clavex

package module
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

README

Clavex Go SDK

Go Reference Go Report Card

Official Go management SDK for the Clavex IAM API.

It covers organizations, users, roles & groups, OIDC/SAML/WS-Fed clients, federation, FGA, PAM, governance, EUDI wallet (OID4VCI / OID4VP / mdoc), CIBA, SSF, webhooks, SCIM and more.

Install

go get github.com/clavex-eu/clavex-sdk-go

Requires Go 1.21+.

Quickstart

package main

import (
	"context"
	"log"

	clavex "github.com/clavex-eu/clavex-sdk-go"
)

func main() {
	client, err := clavex.New("https://auth.example.com",
		clavex.WithCredentials("myorg", "admin@example.com", "password"),
	)
	if err != nil {
		log.Fatal(err)
	}

	ctx := context.Background()
	users, err := client.Users.List(ctx, "org-id")
	if err != nil {
		log.Fatal(err)
	}
	log.Printf("found %d users", len(users))
}

Documentation

Full API reference: pkg.go.dev/github.com/clavex-eu/clavex-sdk-go.

Versioning

Semantic versioning via git tags (vX.Y.Z). Breaking changes only on major bumps.

License

Apache License 2.0 — see LICENSE.

Documentation

Overview

Package clavex provides a Go management SDK for the Clavex IAM API.

Quickstart 

client, err := clavex.New("https://auth.example.com",
    clavex.WithCredentials("myorg", "admin@example.com", "password"),
)
if err != nil {
    log.Fatal(err)
}

users, err := client.Users.List(ctx, orgID)

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func IsConflict 

func IsConflict(err error) bool

IsConflict returns true if the error is a 409 (resource already exists).

func IsNotFound 

func IsNotFound(err error) bool

IsNotFound returns true if the error is a 404.

func IsRateLimit 

func IsRateLimit(err error) bool

IsRateLimit returns true if the error is a 429 (too many requests).

func IsUnauthorized 

func IsUnauthorized(err error) bool

IsUnauthorized returns true if the error is a 401.

func WithManagedBy added in v0.3.0 

func WithManagedBy(ctx context.Context, by, ref string) context.Context

WithManagedBy returns a context that stamps the declarative-management marker on every create/update the SDK performs with it. by is the owning system (e.g. "k8s-operator"); ref is a human-readable pointer to the owning object (e.g. "ClavexClient/clavex-operator-system/testclient") — pass "" to omit it.

func WithManagedRelease added in v0.3.0 

func WithManagedRelease(ctx context.Context) context.Context

WithManagedRelease returns a context that asks the server to disown the resource on the next write — clearing its marker without changing its configuration. Used when the operator stops managing a resource (or a ClavexOrg settings section) but leaves the live value in place.

Types

type AIService 

type AIService struct {
	// contains filtered or unexported fields
}

AIService exposes the AI security copilot and suggestion endpoints.

func (*AIService) GetConfig 

func (s *AIService) GetConfig(ctx context.Context, orgID string) (map[string]interface{}, error)

GetConfig returns the AI copilot configuration.

func (*AIService) PutConfig 

func (s *AIService) PutConfig(ctx context.Context, orgID string, cfg map[string]interface{}) (map[string]interface{}, error)

PutConfig updates the AI copilot configuration.

func (*AIService) Suggest 

func (s *AIService) Suggest(ctx context.Context, orgID, kind string, body interface{}) (map[string]interface{}, error)

Suggest invokes an AI suggestion/analysis endpoint by kind, e.g. "suggest-policy", "suggest-dcql", "explain-anomaly", "audit-copilot", "nl-audit-query".

type APIError 

type APIError struct {
	StatusCode int
	Body       string
}

APIError is returned when the server responds with an HTTP 4xx/5xx status.

func (*APIError) Error 

func (e *APIError) Error() string

type APIKey 

type APIKey struct {
	ID          string     `json:"id"`
	Name        string     `json:"name"`
	Prefix      string     `json:"prefix"` // e.g. "cvx_sk_..." for display
	OrgID       string     `json:"org_id,omitempty"`
	Permissions []string   `json:"permissions,omitempty"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
}

APIKey is an admin API key record (without the secret).

type APIKeyService 

type APIKeyService struct {
	// contains filtered or unexported fields
}

APIKeyService manages superadmin API keys. API keys can be used instead of JWT bearer tokens for machine-to-machine integrations (CI/CD, IaC, provisioning tools). 

key, err := client.APIKeys.Create(ctx, clavex.CreateAPIKeyParams{Name: "terraform"})
// key.Secret is only available at creation time — store it securely.

func (*APIKeyService) Create 

func (s *APIKeyService) Create(ctx context.Context, p CreateAPIKeyParams) (*CreateAPIKeyResult, error)

Create generates a new API key. Requires superadmin privileges.

func (*APIKeyService) List 

func (s *APIKeyService) List(ctx context.Context, orgID string) ([]APIKey, error)

List returns all API keys. If orgID is non-empty, only keys scoped to that org are returned (superadmin keys are excluded). Requires superadmin privileges.

func (*APIKeyService) Revoke 

func (s *APIKeyService) Revoke(ctx context.Context, keyID string) error

Revoke permanently invalidates an API key. Requires superadmin privileges.

type AZAction 

type AZAction struct {
	// Name is the action identifier (e.g. "read", "write", "delete", "can_approve").
	Name       string         `json:"name,omitempty"`
	Properties map[string]any `json:"properties,omitempty"`
}

AZAction is the AuthZen §5.3 Action — what the subject wants to do.

type AZContext 

type AZContext struct {
	// IP is the end-user's IP address.
	IP string `json:"ip,omitempty"`
	// Country is the ISO 3166-1 alpha-2 country code.
	Country string `json:"country,omitempty"`
	// UserAgent string.
	UserAgent string `json:"user_agent,omitempty"`
	// Time overrides the evaluation clock (ISO 8601). Useful for testing.
	Time string `json:"time,omitempty"`
}

AZContext carries additional signals for the authorization decision.

type AZResource 

type AZResource struct {
	Type       string         `json:"type,omitempty"`
	ID         string         `json:"id,omitempty"`
	Properties map[string]any `json:"properties,omitempty"`
}

AZResource is the AuthZen §5.2 Resource — the target of the action.

type AZSubject 

type AZSubject struct {
	// Type identifies the subject kind (e.g. "user", "service_account").
	Type string `json:"type"`
	// ID is the subject identifier. For users, this is the OIDC sub claim
	// or the user's email address.
	ID         string         `json:"id"`
	Properties map[string]any `json:"properties,omitempty"`
}

AZSubject is the AuthZen §5.1 Subject — who is performing the action.

type AccessReviewService 

type AccessReviewService struct {
	// contains filtered or unexported fields
}

AccessReviewService manages periodic user access-review (certification) campaigns.

func (*AccessReviewService) Create 

func (s *AccessReviewService) Create(ctx context.Context, orgID string, p CreateAccessReviewParams) (map[string]interface{}, error)

func (*AccessReviewService) Delete 

func (s *AccessReviewService) Delete(ctx context.Context, orgID, campaignID string) error

func (*AccessReviewService) Get 

func (s *AccessReviewService) Get(ctx context.Context, orgID, campaignID string) (map[string]interface{}, error)

func (*AccessReviewService) Launch 

func (s *AccessReviewService) Launch(ctx context.Context, orgID, campaignID string) error

func (*AccessReviewService) List 

func (s *AccessReviewService) List(ctx context.Context, orgID string) ([]map[string]interface{}, error)

func (*AccessReviewService) ListItems 

func (s *AccessReviewService) ListItems(ctx context.Context, orgID, campaignID string) ([]map[string]interface{}, error)

func (*AccessReviewService) Report 

func (s *AccessReviewService) Report(ctx context.Context, orgID, campaignID string) (map[string]interface{}, error)

type ActionsService 

type ActionsService struct {
	// contains filtered or unexported fields
}

ActionsService manages outbound action targets and event-triggered executions.

func (*ActionsService) CreateExecution 

func (s *ActionsService) CreateExecution(ctx context.Context, orgID string, p CreateActionExecutionParams) (map[string]interface{}, error)

func (*ActionsService) DeleteExecution 

func (s *ActionsService) DeleteExecution(ctx context.Context, orgID, executionID string) error

func (*ActionsService) DeleteTarget 

func (s *ActionsService) DeleteTarget(ctx context.Context, orgID, targetID string) error

func (*ActionsService) ListExecutions 

func (s *ActionsService) ListExecutions(ctx context.Context, orgID string) ([]map[string]interface{}, error)

func (*ActionsService) ListTargets 

func (s *ActionsService) ListTargets(ctx context.Context, orgID string) ([]map[string]interface{}, error)

func (*ActionsService) UpdateExecution 

func (s *ActionsService) UpdateExecution(ctx context.Context, orgID, executionID string, p CreateActionExecutionParams) (map[string]interface{}, error)

func (*ActionsService) UpsertTarget 

func (s *ActionsService) UpsertTarget(ctx context.Context, orgID, name string, p UpsertActionTargetParams) (map[string]interface{}, error)

UpsertTarget creates or replaces an action target identified by name.

type ActiveSession 

type ActiveSession struct {
	ID         string     `json:"id"`
	OrgID      string     `json:"org_id"`
	ClientID   string     `json:"client_id"`
	UserID     *string    `json:"user_id,omitempty"`
	Scope      string     `json:"scope"`
	ExpiresAt  time.Time  `json:"expires_at"`
	CreatedAt  time.Time  `json:"created_at"`
	UserAgent  *string    `json:"user_agent,omitempty"`
	IPAddress  *string    `json:"ip_address,omitempty"`
	DeviceName *string    `json:"device_name,omitempty"`
	LastSeenAt *time.Time `json:"last_seen_at,omitempty"`
}

ActiveSession summarises a live refresh-token session.

type AgentToken 

type AgentToken struct {
	ID          string     `json:"id"`
	OrgID       string     `json:"org_id"`
	UserID      string     `json:"user_id"`
	AgentID     string     `json:"agent_id"`
	AgentName   string     `json:"agent_name"`
	Scope       string     `json:"scope"`
	IsRevoked   bool       `json:"is_revoked"`
	ExpiresAt   time.Time  `json:"expires_at"`
	CreatedAt   time.Time  `json:"created_at"`
	MCPServerID *string    `json:"mcp_server_id,omitempty"`
	RevokedAt   *time.Time `json:"revoked_at,omitempty"`
	// Audience is the "aud" claim embedded in the signed JWT at issuance
	// time. Nil/empty means the issuer default (legacy behaviour).
	Audience *string `json:"audience,omitempty"`
}

AgentToken is an issued AI-agent (MCP) access token record.

type AgentTokenService 

type AgentTokenService struct {
	// contains filtered or unexported fields
}

AgentTokenService manages AI-agent access tokens (MCP).

func (*AgentTokenService) Delete 

func (s *AgentTokenService) Delete(ctx context.Context, orgID, id string) error

func (*AgentTokenService) Issue 

func (s *AgentTokenService) Issue(ctx context.Context, orgID string, p IssueAgentTokenParams) (*IssuedAgentToken, error)

Issue creates a new agent token. The token is shown only once.

func (*AgentTokenService) List 

func (s *AgentTokenService) List(ctx context.Context, orgID string) ([]AgentToken, error)

func (*AgentTokenService) MCPScopes 

func (s *AgentTokenService) MCPScopes(ctx context.Context, orgID string) ([]map[string]interface{}, error)

MCPScopes returns the available MCP scopes for agent tokens.

type AppFamily 

type AppFamily struct {
	ID          string            `json:"id"`
	OrgID       string            `json:"org_id"`
	Name        string            `json:"name"`
	Description *string           `json:"description,omitempty"`
	CreatedAt   time.Time         `json:"created_at"`
	UpdatedAt   time.Time         `json:"updated_at"`
	Members     []AppFamilyMember `json:"members,omitempty"`
}

AppFamily groups OIDC clients for cross-app SSO and coordinated logout.

type AppFamilyMember 

type AppFamilyMember struct {
	FamilyID             string    `json:"family_id"`
	ClientID             string    `json:"client_id"`
	BackchannelLogoutURI *string   `json:"backchannel_logout_uri,omitempty"`
	CreatedAt            time.Time `json:"created_at"`
}

AppFamilyMember is a client that belongs to an application family.

type AppFamilyParams 

type AppFamilyParams struct {
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
}

AppFamilyParams defines an application family.

type AppFamilyService 

type AppFamilyService struct {
	// contains filtered or unexported fields
}

AppFamilyService manages application families (grouped SSO clients).

func (*AppFamilyService) AddMember 

func (s *AppFamilyService) AddMember(ctx context.Context, orgID, familyID, clientID string) error

AddMember adds a client to an application family.

func (*AppFamilyService) Create 

func (s *AppFamilyService) Create(ctx context.Context, orgID string, p AppFamilyParams) (*AppFamily, error)

func (*AppFamilyService) Delete 

func (s *AppFamilyService) Delete(ctx context.Context, orgID, familyID string) error

func (*AppFamilyService) Get 

func (s *AppFamilyService) Get(ctx context.Context, orgID, familyID string) (*AppFamily, error)

func (*AppFamilyService) List 

func (s *AppFamilyService) List(ctx context.Context, orgID string) ([]AppFamily, error)

func (*AppFamilyService) RemoveMember 

func (s *AppFamilyService) RemoveMember(ctx context.Context, orgID, familyID, clientID string) error

RemoveMember removes a client from an application family.

func (*AppFamilyService) Update 

func (s *AppFamilyService) Update(ctx context.Context, orgID, familyID string, p AppFamilyParams) (*AppFamily, error)

type AuditListParams 

type AuditListParams struct {
	UserID    string `url:"user_id,omitempty"`
	EventType string `url:"event_type,omitempty"`
	Limit     int    `url:"limit,omitempty"`
	Offset    int    `url:"offset,omitempty"`
}

AuditListParams carries optional filter parameters for audit queries.

type AuditLogEntry 

type AuditLogEntry struct {
	ID         string                 `json:"id"`
	OrgID      string                 `json:"org_id"`
	ActorID    *string                `json:"actor_id,omitempty"`
	ActorEmail *string                `json:"actor_email,omitempty"`
	Action     string                 `json:"action"`
	ResourceID *string                `json:"resource_id,omitempty"`
	Metadata   map[string]interface{} `json:"metadata,omitempty"`
	IPAddress  *string                `json:"ip_address,omitempty"`
	CreatedAt  time.Time              `json:"created_at"`
}

AuditLogEntry is a single immutable audit event.

type AuditService 

type AuditService struct {
	// contains filtered or unexported fields
}

AuditService provides read access to the audit log.

