WebauthnLoginVerifyRequest defines attributes for webauthn_login_verify request.

type WebauthnRegistrationOptionsRequest 

type WebauthnRegistrationOptionsRequest struct {
	Email       *string `json:"email,omitempty"`
	PhoneNumber *string `json:"phone_number,omitempty"`
}

WebauthnRegistrationOptionsRequest defines attributes for webauthn_registration_options. Email/PhoneNumber are only used in the MFA-session-cookie mode (a caller in the withheld first-time-offer state, with no bearer token yet); ignored for an ordinary bearer-token- authenticated settings-page caller.

type WebauthnRegistrationOptionsResponse 

type WebauthnRegistrationOptionsResponse struct {
	// Options is JSON-encoded PublicKeyCredentialCreationOptions to pass to
	// navigator.credentials.create().
	Options string `json:"options"`
}

WebauthnRegistrationOptionsResponse defines attributes for webauthn_registration_options response.

type WebauthnRegistrationVerifyRequest 

type WebauthnRegistrationVerifyRequest struct {
	// Name is an optional human label for the passkey (e.g. "MacBook Touch ID").
	Name *string `json:"name,omitempty"`
	// Credential is the JSON-encoded PublicKeyCredential attestation response
	// from navigator.credentials.create().
	Credential  string  `json:"credential"`
	Email       *string `json:"email,omitempty"`
	PhoneNumber *string `json:"phone_number,omitempty"`
	State       *string `json:"state,omitempty"`
}

WebauthnRegistrationVerifyRequest defines attributes for webauthn_registration_verify request. Email/PhoneNumber/State are only used on the MFA-session-cookie path; ignored for an ordinary bearer-token- authenticated settings-page caller.

Source Files

View all Source files

Directories

Path Synopsis
manual command
Manual end-to-end smoke test for the Authorizer Go SDK.
 Manual end-to-end smoke test for the Authorizer Go SDK.
internal
genpb/authorizer/v1

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.