func (*AuditService) CreateSink 

func (s *AuditService) CreateSink(ctx context.Context, orgID string, p CreateSinkParams) (*AuditSink, error)

CreateSink registers a new audit sink.

func (*AuditService) DeleteSink 

func (s *AuditService) DeleteSink(ctx context.Context, orgID, sinkID string) error

DeleteSink removes an audit sink.

func (*AuditService) Export 

func (s *AuditService) Export(ctx context.Context, orgID string, opts ListOptions) ([]byte, error)

Export downloads audit log entries as NDJSON. The raw bytes are returned so callers can write them to a file or stream them to a SIEM.

func (*AuditService) List 

func (s *AuditService) List(ctx context.Context, orgID string) ([]AuditLogEntry, error)

List returns audit log entries for orgID. Pass a zero-value AuditListParams{} to retrieve all entries.

func (*AuditService) ListPage 

func (s *AuditService) ListPage(ctx context.Context, orgID string, opts ListOptions) (*Page[AuditLogEntry], error)

ListPage returns a cursor-paginated page of audit log entries. 

page, err := client.AuditLog.ListPage(ctx, orgID, clavex.ListOptions{Limit: 200})

func (*AuditService) ListSinks 

func (s *AuditService) ListSinks(ctx context.Context, orgID string) ([]AuditSink, error)

ListSinks returns all audit sinks for orgID.

func (*AuditService) TestSink 

func (s *AuditService) TestSink(ctx context.Context, orgID, sinkID string) error

TestSink fires a test event to a sink to verify connectivity.

func (*AuditService) UpdateSink 

func (s *AuditService) UpdateSink(ctx context.Context, orgID, sinkID string, p CreateSinkParams) (*AuditSink, error)

UpdateSink modifies an existing audit sink.

type AuditSink 

type AuditSink struct {
	ID        string            `json:"id"`
	OrgID     string            `json:"org_id"`
	Type      string            `json:"type"`
	Config    map[string]string `json:"config,omitempty"`
	Events    []string          `json:"events,omitempty"`
	IsActive  bool              `json:"is_active"`
	CreatedAt time.Time         `json:"created_at"`
}

AuditSink is an outbound integration that forwards audit events.

type AuthService 

type AuthService struct {
	// contains filtered or unexported fields
}

AuthService handles admin authentication.

func (*AuthService) Login 

func (s *AuthService) Login(ctx context.Context, p LoginParams) (*LoginResponse, error)

Login authenticates an admin user and returns the JWT. When using WithCredentials, this is called automatically — you do not need to call it directly unless you want the raw response. 

resp, err := client.Auth.Login(ctx, clavex.LoginParams{
    OrgSlug: "acme", Email: "admin@acme.com", Password: "secret",
})

func (*AuthService) SetToken 

func (s *AuthService) SetToken(token string)

SetToken overrides the current bearer token. Useful for externally managed token rotation.

type AuthZenService 

type AuthZenService struct {
	// contains filtered or unexported fields
}

AuthZenService exposes the OpenID AuthZen 1.0 authorization evaluation API.

Resource servers call Evaluate() to ask "can this subject perform this action on this resource?" without implementing their own policy engine.

Clavex acts as the Policy Decision Point (PDP); your service is the Policy Enforcement Point (PEP). 

ok, err := client.AuthZen.Evaluate(ctx, orgSlug, clavex.EvaluateRequest{
    Subject:  clavex.AZSubject{Type: "user", ID: userSub},
    Resource: clavex.AZResource{Type: "document", ID: docID},
    Action:   clavex.AZAction{Name: "read"},
})
if err != nil { ... }
if !ok.Decision { return http.StatusForbidden }

func (*AuthZenService) BatchEvaluate 

func (s *AuthZenService) BatchEvaluate(ctx context.Context, orgSlug string, reqs []EvaluateRequest) (*BatchEvaluateResponse, error)

BatchEvaluate evaluates multiple authorization requests in a single call. Results are returned in the same order as the input requests.

func (*AuthZenService) Evaluate 

func (s *AuthZenService) Evaluate(ctx context.Context, orgSlug string, req EvaluateRequest) (*EvaluateResponse, error)

Evaluate asks Clavex whether the subject can perform the action on the resource. The orgSlug is the tenant identifier (e.g. "acme").

The client must be authenticated with a valid access token issued by the same org. Resource servers should use a machine-to-machine client credential to obtain this token once and cache it until expiry. 

resp, err := client.AuthZen.Evaluate(ctx, "acme", clavex.EvaluateRequest{
    Subject:  clavex.AZSubject{Type: "user", ID: "alice@example.com"},
    Resource: clavex.AZResource{Type: "invoice", ID: "inv-9001"},
    Action:   clavex.AZAction{Name: "approve"},
    Context:  clavex.AZContext{IP: "1.2.3.4"},
})

type BatchEvaluateRequest 

type BatchEvaluateRequest struct {
	Evaluations []EvaluateRequest `json:"evaluations"`
}

BatchEvaluateRequest is the body for POST /access/v1/evaluations.

type BatchEvaluateResponse 

type BatchEvaluateResponse struct {
	Evaluations []EvaluateResponse `json:"evaluations"`
}

BatchEvaluateResponse is returned by POST /access/v1/evaluations.

type BatchVerifyItem 

type BatchVerifyItem struct {
	ID                     string                 `json:"id"`
	VPToken                string                 `json:"vp_token"`
	Nonce                  string                 `json:"nonce"`
	Audience               string                 `json:"audience,omitempty"`
	PresentationDefinition map[string]interface{} `json:"presentation_definition,omitempty"`
}

BatchVerifyItem is a single vp_token to verify.

type BatchVerifyResult 

type BatchVerifyResult struct {
	ID       string                 `json:"id"`
	Verified bool                   `json:"verified"`
	Error    string                 `json:"error,omitempty"`
	Claims   map[string]interface{} `json:"claims,omitempty"`
}

BatchVerifyResult is the verification outcome for one item.

type Branding 

type Branding struct {
	OrgID           string  `json:"org_id"`
	PrimaryColor    *string `json:"primary_color,omitempty"`
	BackgroundColor *string `json:"background_color,omitempty"`
	LogoURL         *string `json:"logo_url,omitempty"`
	FaviconURL      *string `json:"favicon_url,omitempty"`
	CustomCSS       *string `json:"custom_css,omitempty"`
}

Branding holds org-level login-page customisation.

type BrandingService 

type BrandingService struct {
	// contains filtered or unexported fields
}

BrandingService manages organisation branding settings.

func (*BrandingService) Get 

func (s *BrandingService) Get(ctx context.Context, orgID string) (*Branding, error)

Get returns the branding settings for orgID.

func (*BrandingService) Put 

func (s *BrandingService) Put(ctx context.Context, orgID string, b Branding) (*Branding, error)

Put replaces the branding settings for orgID.

type BreakGlassConfigParams 

type BreakGlassConfigParams struct {
	MaxUsesPerWeek     int      `json:"max_uses_per_week"`
	AutoRevokeHours    int      `json:"auto_revoke_hours"`
	NotificationEmails []string `json:"notification_emails"`
}

BreakGlassConfigParams configures the break-glass policy.

type CIBADeviceToken 

type CIBADeviceToken struct {
	ID          string    `json:"id"`
	OrgID       string    `json:"org_id"`
	UserID      string    `json:"user_id"`
	Platform    string    `json:"platform"` // "apns"|"fcm"
	DeviceToken string    `json:"device_token"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

CIBADeviceToken is a push token registered for a user's mobile device.

type CIBANotificationConfig 

type CIBANotificationConfig struct {
	OrgID                string            `json:"org_id"`
	WebhookURL           *string           `json:"webhook_url"`
	WebhookSecretSet     bool              `json:"webhook_secret_set"`
	WebhookHeaders       map[string]string `json:"webhook_headers"`
	EmailEnabled         bool              `json:"email_enabled"`
	SMSEnabled           bool              `json:"sms_enabled"`
	BaseURL              *string           `json:"base_url"`
	PushEnabled          bool              `json:"push_enabled"`
	APNsKeySet           bool              `json:"apns_key_set"`
	APNsKeyID            *string           `json:"apns_key_id"`
	APNsTeamID           *string           `json:"apns_team_id"`
	APNsBundleID         *string           `json:"apns_bundle_id"`
	APNsProduction       bool              `json:"apns_production"`
	FCMServiceAccountSet bool              `json:"fcm_service_account_set"`
}

CIBANotificationConfig is the per-org notification configuration returned by the API. Secret material is never returned — only *_set booleans indicate whether a value is stored.

type CIBARequest 

type CIBARequest struct {
	AuthReqID      string                 `json:"auth_req_id"`
	OrgID          string                 `json:"org_id"`
	ClientID       string                 `json:"client_id"`
	UserID         *string                `json:"user_id"`
	Scope          string                 `json:"scope"`
	BindingMessage *string                `json:"binding_message"`
	LoginHint      *string                `json:"login_hint"`
	Status         string                 `json:"status"` // "pending"|"approved"|"denied"
	Interval       int                    `json:"interval"`
	ExpiresAt      time.Time              `json:"expires_at"`
	CreatedAt      time.Time              `json:"created_at"`
	VPClaims       map[string]interface{} `json:"vp_claims,omitempty"`
	ACR            string                 `json:"acr,omitempty"`
}

CIBARequest is a pending (or recently resolved) backchannel auth request.

type CIBAService 

type CIBAService struct {
	// contains filtered or unexported fields
}

CIBAService manages the admin/management surface of OpenID CIBA Core 1.0: pending request approval, push device-token registration, and the per-org notification configuration (webhook / email / SMS / APNs / FCM).

The backchannel authorize and token-polling legs are OAuth endpoints driven by the relying party, not this management SDK. 

pending, err := client.CIBA.ListPending(ctx, orgID)
_, err = client.CIBA.Approve(ctx, orgID, pending[0].AuthReqID)

func (*CIBAService) Approve 

func (s *CIBAService) Approve(ctx context.Context, orgID, authReqID string) (string, error)

Approve marks a pending CIBA request as approved. The approved user is the one resolved from the original login_hint/id_token_hint; it cannot be substituted.

func (*CIBAService) DeleteDeviceToken 

func (s *CIBAService) DeleteDeviceToken(ctx context.Context, orgID, tokenID string) error

DeleteDeviceToken removes a push token by its UUID.

func (*CIBAService) DeleteNotificationConfig 

func (s *CIBAService) DeleteNotificationConfig(ctx context.Context, orgID string) error

DeleteNotificationConfig removes the CIBA notification configuration.

func (*CIBAService) Deny 

func (s *CIBAService) Deny(ctx context.Context, orgID, authReqID string) (string, error)

Deny marks a pending CIBA request as denied.

func (*CIBAService) GetNotificationConfig 

func (s *CIBAService) GetNotificationConfig(ctx context.Context, orgID string) (*CIBANotificationConfig, error)

GetNotificationConfig returns the CIBA notification configuration for an org.

func (*CIBAService) ListDeviceTokens 

func (s *CIBAService) ListDeviceTokens(ctx context.Context, orgID, userID string) ([]CIBADeviceToken, error)

ListDeviceTokens returns all registered push tokens for an org. Pass a non-empty userID to filter by user.

func (*CIBAService) ListPending 

func (s *CIBAService) ListPending(ctx context.Context, orgID string) ([]CIBARequest, error)

ListPending returns the pending CIBA requests for an org.

func (*CIBAService) PutNotificationConfig 

func (s *CIBAService) PutNotificationConfig(ctx context.Context, orgID string, p UpsertCIBANotificationConfigParams) (*CIBANotificationConfig, error)

PutNotificationConfig creates or replaces the CIBA notification configuration.

func (*CIBAService) RegisterDeviceToken 

func (s *CIBAService) RegisterDeviceToken(ctx context.Context, orgID string, p RegisterDeviceTokenParams) (*CIBADeviceToken, error)

RegisterDeviceToken registers a push token on behalf of a user (admin).

type CaptchaService 

type CaptchaService struct {
	// contains filtered or unexported fields
}

CaptchaService manages CAPTCHA settings for an organisation.

func (*CaptchaService) Delete 

func (s *CaptchaService) Delete(ctx context.Context, orgID string) error

Delete removes the CAPTCHA config, disabling CAPTCHA for orgID.

func (*CaptchaService) Get 

func (s *CaptchaService) Get(ctx context.Context, orgID string) (*CaptchaSettings, error)

Get returns the current CAPTCHA config for orgID.

func (*CaptchaService) Put 

func (s *CaptchaService) Put(ctx context.Context, orgID string, cfg CaptchaSettings) (*CaptchaSettings, error)

Put replaces the CAPTCHA config for orgID.

type CaptchaSettings 

type CaptchaSettings struct {
	OrgID    string `json:"org_id"`
	Provider string `json:"provider"` // "turnstile"|"hcaptcha"|"recaptcha"
	SiteKey  string `json:"site_key"`
	IsActive bool   `json:"is_active"`
}

CaptchaSettings holds bot-detection settings for an org.

type CheckoutResult 

type CheckoutResult struct {
	Checkout map[string]interface{} `json:"checkout"`
	Secret   string                 `json:"secret"`
	Warning  string                 `json:"warning,omitempty"`
}

CheckoutResult carries the (one-time) plaintext secret for a checkout.

type CircuitBreakerConfig 

type CircuitBreakerConfig struct {
	// Threshold is the number of consecutive failures that open the circuit.
	// Defaults to 5.
	Threshold int
	// Timeout is how long the circuit stays open before a trial request is
	// allowed through (half-open state). Defaults to 30s.
	Timeout time.Duration
}

CircuitBreakerConfig configures the circuit breaker that prevents cascading failures when the API is unavailable. 

client, _ := clavex.New(base, clavex.WithCircuitBreaker(clavex.CircuitBreakerConfig{
    Threshold: 5,
    Timeout:   30 * time.Second,
}))

type Client 

type Client struct {

	// Services — core
	Auth              *AuthService
	Organizations     *OrgService
	Users             *UserService
	Roles             *RoleService
	Groups            *GroupService
	Clients           *ClientService
	ClientScopes      *ClientScopeService
	ProtocolMappers   *ProtocolMapperService
	IdentityProviders *IDPService
	Sessions          *SessionService
	LDAP              *LDAPService
	MFA               *MFAService
	AuditLog          *AuditService
	Branding          *BrandingService
	PasswordPolicy    *PasswordPolicyService
	SMTP              *SMTPService
	CAPTCHA           *CaptchaService
	Webhooks          *WebhookService
	Invitations       *InvitationService
	SCIM              *SCIMService

	// Services — extended
	Policies      *PolicyService
	Usage         *UsageService
	LoginHistory  *LoginHistoryService
	RateLimits    *RateLimitService
	SSF           *SSFService
	AuthZen       *AuthZenService
	DeviceTrust   *DeviceTrustService
	CrossOrgTrust *CrossOrgTrustService
	APIKeys       *APIKeyService
	CIBA          *CIBAService

	// Services — EUDI wallet
	OID4VCI    *OID4VCIService
	OID4VP     *OID4VPService
	Mdoc       *MdocService
	Federation *FederationService

	// Services — authorization & privileged access
	FGA *FGAService
	PAM *PAMService

	// Services — governance & lifecycle
	ServiceAccounts *ServiceAccountService
	LoginFlows      *LoginFlowService
	LifecycleRules  *LifecycleRuleService
	ScimPush        *ScimPushService
	SamlSPs         *SamlSpService
	WsfedRPs        *WsfedRpService
	AppFamilies     *AppFamilyService
	AgentTokens     *AgentTokenService
	AccessReviews   *AccessReviewService
	EntityReviews   *EntityReviewService
	Compliance      *ComplianceService
	GDPR            *GdprService
	Actions         *ActionsService
	AI              *AIService
	Elevate         *ElevateService
	// contains filtered or unexported fields
}

Client is the root of the Clavex management SDK. All services are accessible as fields on this struct.

func New 

func New(baseURL string, opts ...Option) (*Client, error)

New creates a Clavex management client. 

client, err := clavex.New("https://auth.example.com",
    clavex.WithCredentials("acme", "admin@acme.com", "s3cr3t"),
)

type ClientScope 

type ClientScope struct {
	ID          string    `json:"id"`
	OrgID       string    `json:"org_id"`
	Name        string    `json:"name"`
	Description *string   `json:"description,omitempty"`
	Protocol    string    `json:"protocol"`
	IsDefault   bool      `json:"is_default"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

ClientScope is a reusable scope definition.

type ClientScopeService 

type ClientScopeService struct {
	// contains filtered or unexported fields
}

ClientScopeService manages custom OIDC scopes within an organisation.

func (*ClientScopeService) AssignToClient 

func (s *ClientScopeService) AssignToClient(ctx context.Context, orgID, clientID, scopeID string) error

AssignToClient attaches a scope to a client.

func (*ClientScopeService) Create 

func (s *ClientScopeService) Create(ctx context.Context, orgID string, p CreateClientScopeParams) (*ClientScope, error)

Create creates a new client scope.

func (*ClientScopeService) Delete 

func (s *ClientScopeService) Delete(ctx context.Context, orgID, scopeID string) error

Delete removes a client scope.

func (*ClientScopeService) List 

func (s *ClientScopeService) List(ctx context.Context, orgID string) ([]ClientScope, error)

List returns all client scopes in orgID.

func (*ClientScopeService) ListByClient 

func (s *ClientScopeService) ListByClient(ctx context.Context, orgID, clientID string) ([]ClientScope, error)

ListByClient returns the scopes assigned to a specific client.

func (*ClientScopeService) UnassignFromClient 

func (s *ClientScopeService) UnassignFromClient(ctx context.Context, orgID, clientID, scopeID string) error

UnassignFromClient detaches a scope from a client.

func (*ClientScopeService) Update 

func (s *ClientScopeService) Update(ctx context.Context, orgID, scopeID string, p CreateClientScopeParams) (*ClientScope, error)

Update modifies a client scope.

type ClientService 

type ClientService struct {
	// contains filtered or unexported fields
}

ClientService manages OIDC/OAuth2 clients within an organisation.

func (*ClientService) Create 

func (s *ClientService) Create(ctx context.Context, orgID string, p CreateClientParams) (*CreateClientResponse, error)

Create creates a new client in orgID.

func (*ClientService) Delete 

func (s *ClientService) Delete(ctx context.Context, orgID, clientID string) error

Delete removes a client.

func (*ClientService) Get 

func (s *ClientService) Get(ctx context.Context, orgID, clientID string) (*OIDCClient, error)

Get retrieves a single client.

func (*ClientService) List 

func (s *ClientService) List(ctx context.Context, orgID string) ([]OIDCClient, error)

List returns all clients in orgID.

func (*ClientService) RotateSecret 

func (s *ClientService) RotateSecret(ctx context.Context, orgID, clientID string) (*CreateClientResponse, error)

RotateSecret generates a new client secret and returns the updated client.

func (*ClientService) Update 

func (s *ClientService) Update(ctx context.Context, orgID, clientID string, p UpdateClientParams) (*OIDCClient, error)

Update modifies a client.

type ClientUsage 

type ClientUsage struct {
	ClientID   string `json:"client_id"`
	ClientName string `json:"client_name"`
	Logins     int    `json:"logins"`
}

ClientUsage is the per-application slice of the usage breakdown.

type ComplianceService 

type ComplianceService struct {
	// contains filtered or unexported fields
}

ComplianceService exposes compliance scoring, processing records and GDPR ops.

func (*ComplianceService) AuditPack 

func (s *ComplianceService) AuditPack(ctx context.Context, orgID string) (map[string]interface{}, error)

AuditPack generates a signed compliance audit pack.

func (*ComplianceService) CreateProcessingRecord 

func (s *ComplianceService) CreateProcessingRecord(ctx context.Context, orgID string, p ProcessingRecordParams) (map[string]interface{}, error)

func (*ComplianceService) DSAR 

func (s *ComplianceService) DSAR(ctx context.Context, orgID, userID string) (map[string]interface{}, error)

DSAR returns the data-subject-access report for a user.

func (*ComplianceService) DeleteProcessingRecord 

func (s *ComplianceService) DeleteProcessingRecord(ctx context.Context, orgID, recordID string) error

func (*ComplianceService) GDPRErasure 

func (s *ComplianceService) GDPRErasure(ctx context.Context, orgID, userID string) error

GDPRErasure erases a user's personal data (right to be forgotten).

func (*ComplianceService) GDPRExport 

func (s *ComplianceService) GDPRExport(ctx context.Context, orgID string) (map[string]interface{}, error)

GDPRExport triggers a GDPR data export.

func (*ComplianceService) GDPRReport 

func (s *ComplianceService) GDPRReport(ctx context.Context, orgID string) (map[string]interface{}, error)

GDPRReport returns the GDPR compliance report.

func (*ComplianceService) ListProcessingRecords 

func (s *ComplianceService) ListProcessingRecords(ctx context.Context, orgID string) ([]map[string]interface{}, error)

ListProcessingRecords returns the records of processing activities.

func (*ComplianceService) NIS2Report 

func (s *ComplianceService) NIS2Report(ctx context.Context, orgID string) (map[string]interface{}, error)

NIS2Report returns the NIS2 compliance report.

func (*ComplianceService) Score 

func (s *ComplianceService) Score(ctx context.Context, orgID string) (map[string]interface{}, error)

Score returns the current compliance score.

func (*ComplianceService) ScoreHistory 

func (s *ComplianceService) ScoreHistory(ctx context.Context, orgID string) ([]map[string]interface{}, error)

ScoreHistory returns the compliance score history.

func (*ComplianceService) UpdateProcessingRecord 

func (s *ComplianceService) UpdateProcessingRecord(ctx context.Context, orgID, recordID string, p ProcessingRecordParams) (map[string]interface{}, error)

type CreateAPIKeyParams 

type CreateAPIKeyParams struct {
	// Name is a human-readable label for the key (e.g. "terraform", "ci-pipeline").
	Name string `json:"name"`
	// ExpiresIn is the lifetime in seconds. 0 = no expiry.
	ExpiresIn int `json:"expires_in,omitempty"`
	// OrgID optionally scopes the key to a single organization (UUID).
	// Omitted/empty = superadmin key (cross-org, legacy behaviour).
	OrgID string `json:"org_id,omitempty"`
	// Permissions optionally restricts the key beyond org scoping, e.g.
	// []string{"clients:write"}. Omitted = unrestricted within scope.
	Permissions []string `json:"permissions,omitempty"`
}

CreateAPIKeyParams defines the fields for a new API key.

type CreateAPIKeyResult 

type CreateAPIKeyResult struct {
	APIKey APIKey `json:"api_key"`
	// Secret is the plaintext key value. Only returned at creation.
	Secret string `json:"secret"`
}

CreateAPIKeyResult holds the newly created API key. The Secret field is only present at creation time and will never be returned again — store it in a secrets manager immediately.

type CreateAccessRequestParams 

type CreateAccessRequestParams struct {
	ResourceType      string `json:"resource_type"`
	ResourceID        string `json:"resource_id"`
	ResourceName      string `json:"resource_name"`
	Justification     string `json:"justification"`
	RequestedDuration int    `json:"requested_duration"`
}

CreateAccessRequestParams requests just-in-time privileged access.

type CreateAccessReviewParams 

type CreateAccessReviewParams struct {
	Name         string  `json:"name"`
	Description  *string `json:"description,omitempty"`
	Frequency    string  `json:"frequency"`
	StartsAt     string  `json:"starts_at"`
	EndsAt       string  `json:"ends_at"`
	ReminderDays []int   `json:"reminder_days,omitempty"`
	AutoRevoke   bool    `json:"auto_revoke"`
}

CreateAccessReviewParams defines an access-review campaign.

type CreateActionExecutionParams 

type CreateActionExecutionParams struct {
	TargetID  string          `json:"target_id"`
	Name      string          `json:"name"`
	EventType string          `json:"event_type"`
	Condition json.RawMessage `json:"condition,omitempty"`
	Mode      string          `json:"mode,omitempty"`
	IsActive  *bool           `json:"is_active,omitempty"`
}

CreateActionExecutionParams binds an action target to an event.

type CreateClientParams 

type CreateClientParams struct {
	Name                string   `json:"name"`
	ClientID            string   `json:"client_id,omitempty"`
	RedirectURIs        []string `json:"redirect_uris"`
	PostLogoutRedirects []string `json:"post_logout_redirect_uris,omitempty"`
	GrantTypes          []string `json:"grant_types,omitempty"`
	ResponseTypes       []string `json:"response_types,omitempty"`
	IsPublic            bool     `json:"is_public,omitempty"`
	IsActive            *bool    `json:"is_active,omitempty"`
}

CreateClientParams defines the fields for creating a client.

type CreateClientResponse 

type CreateClientResponse struct {
	Client       OIDCClient `json:"client"`
	ClientSecret *string    `json:"client_secret,omitempty"`
}

CreateClientResponse is returned when creating a client. The plain-text secret is only present here and never exposed again.

type CreateClientScopeParams 

type CreateClientScopeParams struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
	Protocol    string `json:"protocol,omitempty"` // "openid-connect" | "saml"
}

CreateClientScopeParams defines the fields for a scope.

type CreateCredentialParams 

type CreateCredentialParams struct {
	Name                 string  `json:"name"`
	Description          *string `json:"description,omitempty"`
	CredentialType       string  `json:"credential_type"`
	Username             *string `json:"username,omitempty"`
	Secret               string  `json:"secret"`
	TargetHost           *string `json:"target_host,omitempty"`
	CheckoutDuration     int     `json:"checkout_duration"`
	RequireAccessRequest bool    `json:"require_access_request"`
	RotationIntervalDays *int    `json:"rotation_interval_days,omitempty"`
}

CreateCredentialParams defines a new vaulted credential.

type CreateCrossOrgTrustParams 

type CreateCrossOrgTrustParams struct {
	// TrustedOrgSlug is the slug of the org whose tokens will be accepted.
	TrustedOrgSlug string `json:"trusted_org_slug"`
	// AllowedScopes limits the scopes that can be exchanged. Empty = all.
	AllowedScopes []string `json:"allowed_scopes,omitempty"`
}

CreateCrossOrgTrustParams defines the fields for a cross-org trust.

type CreateElevateParams 

type CreateElevateParams struct {
	BearerToken    string   `json:"bearer_token"`
	Reason         string   `json:"reason"`
	AllowedMethods []string `json:"allowed_methods,omitempty"` // ["totp","webauthn"]; empty = all
}

CreateElevateParams starts a step-up challenge.

type CreateEntityReviewParams 

type CreateEntityReviewParams struct {
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
	EntityType  string  `json:"entity_type"`
	ReviewerID  string  `json:"reviewer_id"`
}

CreateEntityReviewParams defines an entity-review campaign.

type CreateGroupParams 

type CreateGroupParams struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
}

CreateGroupParams defines the fields for creating a group.

type CreateIACARootParams 

type CreateIACARootParams struct {
	Label    string   `json:"label"`
	PEM      string   `json:"pem"`
	DocTypes []string `json:"doc_types,omitempty"`
}

CreateIACARootParams uploads a trusted IACA root certificate.

type CreateIDPParams 

type CreateIDPParams struct {
	Name              string            `json:"name"`
	Type              string            `json:"type"` // "oidc" | "saml" | "google" | "github" | ...
	Enabled           *bool             `json:"enabled,omitempty"`
	Config            map[string]string `json:"config,omitempty"`
	AllowJIT          bool              `json:"allow_jit,omitempty"`
	RolesClaim        string            `json:"roles_claim,omitempty"`
	RoleClaimMappings map[string]string `json:"role_claim_mappings,omitempty"`
}

CreateIDPParams defines the fields for creating an identity provider.

type CreateInvitationParams 

type CreateInvitationParams struct {
	Email   string   `json:"email"`
	RoleIDs []string `json:"role_ids,omitempty"`
}

CreateInvitationParams holds the invitation request fields.

type CreateIssuerParams 

type CreateIssuerParams struct {
	DisplayName        string  `json:"display_name"`
	DocType            string  `json:"doc_type"`
	DSPrivateKeyPEM    string  `json:"ds_private_key_pem"`
	DSCertificatePEM   string  `json:"ds_certificate_pem"`
	IACACertificatePEM *string `json:"iaca_certificate_pem,omitempty"`
	ValidityHours      int     `json:"validity_hours,omitempty"`
}

CreateIssuerParams registers an issuer with caller-provided key material.

type CreateLDAPParams 

type CreateLDAPParams struct {
	Name            string `json:"name"`
	Vendor          string `json:"vendor,omitempty"` // "ad" | "openldap" | ...
	Host            string `json:"host"`
	Port            int    `json:"port,omitempty"`
	UseTLS          bool   `json:"use_tls,omitempty"`
	BindDN          string `json:"bind_dn"`
	BindPassword    string `json:"bind_password"`
	UsersDN         string `json:"users_dn"`
	UserObjectClass string `json:"user_object_class,omitempty"`
	UIDAttribute    string `json:"uid_attribute,omitempty"`
	EmailAttribute  string `json:"email_attribute,omitempty"`
	SyncEnabled     bool   `json:"sync_enabled,omitempty"`
}

CreateLDAPParams defines the fields for an LDAP connection.

type CreateLoginFlowParams 

type CreateLoginFlowParams struct {
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
	IsDefault   bool    `json:"is_default"`
}

CreateLoginFlowParams defines a new login flow.

type CreateOrgParams 

type CreateOrgParams struct {
	Name    string  `json:"name"`
	Slug    string  `json:"slug"`
	LogoURL *string `json:"logo_url,omitempty"`
}

CreateOrgParams defines the fields for creating an organisation.

type CreatePolicyRuleParams 

type CreatePolicyRuleParams struct {
	Name       string           `json:"name"`
	Priority   int              `json:"priority,omitempty"`
	Action     string           `json:"action"` // "allow" | "deny" | "require_mfa" | "step_up"
	Conditions PolicyConditions `json:"conditions,omitempty"`
}

CreatePolicyRuleParams defines the fields for creating a policy rule.

type CreateProtocolMapperParams 

type CreateProtocolMapperParams struct {
	Name       string            `json:"name"`
	Protocol   string            `json:"protocol"`    // "openid-connect" | "saml"
	MapperType string            `json:"mapper_type"` // e.g. "user-attribute"
	Config     map[string]string `json:"config,omitempty"`
}

CreateProtocolMapperParams defines the fields for a protocol mapper.

type CreateRoleParams 

type CreateRoleParams struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
}

CreateRoleParams defines the fields for creating a role.

type CreateSSFStreamParams 

type CreateSSFStreamParams struct {
	// EventTypes is the list of SET event URIs to subscribe to.
	// Example: "https://schemas.openid.net/secevent/risc/event-type/session-revoked"
	EventTypes []string `json:"event_types"`
	// DeliveryMethod is the RISC delivery method URI.
	// "push": https://schemas.openid.net/secevent/risc/delivery-method/push
	// "poll": https://schemas.openid.net/secevent/risc/delivery-method/poll
	DeliveryMethod string `json:"delivery_method"`
	// EndpointURL is the push receiver URL (required for push delivery).
	EndpointURL string `json:"endpoint_url,omitempty"`
	// Description is a human-readable label.
	Description string `json:"description,omitempty"`
}

CreateSSFStreamParams defines the fields for a new SSF stream.

type CreateSamlSpParams 

type CreateSamlSpParams struct {
	EntityID     string  `json:"entity_id"`
	Name         string  `json:"name"`
	ACSURL       string  `json:"acs_url"`
	SLOURL       *string `json:"slo_url,omitempty"`
	MetadataXML  *string `json:"metadata_xml,omitempty"`
	NameIDFormat string  `json:"name_id_format,omitempty"`
}

CreateSamlSpParams registers a SAML service provider.

type CreateScimPushParams 

type CreateScimPushParams struct {
	Name          string   `json:"name"`
	EndpointURL   string   `json:"endpoint_url"`
	BearerToken   string   `json:"bearer_token"`
	EnabledEvents []string `json:"enabled_events"`
}

CreateScimPushParams defines an outbound SCIM target.

type CreateServiceAccountParams 

type CreateServiceAccountParams struct {
	Name        string   `json:"name"`
	Description *string  `json:"description,omitempty"`
	Scopes      []string `json:"scopes,omitempty"`
}

CreateServiceAccountParams defines a new service account.

type CreateSinkParams 

type CreateSinkParams struct {
	// Type is the sink backend: "http" | "syslog" | "s3" | "splunk".
	Type   string            `json:"type"`
	Config map[string]string `json:"config"`
	// Events is the allow-list of event types to forward. Empty = all events.
	Events []string `json:"events,omitempty"`
}

CreateSinkParams defines the fields for an audit log sink.

type CreateTokenResult 

type CreateTokenResult struct {
	Token     string    `json:"token"`
	SCIMToken SCIMToken `json:"scim_token"`
}

CreateTokenResult holds the freshly generated SCIM token.

type CreateUserParams 

type CreateUserParams struct {
	Email      string            `json:"email"`
	Username   string            `json:"username,omitempty"`
	FirstName  string            `json:"first_name,omitempty"`
	LastName   string            `json:"last_name,omitempty"`
	Password   string            `json:"password,omitempty"`
	IsActive   *bool             `json:"is_active,omitempty"`
	RoleIDs    []string          `json:"role_ids,omitempty"`
	GroupIDs   []string          `json:"group_ids,omitempty"`
	Attributes map[string]string `json:"attributes,omitempty"`
}

CreateUserParams defines the fields for creating a user.

type CreateVCIConfigParams 

type CreateVCIConfigParams struct {
	VCT           string                 `json:"vct"`
	DisplayName   string                 `json:"display_name"`
	Description   *string                `json:"description,omitempty"`
	ClaimsMapping map[string]interface{} `json:"claims_mapping,omitempty"`
	TTLSeconds    int                    `json:"ttl_seconds,omitempty"`
	Category      string                 `json:"category,omitempty"` // identity|training|qualification|badge
	SchemaFields  []VCISchemaField       `json:"schema_fields,omitempty"`
}

CreateVCIConfigParams are the fields for a new credential configuration.

type CreateVCIOfferParams 

type CreateVCIOfferParams struct {
	UserID  *string                `json:"user_id,omitempty"`
	VCT     string                 `json:"vct"`
	TxCode  *string                `json:"tx_code,omitempty"`
	TTLMins int                    `json:"ttl_minutes,omitempty"`
	Payload map[string]interface{} `json:"payload,omitempty"`
}

CreateVCIOfferParams are the fields for a new credential offer.

type CreateVCIOfferResponse 

type CreateVCIOfferResponse struct {
	OfferID            string                 `json:"offer_id"`
	CredentialOffer    map[string]interface{} `json:"credential_offer"`
	CredentialOfferURI string                 `json:"credential_offer_uri"`
	ExpiresAt          time.Time              `json:"expires_at"`
}

CreateVCIOfferResponse is returned when an offer is created.

type CreateWebhookParams 

type CreateWebhookParams struct {
	URL      string   `json:"url"`
	Events   []string `json:"events"`
	Secret   string   `json:"secret,omitempty"`
	IsActive *bool    `json:"is_active,omitempty"`
}

CreateWebhookParams defines the fields for a webhook.

type CrossOrgTrust 

type CrossOrgTrust struct {
	ID             string    `json:"id"`
	OrgID          string    `json:"org_id"`
	TrustedOrgSlug string    `json:"trusted_org_slug"`
	TrustedOrgID   string    `json:"trusted_org_id"`
	AllowedScopes  []string  `json:"allowed_scopes,omitempty"`
	CreatedAt      time.Time `json:"created_at"`
}

CrossOrgTrust represents a token-exchange trust relationship.

type CrossOrgTrustService 

type CrossOrgTrustService struct {
	// contains filtered or unexported fields
}

CrossOrgTrustService manages RFC 8693 token exchange trust relationships between organisations. This allows users authenticated in org A to obtain tokens valid in org B without re-authenticating. 

trust, err := client.CrossOrgTrust.Create(ctx, orgID, clavex.CreateCrossOrgTrustParams{
    TrustedOrgSlug: "partner-corp",
    AllowedScopes:  []string{"openid", "profile"},
})

func (*CrossOrgTrustService) Create 

func (s *CrossOrgTrustService) Create(ctx context.Context, orgID string, p CreateCrossOrgTrustParams) (*CrossOrgTrust, error)

Create establishes a new cross-org trust relationship.

func (*CrossOrgTrustService) List 

func (s *CrossOrgTrustService) List(ctx context.Context, orgID string) ([]CrossOrgTrust, error)

List returns all cross-org trust relationships for orgID (outbound).

func (*CrossOrgTrustService) ListInbound 

func (s *CrossOrgTrustService) ListInbound(ctx context.Context, orgID string) ([]CrossOrgTrust, error)

ListInbound returns trusts where other orgs trust orgID.

func (*CrossOrgTrustService) Revoke 

func (s *CrossOrgTrustService) Revoke(ctx context.Context, orgID, trustID string) error

Revoke removes a cross-org trust relationship.

type DeviceTrustService 

type DeviceTrustService struct {
	// contains filtered or unexported fields
}

DeviceTrustService manages trusted devices for zero-trust session binding. 

devices, err := client.DeviceTrust.List(ctx, orgID, userID)

func (*DeviceTrustService) List 

func (s *DeviceTrustService) List(ctx context.Context, orgID, userID string) ([]TrustedDevice, error)

List returns all trusted devices for a user.

func (*DeviceTrustService) Revoke 

func (s *DeviceTrustService) Revoke(ctx context.Context, orgID, userID, deviceID string) error

Revoke removes a specific trusted device.

func (*DeviceTrustService) RevokeAll 

func (s *DeviceTrustService) RevokeAll(ctx context.Context, orgID, userID string) error

RevokeAll removes all trusted devices for a user.

type ElevateService 

type ElevateService struct {
	// contains filtered or unexported fields
}

ElevateService manages step-up authentication challenges for sensitive actions.

func (*ElevateService) Create 

func (s *ElevateService) Create(ctx context.Context, orgID string, p CreateElevateParams) (map[string]interface{}, error)

Create starts a step-up challenge.

func (*ElevateService) Get 

func (s *ElevateService) Get(ctx context.Context, orgID, challengeID string) (map[string]interface{}, error)

Get returns the status of a step-up challenge.

func (*ElevateService) Verify 

func (s *ElevateService) Verify(ctx context.Context, orgID, challengeID string, p VerifyElevateParams) (map[string]interface{}, error)

Verify completes a step-up challenge.

func (*ElevateService) WebAuthnBegin 

func (s *ElevateService) WebAuthnBegin(ctx context.Context, orgID, challengeID string) (map[string]interface{}, error)

WebAuthnBegin starts a WebAuthn step-up assertion.

type EntityReviewService 

type EntityReviewService struct {
	// contains filtered or unexported fields
}

EntityReviewService manages reviews of non-user entities (clients, IdPs, ...).

func (*EntityReviewService) Activate 

func (s *EntityReviewService) Activate(ctx context.Context, orgID, campaignID, reviewerID string) (map[string]interface{}, error)

func (*EntityReviewService) Create 

func (s *EntityReviewService) Create(ctx context.Context, orgID string, p CreateEntityReviewParams) (map[string]interface{}, error)

func (*EntityReviewService) Delete 

func (s *EntityReviewService) Delete(ctx context.Context, orgID, campaignID string) error

func (*EntityReviewService) Get 

func (s *EntityReviewService) Get(ctx context.Context, orgID, campaignID string) (map[string]interface{}, error)

func (*EntityReviewService) List 

func (s *EntityReviewService) List(ctx context.Context, orgID string) ([]map[string]interface{}, error)

func (*EntityReviewService) ListItems 

func (s *EntityReviewService) ListItems(ctx context.Context, orgID, campaignID string) ([]map[string]interface{}, error)

type ErrCircuitOpen 

type ErrCircuitOpen struct{}

ErrCircuitOpen is returned when all requests are blocked by the circuit breaker.

func (ErrCircuitOpen) Error 

func (ErrCircuitOpen) Error() string

type EvaluateRequest 

type EvaluateRequest struct {
	Subject  AZSubject  `json:"subject"`
	Resource AZResource `json:"resource"`
	Action   AZAction   `json:"action"`
	Context  AZContext  `json:"context,omitempty"`
}

EvaluateRequest is the body of POST /access/v1/evaluation (AuthZen §5).

type EvaluateResponse 

type EvaluateResponse struct {
	// Decision is true when the subject is allowed to perform the action.
	Decision bool `json:"decision"`
	// Context carries optional diagnostics: rule name, reason, mfa_required.
	Context map[string]any `json:"context,omitempty"`
}

EvaluateResponse is the AuthZen §6 evaluation response.

type FGAReadParams 

type FGAReadParams struct {
	User              string
	Relation          string
	Object            string
	PageSize          int
	ContinuationToken string
}

FGAReadParams filters a tuple read. Empty fields are treated as wildcards.

type FGAReadResult 

type FGAReadResult struct {
	Tuples            []FGATuple `json:"tuples"`
	ContinuationToken string     `json:"continuation_token,omitempty"`
}

FGAReadResult is a page of stored tuples.

type FGAService 

type FGAService struct {
	// contains filtered or unexported fields
}

FGAService manages the relationship-based authorization store: the authorization model, relationship tuples, and authorization checks. The model is an OpenFGA-style DSL/JSON document handled as raw JSON. 

allowed, err := client.FGA.Check(ctx, orgID, clavex.FGATuple{
    User: "user:alice", Relation: "viewer", Object: "doc:readme",
})

func (*FGAService) Check 

func (s *FGAService) Check(ctx context.Context, orgID string, t FGATuple) (bool, error)

Check evaluates whether the tuple's user has the relation on the object.

func (*FGAService) GetModel 

func (s *FGAService) GetModel(ctx context.Context, orgID string) (json.RawMessage, error)

GetModel returns the current authorization model as raw JSON.

func (*FGAService) GetStore 

func (s *FGAService) GetStore(ctx context.Context, orgID string) (*FGAStoreInfo, error)

GetStore returns the FGA store metadata for the org.

func (*FGAService) GetTemplate 

func (s *FGAService) GetTemplate(ctx context.Context, orgID, templateID string) (*FGATemplate, error)

GetTemplate returns a single model template.

func (*FGAService) ImportTemplate 

func (s *FGAService) ImportTemplate(ctx context.Context, orgID, templateID string) (string, error)

ImportTemplate applies a template's model to the org's store. Returns the new authorization model ID.

func (*FGAService) InitStore 

func (s *FGAService) InitStore(ctx context.Context, orgID string) (*FGAStoreInfo, error)

InitStore creates (or returns the existing) FGA store for the org.

func (*FGAService) ListTemplates 

func (s *FGAService) ListTemplates(ctx context.Context, orgID string) ([]FGATemplate, error)

ListTemplates returns the available model templates.

func (*FGAService) Read 

func (s *FGAService) Read(ctx context.Context, orgID string, p FGAReadParams) (*FGAReadResult, error)

Read returns stored tuples matching the (optional) filter.

func (*FGAService) Write 

func (s *FGAService) Write(ctx context.Context, orgID string, writes, deletes []FGATuple) error

Write applies tuple writes and deletes in a single transaction.

func (*FGAService) WriteModel 

func (s *FGAService) WriteModel(ctx context.Context, orgID string, model json.RawMessage) (string, error)

WriteModel replaces the authorization model. The model is an OpenFGA-style JSON document. Returns the new authorization model ID.

type FGAStoreInfo 

type FGAStoreInfo struct {
	StoreID   string  `json:"store_id"`
	ModelID   *string `json:"model_id"`
	Message   string  `json:"message,omitempty"`
	CreatedAt *string `json:"created_at,omitempty"`
	UpdatedAt *string `json:"updated_at,omitempty"`
}

FGAStoreInfo describes the org's FGA store.

type FGATemplate 

type FGATemplate struct {
	ID          string          `json:"id"`
	Name        string          `json:"name"`
	Description string          `json:"description,omitempty"`
	UseCases    []string        `json:"use_cases,omitempty"`
	Model       json.RawMessage `json:"model,omitempty"`
}

FGATemplate is a reusable authorization-model template.

type FGATuple 

type FGATuple struct {
	User     string `json:"user"`
	Relation string `json:"relation"`
	Object   string `json:"object"`
}

FGATuple is a relationship tuple (user, relation, object).

type FederationService 

type FederationService struct {
	// contains filtered or unexported fields
}

FederationService manages the OpenID Federation trust-anchor surface: subordinate entities and trust-mark types.

Subordinate operations identify the entity via the `entity_id` query parameter rather than a path segment, mirroring the backend API.

func (*FederationService) GetSubordinate 

func (s *FederationService) GetSubordinate(ctx context.Context, orgID, entityID string) (*FederationSubordinate, error)

GetSubordinate returns a single subordinate by entity ID.

func (*FederationService) ListSubordinates 

func (s *FederationService) ListSubordinates(ctx context.Context, orgID, status string) ([]FederationSubordinate, error)

ListSubordinates returns subordinate entities. status may be "active", "suspended", "revoked", "all", or empty for the default view.

func (*FederationService) ListTrustMarkTypes 

func (s *FederationService) ListTrustMarkTypes(ctx context.Context, orgID string) ([]TrustMarkType, error)

ListTrustMarkTypes returns the trust-mark types defined by this trust anchor.

func (*FederationService) RegisterSubordinate 

func (s *FederationService) RegisterSubordinate(ctx context.Context, orgID string, p RegisterSubordinateParams) (*FederationSubordinate, error)

RegisterSubordinate registers a new subordinate entity.

func (*FederationService) RevokeSubordinate 

func (s *FederationService) RevokeSubordinate(ctx context.Context, orgID, entityID string) error

RevokeSubordinate removes a subordinate entity.

func (*FederationService) RevokeTrustMark 

func (s *FederationService) RevokeTrustMark(ctx context.Context, orgID string, p RevokeTrustMarkParams) error

RevokeTrustMark revokes an issued trust mark for a subject. The backend DELETE endpoint accepts the parameters in the request body.

func (*FederationService) UpdateSubordinate 

func (s *FederationService) UpdateSubordinate(ctx context.Context, orgID, entityID string, p RegisterSubordinateParams) (*FederationSubordinate, error)

UpdateSubordinate updates an existing subordinate (identified by entity ID).

func (*FederationService) UpsertTrustMarkType 

func (s *FederationService) UpsertTrustMarkType(ctx context.Context, orgID string, p UpsertTrustMarkTypeParams) (*TrustMarkType, error)

UpsertTrustMarkType creates or replaces a trust-mark type.

type FederationSubordinate 

type FederationSubordinate struct {
	ID                       string    `json:"id"`
	EntityID                 string    `json:"entity_id"`
	Name                     string    `json:"name"`
	EntityTypes              []string  `json:"entity_types"`
	TrustMarkIDs             []string  `json:"trust_mark_ids,omitempty"`
	Status                   string    `json:"status"`
	StatementLifetimeSeconds int       `json:"statement_lifetime_seconds,omitempty"`
	CreatedAt                time.Time `json:"created_at"`
	UpdatedAt                time.Time `json:"updated_at"`
}

FederationSubordinate is a registered subordinate entity statement.

type FlowStep 

type FlowStep struct {
	ID       string          `json:"id"`
	FlowID   string          `json:"flow_id"`
	OrgID    string          `json:"org_id"`
	StepType string          `json:"step_type"`
	Position int             `json:"position"`
	Config   json.RawMessage `json:"config,omitempty"`
	IsActive bool            `json:"is_active"`
}

FlowStep is a stored login-flow step (read shape).

type GdprService 

type GdprService struct {
	// contains filtered or unexported fields
}

GdprService manages the GDPR data-retention policy.

func (*GdprService) DeleteRetentionPolicy 

func (s *GdprService) DeleteRetentionPolicy(ctx context.Context, orgID string) error

func (*GdprService) GetRetentionPolicy 

func (s *GdprService) GetRetentionPolicy(ctx context.Context, orgID string) (map[string]interface{}, error)

func (*GdprService) PutRetentionPolicy 

func (s *GdprService) PutRetentionPolicy(ctx context.Context, orgID string, p RetentionPolicyParams) (map[string]interface{}, error)

type GenerateIssuerParams 

type GenerateIssuerParams struct {
	DisplayName string `json:"display_name"`
	DocType     string `json:"doc_type,omitempty"`
}

GenerateIssuerParams requests a freshly generated self-signed DS/IACA pair.

type GenerateIssuerResponse 

type GenerateIssuerResponse struct {
	Issuer          MdocIssuer `json:"issuer"`
	DSCertificate   string     `json:"ds_certificate"`
	IACACertificate string     `json:"iaca_certificate"`
}

GenerateIssuerResponse carries the new issuer plus its generated certificates.

type Group 

type Group struct {
	ID        string    `json:"id"`
	OrgID     string    `json:"org_id"`
	Name      string    `json:"name"`
	CreatedAt time.Time `json:"created_at"`
}

Group represents a collection of users.

type GroupService 

type GroupService struct {
	// contains filtered or unexported fields
}

GroupService manages groups within an organisation.

func (*GroupService) AddMember 

func (s *GroupService) AddMember(ctx context.Context, orgID, groupID, userID string) error

AddMember adds a user to a group.

func (*GroupService) AssignRole 

func (s *GroupService) AssignRole(ctx context.Context, orgID, groupID, roleID string) error

AssignRole assigns a role to a group.

func (*GroupService) Create 

func (s *GroupService) Create(ctx context.Context, orgID string, p CreateGroupParams) (*Group, error)

Create creates a new group in orgID.

func (*GroupService) Delete 

func (s *GroupService) Delete(ctx context.Context, orgID, groupID string) error

Delete removes a group.

func (*GroupService) Get 

func (s *GroupService) Get(ctx context.Context, orgID, groupID string) (*Group, error)

Get retrieves a single group.

func (*GroupService) List 

func (s *GroupService) List(ctx context.Context, orgID string) ([]Group, error)

List returns all groups in orgID.

func (*GroupService) ListMembers 

func (s *GroupService) ListMembers(ctx context.Context, orgID, groupID string) ([]User, error)

ListMembers returns all users in a group.

func (*GroupService) ListRoles 

func (s *GroupService) ListRoles(ctx context.Context, orgID, groupID string) ([]Role, error)

ListRoles returns all roles assigned to a group.

func (*GroupService) RemoveMember 

func (s *GroupService) RemoveMember(ctx context.Context, orgID, groupID, userID string) error

RemoveMember removes a user from a group.

func (*GroupService) RemoveRole 

func (s *GroupService) RemoveRole(ctx context.Context, orgID, groupID, roleID string) error

RemoveRole unassigns a role from a group.

type HourRange 

type HourRange struct {
	From int `json:"from"`
	To   int `json:"to"`
}

HourRange is a UTC time window [From, To] (inclusive, 0-23).

type IACARoot 

type IACARoot struct {
	ID                string    `json:"id"`
	OrgID             string    `json:"org_id"`
	Label             string    `json:"label"`
	SubjectDN         string    `json:"subject_dn"`
	SHA256Fingerprint string    `json:"sha256_fingerprint"`
	PEM               string    `json:"pem"`
	DocTypes          []string  `json:"doc_types"`
	IsActive          bool      `json:"is_active"`
	CreatedAt         time.Time `json:"created_at"`
}

IACARoot is a trusted IACA root certificate.

type IDPService 

type IDPService struct {
	// contains filtered or unexported fields
}

IDPService manages identity providers (OIDC/SAML) within an organisation.

func (*IDPService) Create 

func (s *IDPService) Create(ctx context.Context, orgID string, p CreateIDPParams) (*IdentityProvider, error)

Create adds an identity provider to orgID.

func (*IDPService) Delete 

func (s *IDPService) Delete(ctx context.Context, orgID, idpID string) error

Delete removes an identity provider.

func (*IDPService) Get 

func (s *IDPService) Get(ctx context.Context, orgID, idpID string) (*IdentityProvider, error)

Get retrieves a single identity provider.

func (*IDPService) List 

func (s *IDPService) List(ctx context.Context, orgID string) ([]IdentityProvider, error)

List returns all identity providers in orgID.

func (*IDPService) Update 

func (s *IDPService) Update(ctx context.Context, orgID, idpID string, p CreateIDPParams) (*IdentityProvider, error)

Update modifies an identity provider.

type IdentityProvider 

type IdentityProvider struct {
	ID                string            `json:"id"`
	OrgID             string            `json:"org_id"`
	Name              string            `json:"name"`
	ProviderType      string            `json:"provider_type"`
	ClientID          string            `json:"client_id"`
	AuthorizationURL  string            `json:"authorization_url"`
	TokenURL          string            `json:"token_url"`
	UserinfoURL       *string           `json:"userinfo_url,omitempty"`
	Scopes            string            `json:"scopes"`
	EmailClaim        string            `json:"email_claim"`
	FirstNameClaim    string            `json:"first_name_claim"`
	LastNameClaim     string            `json:"last_name_claim"`
	IsActive          bool              `json:"is_active"`
	AllowJIT          bool              `json:"allow_jit"`
	RolesClaim        *string           `json:"roles_claim,omitempty"`
	RoleClaimMappings map[string]string `json:"role_claim_mappings,omitempty"`
	CreatedAt         time.Time         `json:"created_at"`
	UpdatedAt         time.Time         `json:"updated_at"`
}

IdentityProvider is an upstream OIDC/OAuth2 SSO provider.

type ImportUsersParams 

type ImportUsersParams struct {
	// Users is the list of user records to import.
	Users []CreateUserParams `json:"users"`
	// SkipExisting silently ignores users whose email already exists.
	SkipExisting bool `json:"skip_existing,omitempty"`
}

ImportUsersParams carries the import request body.

type Invitation 

type Invitation struct {
	ID        string    `json:"id"`
	OrgID     string    `json:"org_id"`
	Email     string    `json:"email"`
	RoleIDs   []string  `json:"role_ids,omitempty"`
	ExpiresAt time.Time `json:"expires_at"`
	CreatedAt time.Time `json:"created_at"`
}

Invitation is a pending email invite to join an org.

type InvitationService 

type InvitationService struct {
	// contains filtered or unexported fields
}

InvitationService manages pending user invitations.

func (*InvitationService) Create 

func (s *InvitationService) Create(ctx context.Context, orgID string, p CreateInvitationParams) (*Invitation, error)

Create sends an invitation email and records the invitation.

func (*InvitationService) Delete 

func (s *InvitationService) Delete(ctx context.Context, orgID, inviteID string) error

Delete revokes a pending invitation.

func (*InvitationService) List 

func (s *InvitationService) List(ctx context.Context, orgID string) ([]Invitation, error)

List returns all pending invitations for orgID.

type IssueAgentTokenParams 

type IssueAgentTokenParams struct {
	UserID      string  `json:"user_id"`
	AgentID     string  `json:"agent_id"`
	AgentName   string  `json:"agent_name"`
	Scope       string  `json:"scope,omitempty"`
	TTLSeconds  int     `json:"ttl_seconds,omitempty"`
	MCPServerID *string `json:"mcp_server_id,omitempty"`
	// Audience optionally overrides the token's "aud" claim (default: the
	// issuer). Must be present in the org's agent-token audience allowlist.
	// Typical use: cloud STS/WIF federation for Terraform, e.g.
	// "sts.amazonaws.com" (AWS), "api://AzureADTokenExchange" (Azure), or a
	// GCP Workload Identity Federation pool provider audience — the signed
	// token is then handed to the aws/azurerm/google Terraform provider's
	// native OIDC federation (assume_role_with_web_identity / use_oidc /
	// external_account); Clavex itself never calls the cloud STS/WIF APIs.
	Audience *string `json:"audience,omitempty"`
}

IssueAgentTokenParams issues a scoped agent token.

type IssuedAgentToken 

type IssuedAgentToken struct {
	Token     string `json:"token"`
	TokenID   string `json:"token_id"`
	ExpiresAt string `json:"expires_at"`
}

IssuedAgentToken carries the signed JWT (shown once) plus the record ID.

type LDAPConnection 

type LDAPConnection struct {
	ID         string     `json:"id"`
	OrgID      string     `json:"org_id"`
	Name       string     `json:"name"`
	Host       string     `json:"host"`
	Port       int        `json:"port"`
	UseTLS     bool       `json:"use_tls"`
	BindDN     *string    `json:"bind_dn,omitempty"`
	BaseDN     string     `json:"base_dn"`
	UserFilter string     `json:"user_filter"`
	IsActive   bool       `json:"is_active"`
	LastSyncAt *time.Time `json:"last_sync_at,omitempty"`
	CreatedAt  time.Time  `json:"created_at"`
}

LDAPConnection holds the configuration for an LDAP directory sync.

type LDAPService 

type LDAPService struct {
	// contains filtered or unexported fields
}

LDAPService manages LDAP federation connections for an organisation.

func (*LDAPService) Create 

func (s *LDAPService) Create(ctx context.Context, orgID string, p CreateLDAPParams) (*LDAPConnection, error)

Create creates a new LDAP connection in orgID.

func (*LDAPService) Delete 

func (s *LDAPService) Delete(ctx context.Context, orgID, ldapID string) error

Delete removes an LDAP connection.

func (*LDAPService) Get 

func (s *LDAPService) Get(ctx context.Context, orgID, ldapID string) (*LDAPConnection, error)

Get retrieves a single LDAP connection.

func (*LDAPService) List 

func (s *LDAPService) List(ctx context.Context, orgID string) ([]LDAPConnection, error)

List returns all LDAP connections in orgID.

func (*LDAPService) Sync 

func (s *LDAPService) Sync(ctx context.Context, orgID, ldapID string) error

Sync triggers an immediate LDAP user sync.

func (*LDAPService) TestConnection 

func (s *LDAPService) TestConnection(ctx context.Context, orgID, ldapID string) (*TestConnectionResult, error)

TestConnection verifies that the server can reach the LDAP host.

func (*LDAPService) Update 

func (s *LDAPService) Update(ctx context.Context, orgID, ldapID string, p CreateLDAPParams) (*LDAPConnection, error)

Update modifies an LDAP connection.

type LifecycleRule 

type LifecycleRule struct {
	ID          string          `json:"id"`
	OrgID       string          `json:"org_id"`
	Name        string          `json:"name"`
	Description *string         `json:"description,omitempty"`
	Trigger     string          `json:"trigger"`
	Priority    int             `json:"priority"`
	Conditions  json.RawMessage `json:"conditions"`
	Actions     json.RawMessage `json:"actions"`
	IsActive    bool            `json:"is_active"`
	CreatedAt   time.Time       `json:"created_at"`
	UpdatedAt   time.Time       `json:"updated_at"`
}

LifecycleRule is a joiner/mover/leaver automation rule.

type LifecycleRuleParams 

type LifecycleRuleParams struct {
	Name        string          `json:"name"`
	Description *string         `json:"description,omitempty"`
	Trigger     string          `json:"trigger"` // "joiner"|"mover"|"leaver"
	Priority    int             `json:"priority"`
	Conditions  json.RawMessage `json:"conditions"`
	Actions     json.RawMessage `json:"actions"`
	IsActive    *bool           `json:"is_active,omitempty"`
}

LifecycleRuleParams defines a lifecycle rule. Conditions and actions are passed as raw JSON to match the server's evolving rule schema.

type LifecycleRuleService 

type LifecycleRuleService struct {
	// contains filtered or unexported fields
}

LifecycleRuleService manages joiner/mover/leaver automation rules.

func (*LifecycleRuleService) Create 

func (s *LifecycleRuleService) Create(ctx context.Context, orgID string, p LifecycleRuleParams) (*LifecycleRule, error)

func (*LifecycleRuleService) Delete 

func (s *LifecycleRuleService) Delete(ctx context.Context, orgID, ruleID string) error

func (*LifecycleRuleService) Get 

func (s *LifecycleRuleService) Get(ctx context.Context, orgID, ruleID string) (*LifecycleRule, error)

func (*LifecycleRuleService) List 

func (s *LifecycleRuleService) List(ctx context.Context, orgID string) ([]LifecycleRule, error)

func (*LifecycleRuleService) Update 

func (s *LifecycleRuleService) Update(ctx context.Context, orgID, ruleID string, p LifecycleRuleParams) (*LifecycleRule, error)

type ListOptions 

type ListOptions struct {
	// Cursor is the opaque pagination cursor returned in the previous Page.
	// Leave empty to fetch the first page.
	Cursor string
	// Limit is the maximum number of items to return (0 = server default).
	Limit int
	// Page is the 1-based page number for offset-based endpoints.
	Page int
	// PerPage is the page size for offset-based endpoints.
	PerPage int
}

ListOptions carries optional parameters for paginated list calls.

Not all fields are honoured by every endpoint — unused fields are ignored.

type LoginFlow 

type LoginFlow struct {
	ID          string     `json:"id"`
	OrgID       string     `json:"org_id"`
	Name        string     `json:"name"`
	Description *string    `json:"description,omitempty"`
	IsDefault   bool       `json:"is_default"`
	IsActive    bool       `json:"is_active"`
	CreatedAt   time.Time  `json:"created_at"`
	UpdatedAt   time.Time  `json:"updated_at"`
	Steps       []FlowStep `json:"steps,omitempty"`
}

LoginFlow is a multi-step login flow.

type LoginFlowService 

type LoginFlowService struct {
	// contains filtered or unexported fields
}

LoginFlowService manages multi-step login flows and their client bindings.

func (*LoginFlowService) AssignClient 

func (s *LoginFlowService) AssignClient(ctx context.Context, orgID, flowID, clientID string) error

AssignClient binds a client to a flow.

func (*LoginFlowService) Create 

func (s *LoginFlowService) Create(ctx context.Context, orgID string, p CreateLoginFlowParams) (*LoginFlow, error)

func (*LoginFlowService) Delete 

func (s *LoginFlowService) Delete(ctx context.Context, orgID, flowID string) error

func (*LoginFlowService) Get 

func (s *LoginFlowService) Get(ctx context.Context, orgID, flowID string) (*LoginFlow, error)

func (*LoginFlowService) List 

func (s *LoginFlowService) List(ctx context.Context, orgID string) ([]LoginFlow, error)

func (*LoginFlowService) ListClients 

func (s *LoginFlowService) ListClients(ctx context.Context, orgID, flowID string) ([]string, error)

ListClients returns the client IDs bound to a flow.

func (*LoginFlowService) ReplaceSteps 

func (s *LoginFlowService) ReplaceSteps(ctx context.Context, orgID, flowID string, steps []LoginFlowStep) ([]FlowStep, error)

ReplaceSteps replaces the ordered steps of a flow.

func (*LoginFlowService) UnassignClient 

func (s *LoginFlowService) UnassignClient(ctx context.Context, orgID, flowID, clientID string) error

UnassignClient unbinds a client from a flow.

func (*LoginFlowService) Update 

func (s *LoginFlowService) Update(ctx context.Context, orgID, flowID string, p UpdateLoginFlowParams) (*LoginFlow, error)

type LoginFlowStep 

type LoginFlowStep struct {
	StepType string                 `json:"step_type"`
	Position int                    `json:"position"`
	Config   map[string]interface{} `json:"config,omitempty"`
	IsActive *bool                  `json:"is_active,omitempty"`
}

LoginFlowStep is one step in a login flow (write shape).

type LoginHistoryEntry 

type LoginHistoryEntry struct {
	ID         string    `json:"id"`
	OrgID      string    `json:"org_id"`
	UserID     *string   `json:"user_id,omitempty"`
	Email      string    `json:"email,omitempty"`
	ClientID   string    `json:"client_id,omitempty"`
	Method     string    `json:"method"` // "password"|"totp"|"webauthn"|"oidc"|...
	Success    bool      `json:"success"`
	IPAddress  *string   `json:"ip_address,omitempty"`
	Country    *string   `json:"country,omitempty"`
	UserAgent  *string   `json:"user_agent,omitempty"`
	FailReason *string   `json:"fail_reason,omitempty"`
	CreatedAt  time.Time `json:"created_at"`
}

LoginHistoryEntry is a single authentication event in the immutable log.

type LoginHistoryService 

type LoginHistoryService struct {
	// contains filtered or unexported fields
}

LoginHistoryService provides read access to the immutable authentication event log.

func (*LoginHistoryService) ListByOrg 

func (s *LoginHistoryService) ListByOrg(ctx context.Context, orgID string, opts ListOptions) (*Page[LoginHistoryEntry], error)

ListByOrg returns login history for the entire org (cursor-paginated). 

page, err := client.LoginHistory.ListByOrg(ctx, orgID, clavex.ListOptions{Limit: 100})

func (*LoginHistoryService) ListByUser 

func (s *LoginHistoryService) ListByUser(ctx context.Context, orgID, userID string, opts ListOptions) (*Page[LoginHistoryEntry], error)

ListByUser returns login history for a specific user (cursor-paginated).

type LoginParams 

type LoginParams struct {
	OrgSlug  string `json:"org_slug"`
	Email    string `json:"email"`
	Password string `json:"password"`
}

LoginParams holds credentials for manual login.

type LoginResponse 

type LoginResponse struct {
	Token        string `json:"token"`
	ExpiresIn    int    `json:"expires_in"`
	OrgID        string `json:"org_id"`
	OrgSlug      string `json:"org_slug"`
	IsSuperAdmin bool   `json:"is_super_admin"`
}

LoginResponse is returned by AuthService.Login.

type MFACredential 

type MFACredential struct {
	ID        string    `json:"id"`
	UserID    string    `json:"user_id"`
	Type      string    `json:"type"` // "totp" | "webauthn"
	Name      string    `json:"name"`
	IsPrimary bool      `json:"is_primary"`
	CreatedAt time.Time `json:"created_at"`
}

MFACredential holds a TOTP or WebAuthn credential for a user.

type MFAService 

type MFAService struct {
	// contains filtered or unexported fields
}

MFAService manages MFA credentials (admin view).

func (*MFAService) Delete 

func (s *MFAService) Delete(ctx context.Context, orgID, userID, credID string) error

Delete removes a specific MFA credential.

func (*MFAService) List 

func (s *MFAService) List(ctx context.Context, orgID, userID string) ([]MFACredential, error)

List returns all MFA credentials enrolled by a user.

type MdocIssuer 

type MdocIssuer struct {
	ID                 string    `json:"id"`
	OrgID              string    `json:"org_id"`
	DisplayName        string    `json:"display_name"`
	DocType            string    `json:"doc_type"`
	DSCertificatePEM   string    `json:"ds_certificate_pem"`
	IACACertificatePEM *string   `json:"iaca_certificate_pem,omitempty"`
	ValidityHours      int       `json:"validity_hours"`
	IsActive           bool      `json:"is_active"`
	CreatedAt          time.Time `json:"created_at"`
	UpdatedAt          time.Time `json:"updated_at"`
}

MdocIssuer is an org's mdoc Document Signer (DS) configuration.

type MdocService 

type MdocService struct {
	// contains filtered or unexported fields
}

MdocService manages ISO 18013-5 mdoc issuers and the IACA trust roots used to validate presented mobile documents (mDL, PID, etc).

func (*MdocService) CreateIACARoot 

func (s *MdocService) CreateIACARoot(ctx context.Context, orgID string, p CreateIACARootParams) (*IACARoot, error)

CreateIACARoot uploads a trusted IACA root certificate.

func (*MdocService) CreateIssuer 

func (s *MdocService) CreateIssuer(ctx context.Context, orgID string, p CreateIssuerParams) (*MdocIssuer, error)

CreateIssuer registers an issuer with caller-provided key material.

func (*MdocService) DeleteIACARoot 

func (s *MdocService) DeleteIACARoot(ctx context.Context, orgID, rootID string) error

DeleteIACARoot removes a trusted IACA root.

func (*MdocService) DeleteIssuer 

func (s *MdocService) DeleteIssuer(ctx context.Context, orgID, issuerID string) error

DeleteIssuer removes an mdoc issuer.

func (*MdocService) GenerateIssuer 

func (s *MdocService) GenerateIssuer(ctx context.Context, orgID string, p GenerateIssuerParams) (*GenerateIssuerResponse, error)

GenerateIssuer creates an issuer with a freshly generated self-signed DS pair.

func (*MdocService) GetSession 

func (s *MdocService) GetSession(ctx context.Context, orgID, sessionID string) (map[string]interface{}, error)

GetSession returns a single mdoc presentation session.

func (*MdocService) ListIACARoots 

func (s *MdocService) ListIACARoots(ctx context.Context, orgID string) ([]IACARoot, error)

ListIACARoots returns all trusted IACA roots for orgID.

func (*MdocService) ListIssuers 

func (s *MdocService) ListIssuers(ctx context.Context, orgID string) ([]MdocIssuer, error)

ListIssuers returns all mdoc issuers for orgID.

func (*MdocService) ListSessions 

func (s *MdocService) ListSessions(ctx context.Context, orgID string) ([]map[string]interface{}, error)

ListSessions returns mdoc presentation sessions for orgID.

type MockCall 

type MockCall struct {
	Method string
	Path   string
	// Body is the raw request body (may be empty for GET/DELETE).
	Body []byte
}

MockCall records a single HTTP request received by the MockServer.

type MockServer 

type MockServer struct {
	// contains filtered or unexported fields
}

MockServer is a test helper that simulates a Clavex management API. Use it in unit tests to avoid network calls to a real Clavex instance.

Quick start 

ms := clavex.NewMockServer()
defer ms.Close()

// Register a canned response.
ms.Respond("GET", "/api/v1/organizations/org-1/users", 200, []clavex.User{
    {ID: "usr-1", Email: "alice@example.com"},
})

client, _ := clavex.New(ms.URL(), clavex.WithToken("test-token"))
users, _ := client.Users.List(ctx, "org-1")
fmt.Println(users[0].Email) // "alice@example.com"

// Verify calls.
calls := ms.Calls()
assert.Equal(t, 1, len(calls))
assert.Equal(t, "GET", calls[0].Method)

func NewMockServer 

func NewMockServer() *MockServer

NewMockServer creates and starts a local HTTP test server. Call Close() when done.

func (*MockServer) Calls 

func (ms *MockServer) Calls() []MockCall

Calls returns a snapshot of all HTTP requests received so far.

func (*MockServer) CallsFor 

func (ms *MockServer) CallsFor(method, path string) []MockCall

CallsFor returns all recorded calls matching the given method and path.

func (*MockServer) Close 

func (ms *MockServer) Close()

Close shuts down the mock server.

func (*MockServer) HandleFunc 

func (ms *MockServer) HandleFunc(method, pattern string, fn func(http.ResponseWriter, *http.Request))

HandleFunc registers a handler for the given method and path pattern. Pass an empty method string to match any method. 

ms.HandleFunc("POST", "/api/v1/auth/login", func(w http.ResponseWriter, r *http.Request) {
    json.NewEncoder(w).Encode(clavex.LoginResponse{Token: "test", ExpiresIn: 3600})
})

func (*MockServer) Reset 

func (ms *MockServer) Reset()

Reset clears the recorded call history. Does not affect registered handlers.

func (*MockServer) Respond 

func (ms *MockServer) Respond(method, path string, statusCode int, body any)

Respond registers a fixed JSON response for the given method and URL path. body may be any JSON-serialisable value or nil for empty bodies. 

ms.Respond("GET", "/api/v1/organizations/org-1/users", 200, []clavex.User{...})
ms.Respond("DELETE", "/api/v1/organizations/org-1/users/usr-1", 204, nil)

func (*MockServer) RespondError 

func (ms *MockServer) RespondError(method, path string, statusCode int, message string)

RespondError registers a JSON error response (mirrors the Clavex APIError format). 

ms.RespondError("DELETE", "/api/v1/organizations/missing", 404, "organization not found")

func (*MockServer) ServeHTTP 

func (ms *MockServer) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP records the call and dispatches to registered handlers.

func (*MockServer) URL 

func (ms *MockServer) URL() string

URL returns the base URL of the mock server (e.g. "http://127.0.0.1:PORT").

type OID4VCIService 

type OID4VCIService struct {
	// contains filtered or unexported fields
}

OID4VCIService manages the issuance side of the EUDI wallet stack: credential configurations, the credential catalog, pre-authorized offers, issued credentials, and deferred issuance transactions. 

cfg, err := client.OID4VCI.CreateConfig(ctx, orgID, clavex.CreateVCIConfigParams{
    VCT:         "https://example.com/credentials/diploma",
    DisplayName: "University Diploma",
})

func (*OID4VCIService) AnalyticsSummary 

func (s *OID4VCIService) AnalyticsSummary(ctx context.Context, orgID string) (map[string]interface{}, error)

AnalyticsSummary returns issuance analytics for orgID.

func (*OID4VCIService) ApproveDeferred 

func (s *OID4VCIService) ApproveDeferred(ctx context.Context, orgID, txnID string) error

ApproveDeferred approves a deferred-issuance transaction.

func (*OID4VCIService) Catalog 

func (s *OID4VCIService) Catalog(ctx context.Context, orgID string) (map[string]interface{}, error)

Catalog returns the credential catalog (available seed templates / types).

func (*OID4VCIService) CreateConfig 

func (s *OID4VCIService) CreateConfig(ctx context.Context, orgID string, p CreateVCIConfigParams) (*VCICredentialConfig, error)

CreateConfig creates a new credential configuration.

func (*OID4VCIService) CreateOffer 

func (s *OID4VCIService) CreateOffer(ctx context.Context, orgID string, p CreateVCIOfferParams) (*CreateVCIOfferResponse, error)

CreateOffer creates a pre-authorized credential offer.

func (*OID4VCIService) DeleteConfig 

func (s *OID4VCIService) DeleteConfig(ctx context.Context, orgID, configID string) error

DeleteConfig removes a credential configuration.

func (*OID4VCIService) ListConfigs 

func (s *OID4VCIService) ListConfigs(ctx context.Context, orgID string) ([]VCICredentialConfig, error)

ListConfigs returns all credential configurations for orgID.

func (*OID4VCIService) ListDeferred 

func (s *OID4VCIService) ListDeferred(ctx context.Context, orgID string) ([]map[string]interface{}, error)

ListDeferred returns pending deferred-issuance transactions.

func (*OID4VCIService) ListIssued 

func (s *OID4VCIService) ListIssued(ctx context.Context, orgID string) ([]VCIIssuedCredential, error)

ListIssued returns issued credentials for orgID.

func (*OID4VCIService) ListOffers 

func (s *OID4VCIService) ListOffers(ctx context.Context, orgID string) ([]VCIOffer, error)

ListOffers returns all credential offers for orgID.

func (*OID4VCIService) PatchConfig 

func (s *OID4VCIService) PatchConfig(ctx context.Context, orgID, configID string, p PatchVCIConfigParams) (*VCICredentialConfig, error)

PatchConfig updates a credential configuration.

func (*OID4VCIService) RestoreIssued 

func (s *OID4VCIService) RestoreIssued(ctx context.Context, orgID, credID string) error

RestoreIssued un-revokes a previously revoked credential.

func (*OID4VCIService) RevokeIssued 

func (s *OID4VCIService) RevokeIssued(ctx context.Context, orgID, credID, reason string) error

RevokeIssued revokes an issued credential.

func (*OID4VCIService) SeedCatalog 

func (s *OID4VCIService) SeedCatalog(ctx context.Context, orgID, variant string) error

SeedCatalog seeds a built-in credential catalog template. Pass an empty variant to seed the default set, or a variant such as "mdl", "spid", "it-wallet", "cie", "cie-wallet", "age-over-18", "spid-mdl".

func (*OID4VCIService) SendOffer 

func (s *OID4VCIService) SendOffer(ctx context.Context, orgID, offerID string, p SendVCIOfferParams) (map[string]interface{}, error)

SendOffer delivers the offer deep-link via SMS or email.

type OID4VPService 

type OID4VPService struct {
	// contains filtered or unexported fields
}

OID4VPService manages the verification side of the EUDI wallet stack: inspecting presentation sessions and batch-verifying vp_tokens.

func (*OID4VPService) BatchVerify 

func (s *OID4VPService) BatchVerify(ctx context.Context, orgID string, items []BatchVerifyItem) ([]BatchVerifyResult, error)

BatchVerify verifies a batch of vp_tokens. Results are matched by item ID.

func (*OID4VPService) GetSession 

func (s *OID4VPService) GetSession(ctx context.Context, orgID, sessionID string) (*VPSession, error)

GetSession returns a single presentation session.

func (*OID4VPService) ListSessions 

func (s *OID4VPService) ListSessions(ctx context.Context, orgID string) ([]VPSession, error)

ListSessions returns the OID4VP presentation sessions for orgID.

type OIDCClient 

type OIDCClient struct {
	ClientID               string    `json:"client_id"`
	OrgID                  string    `json:"org_id"`
	Name                   string    `json:"name"`
	RedirectURIs           []string  `json:"redirect_uris"`
	PostLogoutRedirectURIs []string  `json:"post_logout_redirect_uris,omitempty"`
	GrantTypes             []string  `json:"grant_types,omitempty"`
	IsPublic               bool      `json:"is_public"`
	IsActive               bool      `json:"is_active"`
	LogoURL                *string   `json:"logo_url,omitempty"`
	CreatedAt              time.Time `json:"created_at"`
	UpdatedAt              time.Time `json:"updated_at"`
}

OIDCClient is an OIDC application registration.

type Option 

type Option func(*Client)

Option configures a Client.

func WithAPIKey added in v0.2.0 

func WithAPIKey(key string) Option

WithAPIKey configures the client to authenticate via the X-API-Key header instead of a JWT bearer token. Use this for machine-to-machine callers holding an admin API key (see APIKeyService / clavex_api_key) — including org-scoped keys (org_id set at creation), which is the credential model used by the Clavex Kubernetes Operator's per-CR authSecretRef.

func WithCircuitBreaker 

func WithCircuitBreaker(cfg CircuitBreakerConfig) Option

WithCircuitBreaker enables the circuit breaker.

func WithCredentials 

func WithCredentials(orgSlug, email, password string) Option

WithCredentials configures automatic login (fetches + refreshes the JWT).

func WithHTTPClient 

func WithHTTPClient(hc *http.Client) Option

WithHTTPClient replaces the default HTTP client.

func WithRetry 

func WithRetry(p RetryPolicy) Option

WithRetry configures automatic retries on transient errors.

func WithToken 

func WithToken(token string) Option

WithToken sets a pre-acquired admin JWT. The caller is responsible for renewal before the token expires.

type OrgService 

type OrgService struct {
	// contains filtered or unexported fields
}

OrgService manages organisations (superadmin operations).

func (*OrgService) Create 

func (s *OrgService) Create(ctx context.Context, p CreateOrgParams) (*Organization, error)

Create creates a new organisation. Requires superadmin privileges.

func (*OrgService) Delete 

func (s *OrgService) Delete(ctx context.Context, orgID string) error

Delete permanently removes an organisation and all its data.

func (*OrgService) Get 

func (s *OrgService) Get(ctx context.Context, orgID string) (*Organization, error)

Get retrieves an organisation by ID.

func (*OrgService) List 

func (s *OrgService) List(ctx context.Context) ([]Organization, error)

List returns all organisations. Requires superadmin privileges.

func (*OrgService) Update 

func (s *OrgService) Update(ctx context.Context, orgID string, p UpdateOrgParams) (*Organization, error)

Update modifies an organisation.

type OrgUsage 

type OrgUsage struct {
	OrgID          string         `json:"org_id"`
	WindowStart    time.Time      `json:"window_start"`
	WindowEnd      time.Time      `json:"window_end"`
	MAU            int            `json:"mau"` // Monthly Active Users
	DAU            int            `json:"dau"` // Daily Active Users (trailing 24h)
	TotalLogins    int            `json:"total_logins"`
	SuccessLogins  int            `json:"success_logins"`
	FailedLogins   int            `json:"failed_logins"`
	NewUsers       int            `json:"new_users"`
	LoginsByMethod map[string]int `json:"logins_by_method"` // e.g. {"password": 450, "google": 120}
	TopClients     []ClientUsage  `json:"top_clients,omitempty"`
}

OrgUsage holds aggregated authentication metrics for a 30-day window.

type Organization 

type Organization struct {
	ID          string            `json:"id"`
	Name        string            `json:"name"`
	Slug        string            `json:"slug"`
	LogoURL     *string           `json:"logo_url,omitempty"`
	Settings    map[string]string `json:"settings,omitempty"`
	IsActive    bool              `json:"is_active"`
	MFARequired bool              `json:"mfa_required"`
	CreatedAt   time.Time         `json:"created_at"`
	UpdatedAt   time.Time         `json:"updated_at"`
}

Organization represents a Clavex tenant.

type PAMCredential 

type PAMCredential struct {
	ID                   string     `json:"id"`
	OrgID                string     `json:"org_id"`
	Name                 string     `json:"name"`
	Description          *string    `json:"description,omitempty"`
	CredentialType       string     `json:"credential_type"`
	Username             *string    `json:"username,omitempty"`
	TargetHost           *string    `json:"target_host,omitempty"`
	CheckoutDuration     int        `json:"checkout_duration"`
	RequireAccessRequest bool       `json:"require_access_request"`
	IsActive             bool       `json:"is_active"`
	RotationIntervalDays *int       `json:"rotation_interval_days,omitempty"`
	LastRotatedAt        *time.Time `json:"last_rotated_at,omitempty"`
	CreatedAt            time.Time  `json:"created_at"`
	UpdatedAt            time.Time  `json:"updated_at"`
}

PAMCredential is a vaulted privileged credential (secret never returned here).

type PAMListResult 

type PAMListResult struct {
	Data    []map[string]interface{} `json:"data"`
	Total   int                      `json:"total"`
	Page    int                      `json:"page"`
	PerPage int                      `json:"per_page"`
}

PAMListResult is a paginated PAM listing.

type PAMPage 

type PAMPage struct {
	Page    int
	PerPage int
}

PAMPage selects a page for paginated PAM listings.

type PAMService 

type PAMService struct {
	// contains filtered or unexported fields
}

PAMService manages privileged access: just-in-time access requests, the credential vault (checkout/return), an SSH certificate authority, and recorded privileged sessions.

Access-request and session/credential read responses are returned as decoded JSON objects to remain forward-compatible with the evolving server-side records. Write inputs are strongly typed.

SECURITY: Checkout and CreateCredential return plaintext secrets that are shown only once — store them securely and never log them.

func (*PAMService) AddSessionEvent 

func (s *PAMService) AddSessionEvent(ctx context.Context, orgID, sessionID, eventType string, payload json.RawMessage) (map[string]interface{}, error)

AddSessionEvent appends an event to a session's recording.

func (*PAMService) ApproveAccessRequest 

func (s *PAMService) ApproveAccessRequest(ctx context.Context, orgID, reqID, note string) (map[string]interface{}, error)

ApproveAccessRequest approves a pending access request.

func (*PAMService) BreakGlass 

func (s *PAMService) BreakGlass(ctx context.Context, orgID string, p CreateAccessRequestParams) (map[string]interface{}, error)

BreakGlass creates an emergency break-glass access request.

func (*PAMService) Checkout 

func (s *PAMService) Checkout(ctx context.Context, orgID, credID, accessRequestID, reason string) (*CheckoutResult, error)

Checkout retrieves the plaintext secret for a credential for a limited time. The secret is shown only once — store it securely.

func (*PAMService) CreateAccessRequest 

func (s *PAMService) CreateAccessRequest(ctx context.Context, orgID string, p CreateAccessRequestParams) (map[string]interface{}, error)

CreateAccessRequest creates a new access request.

func (*PAMService) CreateCredential 

func (s *PAMService) CreateCredential(ctx context.Context, orgID string, p CreateCredentialParams) (*PAMCredential, error)

CreateCredential vaults a new credential. The response includes the stored record; the plaintext secret is only retrievable later via Checkout.

func (*PAMService) DeleteCredential 

func (s *PAMService) DeleteCredential(ctx context.Context, orgID, credID string) error

DeleteCredential removes a vaulted credential.

func (*PAMService) DeleteSSHCA 

func (s *PAMService) DeleteSSHCA(ctx context.Context, orgID string) error

DeleteSSHCA removes the SSH CA configuration.

func (*PAMService) DenyAccessRequest 

func (s *PAMService) DenyAccessRequest(ctx context.Context, orgID, reqID, note string) (map[string]interface{}, error)

DenyAccessRequest denies a pending access request.

func (*PAMService) EndSession 

func (s *PAMService) EndSession(ctx context.Context, orgID, sessionID string) error

EndSession terminates a privileged session.

func (*PAMService) GetAccessRequest 

func (s *PAMService) GetAccessRequest(ctx context.Context, orgID, reqID string) (map[string]interface{}, error)

GetAccessRequest returns a single access request.

func (*PAMService) GetBreakGlassConfig 

func (s *PAMService) GetBreakGlassConfig(ctx context.Context, orgID string) (map[string]interface{}, error)

GetBreakGlassConfig returns the break-glass policy and this week's usage.

func (*PAMService) GetCAPublicKey 

func (s *PAMService) GetCAPublicKey(ctx context.Context, orgID string) (string, error)

GetCAPublicKey returns the SSH CA public key in OpenSSH format (plain text).

func (*PAMService) GetSSHCA 

func (s *PAMService) GetSSHCA(ctx context.Context, orgID string) (map[string]interface{}, error)

GetSSHCA returns the SSH CA configuration.

func (*PAMService) GetSession 

func (s *PAMService) GetSession(ctx context.Context, orgID, sessionID string) (map[string]interface{}, error)

GetSession returns a single privileged session.

func (*PAMService) ListAccessRequests 

func (s *PAMService) ListAccessRequests(ctx context.Context, orgID, status string, page PAMPage) (*PAMListResult, error)

ListAccessRequests returns access requests. Pass status="" for all.

func (*PAMService) ListCredentials 

func (s *PAMService) ListCredentials(ctx context.Context, orgID string) ([]PAMCredential, error)

ListCredentials returns the vaulted credentials for orgID.

func (*PAMService) ListRotationLog 

func (s *PAMService) ListRotationLog(ctx context.Context, orgID, credID string) ([]map[string]interface{}, error)

ListRotationLog returns the rotation history for a credential.

func (*PAMService) ListSessionEvents 

func (s *PAMService) ListSessionEvents(ctx context.Context, orgID, sessionID string) ([]map[string]interface{}, error)

ListSessionEvents returns the events recorded for a session.

func (*PAMService) ListSessions 

func (s *PAMService) ListSessions(ctx context.Context, orgID string, page PAMPage) (*PAMListResult, error)

ListSessions returns recorded privileged sessions.

func (*PAMService) PutBreakGlassConfig 

func (s *PAMService) PutBreakGlassConfig(ctx context.Context, orgID string, p BreakGlassConfigParams) error

PutBreakGlassConfig creates or replaces the break-glass policy.

func (*PAMService) ReturnCheckout 

func (s *PAMService) ReturnCheckout(ctx context.Context, orgID, credID, checkoutID string) error

ReturnCheckout returns a checked-out credential early.

func (*PAMService) RevokeAccessRequest 

func (s *PAMService) RevokeAccessRequest(ctx context.Context, orgID, reqID, reason string) (map[string]interface{}, error)

RevokeAccessRequest revokes an approved access request.

func (*PAMService) SignSSHKey 

func (s *PAMService) SignSSHKey(ctx context.Context, orgID, publicKey, validPrincipals, accessRequestID string) (*SignSSHKeyResult, error)

SignSSHKey signs an SSH public key, returning a short-lived certificate.

func (*PAMService) StartSession 

func (s *PAMService) StartSession(ctx context.Context, orgID string, p StartSessionParams) (map[string]interface{}, error)

StartSession begins a recorded privileged session.

func (*PAMService) UpdateCredential 

func (s *PAMService) UpdateCredential(ctx context.Context, orgID, credID string, p UpdateCredentialParams) error

UpdateCredential modifies a vaulted credential.

func (*PAMService) UpsertSSHCA 

func (s *PAMService) UpsertSSHCA(ctx context.Context, orgID string, p SSHCAParams) error

UpsertSSHCA creates or replaces the SSH CA configuration.

type Page 

type Page[T any] struct {
	Items      []T    `json:"items"`
	Total      int    `json:"total,omitempty"`
	NextCursor string `json:"next_cursor,omitempty"`
	PrevCursor string `json:"prev_cursor,omitempty"`
	HasMore    bool   `json:"has_more,omitempty"`
}

Page is a single page of results returned by cursor-paginated list methods. 

page, err := client.Users.ListPage(ctx, orgID, clavex.ListOptions{Limit: 50})
for _, u := range page.Items {
    fmt.Println(u.Email)
}
if page.NextCursor != "" {
    next, err := client.Users.ListPage(ctx, orgID, clavex.ListOptions{
        Cursor: page.NextCursor, Limit: 50,
    })
}

type PasswordPolicy 

type PasswordPolicy struct {
	OrgID          string `json:"org_id"`
	MinLength      int    `json:"min_length"`
	RequireUpper   bool   `json:"require_upper"`
	RequireLower   bool   `json:"require_lower"`
	RequireNumber  bool   `json:"require_number"`
	RequireSpecial bool   `json:"require_special"`
	MaxAgeDays     int    `json:"max_age_days"`
	HistoryCount   int    `json:"history_count"`
	// Declarative-management marker (server migration 000179). Nil when the
	// section is hand-managed. Read-only from the SDK's perspective — set it
	// via WithManagedBy on the request context, not on the payload.
	ManagedBy  *string `json:"managed_by,omitempty"`
	ManagedRef *string `json:"managed_ref,omitempty"`
}

PasswordPolicy defines complexity rules for an org.

type PasswordPolicyService 

type PasswordPolicyService struct {
	// contains filtered or unexported fields
}

PasswordPolicyService manages the password policy for an organisation.

func (*PasswordPolicyService) Get 

func (s *PasswordPolicyService) Get(ctx context.Context, orgID string) (*PasswordPolicy, error)

Get returns the password policy for orgID.

func (*PasswordPolicyService) Put 

func (s *PasswordPolicyService) Put(ctx context.Context, orgID string, p PasswordPolicy) (*PasswordPolicy, error)

Put replaces the password policy for orgID.

func (*PasswordPolicyService) ReleaseManagedMarker added in v0.3.0 

func (s *PasswordPolicyService) ReleaseManagedMarker(ctx context.Context, orgID string) error

ReleaseManagedMarker clears the declarative-management marker on orgID's password policy without changing its configured values. A declarative caller (the Kubernetes operator) calls this when it stops managing the section.

type PatchVCIConfigParams 

type PatchVCIConfigParams struct {
	PreIssuanceWebhookURL     *string                `json:"pre_issuance_webhook_url,omitempty"`
	PreIssuanceWebhookSecret  *string                `json:"pre_issuance_webhook_secret,omitempty"`
	RequireVP                 *bool                  `json:"require_vp,omitempty"`
	PresentationDefinitionVPR map[string]interface{} `json:"presentation_definition_vpr,omitempty"`
	SourceIdpType             *string                `json:"source_idp_type,omitempty"`
	SelectiveDisclosure       *bool                  `json:"selective_disclosure,omitempty"`
	RequireKeyAttestation     *bool                  `json:"require_key_attestation,omitempty"`
	ClaimsMapping             map[string]interface{} `json:"claims_mapping,omitempty"`
}

PatchVCIConfigParams are the mutable fields of a credential configuration. Nil pointers leave the corresponding value unchanged.

type PolicyConditions 

type PolicyConditions struct {
	// IPCIDRs is an IP CIDR allowlist. Matches if the request IP is in any range.
	IPCIDRs []string `json:"ip_cidr,omitempty"`
	// Countries is an ISO 3166-1 alpha-2 allowlist.
	Countries []string `json:"country,omitempty"`
	// NotCountries is an ISO 3166-1 alpha-2 denylist.
	NotCountries []string `json:"country_not,omitempty"`
	// ClientIDs restricts the rule to specific OIDC client_ids.
	ClientIDs []string `json:"client_id,omitempty"`
	// MFAEnrolled matches users who have (true) or have not (false) enrolled MFA.
	MFAEnrolled *bool `json:"mfa_enrolled,omitempty"`
	// NewCountry matches when the request country is not in the 90-day baseline.
	NewCountry *bool `json:"new_country,omitempty"`
	// DaysOfWeek restricts to given UTC days ("Mon", "Tue", ...).
	DaysOfWeek []string `json:"day_of_week,omitempty"`
	// HourRange restricts to a UTC hour window (0–23).
	HourRange *HourRange `json:"hour_range,omitempty"`
	// LastLoginBefore matches when the last login was older than this duration
	// (Go duration string, e.g. "720h"). Absent LastLoginAt counts as infinite.
	LastLoginBefore string `json:"last_login_before,omitempty"`
}

PolicyConditions holds the optional match criteria for a policy rule. A nil/zero-value field means "no constraint on this signal".

type PolicyOutcome 

type PolicyOutcome struct {
	Action    string `json:"action"`
	RuleName  string `json:"rule_name,omitempty"`
	Reason    string `json:"reason,omitempty"`
	MFAForced bool   `json:"mfa_forced,omitempty"`
}

PolicyOutcome is the result of evaluating the policy engine.

type PolicyRule 

type PolicyRule struct {
	ID         string           `json:"id"`
	OrgID      string           `json:"org_id"`
	Name       string           `json:"name"`
	Priority   int              `json:"priority"`
	Action     string           `json:"action"` // "allow"|"deny"|"require_mfa"|"step_up"
	Conditions PolicyConditions `json:"conditions"`
	Enabled    bool             `json:"enabled"`
	CreatedAt  time.Time        `json:"created_at"`
	UpdatedAt  time.Time        `json:"updated_at"`
}

PolicyRule is a single named auth-flow policy rule.

type PolicyService 

type PolicyService struct {
	// contains filtered or unexported fields
}

PolicyService manages auth-flow policy rules for an organisation. Rules are evaluated in priority order during every authentication event.

Auth0 analogy: Actions / Rules. Okta analogy: Authentication Policies / Global Session Policy. 

// Block logins from Russia
rule, err := client.Policies.Create(ctx, orgID, clavex.CreatePolicyRuleParams{
    Name:     "block-russia",
    Priority: 10,
    Action:   "deny",
    Conditions: clavex.PolicyConditions{Countries: []string{"RU"}},
})

func (*PolicyService) Create 

func (s *PolicyService) Create(ctx context.Context, orgID string, p CreatePolicyRuleParams) (*PolicyRule, error)

Create adds a new policy rule to orgID.

func (*PolicyService) Delete 

func (s *PolicyService) Delete(ctx context.Context, orgID, ruleID string) error

Delete removes a policy rule.

func (*PolicyService) List 

func (s *PolicyService) List(ctx context.Context, orgID string) ([]PolicyRule, error)

List returns all auth-flow policy rules for orgID.

func (*PolicyService) Simulate 

func (s *PolicyService) Simulate(ctx context.Context, orgID string, p SimulateParams) (*SimulateResult, error)

Simulate performs a dry-run policy evaluation without side effects. Returns the outcome and a full trace of all rule evaluations. 

result, err := client.Policies.Simulate(ctx, orgID, clavex.SimulateParams{
    UserID:    "550e8400-...",
    IPAddress: "1.2.3.4",
    Country:   "CN",
})
fmt.Println(result.Outcome.Action, result.MFARequired)

func (*PolicyService) Update 

func (s *PolicyService) Update(ctx context.Context, orgID, ruleID string, p UpdatePolicyRuleParams) (*PolicyRule, error)

Update modifies a policy rule.

type PostureRecommendation 

type PostureRecommendation struct {
	Severity string `json:"severity"` // "critical"|"high"|"medium"|"low"
	Code     string `json:"code"`
	Title    string `json:"title"`
	Detail   string `json:"detail,omitempty"`
}

PostureRecommendation is a single actionable security improvement.

type ProcessingRecordParams 

type ProcessingRecordParams struct {
	ActivityName    string      `json:"activity_name"`
	Purpose         string      `json:"purpose"`
	LegalBasis      string      `json:"legal_basis"`
	DataCategories  []string    `json:"data_categories,omitempty"`
	DataSubjects    string      `json:"data_subjects"`
	RetentionPeriod string      `json:"retention_period"`
	Recipients      interface{} `json:"recipients,omitempty"`
	Processors      interface{} `json:"processors,omitempty"`
}

ProcessingRecordParams is a GDPR Article 30 record of processing activity.

type ProtocolMapper 

type ProtocolMapper struct {
	ID         string                 `json:"id"`
	ClientID   string                 `json:"client_id"`
	Name       string                 `json:"name"`
	Protocol   string                 `json:"protocol"`
	MapperType string                 `json:"mapper_type"`
	Config     map[string]interface{} `json:"config,omitempty"`
	CreatedAt  time.Time              `json:"created_at"`
	UpdatedAt  time.Time              `json:"updated_at"`
}

ProtocolMapper maps a claim from the token store to the issued JWT.

type ProtocolMapperService 

type ProtocolMapperService struct {
	// contains filtered or unexported fields
}

ProtocolMapperService manages protocol mappers attached to a client.

func (*ProtocolMapperService) Create 

func (s *ProtocolMapperService) Create(ctx context.Context, orgID, clientID string, p CreateProtocolMapperParams) (*ProtocolMapper, error)

Create adds a protocol mapper to a client.

func (*ProtocolMapperService) Delete 

func (s *ProtocolMapperService) Delete(ctx context.Context, orgID, clientID, mapperID string) error

Delete removes a protocol mapper.

func (*ProtocolMapperService) List 

func (s *ProtocolMapperService) List(ctx context.Context, orgID, clientID string) ([]ProtocolMapper, error)

List returns all protocol mappers for a client.

func (*ProtocolMapperService) Update 

func (s *ProtocolMapperService) Update(ctx context.Context, orgID, clientID, mapperID string, p CreateProtocolMapperParams) (*ProtocolMapper, error)

Update modifies a protocol mapper.

type RateLimitConfig 

type RateLimitConfig struct {
	OrgID string `json:"org_id,omitempty"`
	// MaxAttemptsPerMinute is the maximum login attempts per user per minute.
	MaxAttemptsPerMinute int `json:"max_attempts_per_minute"`
	// LockoutDurationSeconds is how long a user is locked out after exceeding
	// the threshold.
	LockoutDurationSeconds int `json:"lockout_duration_seconds"`
	// IPMaxAttemptsPerMinute limits attempts per source IP (0 = disabled).
	IPMaxAttemptsPerMinute int `json:"ip_max_attempts_per_minute,omitempty"`
	// Declarative-management marker (server migration 000179). Nil when the
	// section is hand-managed. Set it via WithManagedBy on the request context,
	// not on the payload.
	ManagedBy  *string `json:"managed_by,omitempty"`
	ManagedRef *string `json:"managed_ref,omitempty"`
}

RateLimitConfig defines per-org login rate-limit thresholds.

type RateLimitService 

type RateLimitService struct {
	// contains filtered or unexported fields
}

RateLimitService manages per-org login rate-limit configuration.

func (*RateLimitService) Get 

func (s *RateLimitService) Get(ctx context.Context, orgID string) (*RateLimitConfig, error)

Get returns the current rate-limit settings for orgID.

func (*RateLimitService) ReleaseManagedMarker added in v0.3.0 

func (s *RateLimitService) ReleaseManagedMarker(ctx context.Context, orgID string) error

ReleaseManagedMarker clears the declarative-management marker on orgID's rate-limit config without changing its configured values. A declarative caller (the Kubernetes operator) calls this when it stops managing the section.

func (*RateLimitService) Update 

func (s *RateLimitService) Update(ctx context.Context, orgID string, cfg RateLimitConfig) (*RateLimitConfig, error)

Update replaces the rate-limit settings for orgID.

type RegisterDeviceTokenParams 

type RegisterDeviceTokenParams struct {
	UserID      string `json:"user_id"`
	Platform    string `json:"platform"` // "apns"|"fcm"
	DeviceToken string `json:"device_token"`
}

RegisterDeviceTokenParams registers a push token on behalf of a user (admin).

type RegisterSubordinateParams 

type RegisterSubordinateParams struct {
	EntityID                 string                 `json:"entity_id"`
	Name                     string                 `json:"name"`
	EntityTypes              []string               `json:"entity_types"`
	JWKS                     map[string]interface{} `json:"jwks,omitempty"`
	JWKSURI                  string                 `json:"jwks_uri,omitempty"`
	MetadataOverride         map[string]interface{} `json:"metadata_override,omitempty"`
	MetadataPolicy           map[string]interface{} `json:"metadata_policy,omitempty"`
	TrustMarkIDs             []string               `json:"trust_mark_ids,omitempty"`
	Status                   string                 `json:"status,omitempty"`
	StatementLifetimeSeconds int                    `json:"statement_lifetime_seconds,omitempty"`
}

RegisterSubordinateParams registers or updates a subordinate entity.

type RetentionPolicyParams 

type RetentionPolicyParams struct {
	Enabled         bool     `json:"enabled"`
	RetentionDays   int      `json:"retention_days"`
	ActivityField   string   `json:"activity_field,omitempty"`
	ExemptRoleNames []string `json:"exempt_role_names,omitempty"`
}

RetentionPolicyParams configures inactive-data retention.

type RetryPolicy 

type RetryPolicy struct {
	// MaxAttempts is the total number of attempts including the first.
	// 1 means no retry (the default). Set to 3 for two retry attempts.
	MaxAttempts int
	// BaseDelay is the initial backoff interval. Doubles on each attempt.
	BaseDelay time.Duration
	// MaxDelay caps the exponential growth.
	MaxDelay time.Duration
	// RetryOn is the list of HTTP status codes that trigger a retry.
	// Defaults to [429, 502, 503, 504].
	RetryOn []int
}

RetryPolicy configures automatic request retries with exponential backoff. 

client, _ := clavex.New(base, clavex.WithRetry(clavex.RetryPolicy{
    MaxAttempts: 3,
    BaseDelay:   200 * time.Millisecond,
}))

type RevokeTrustMarkParams 

type RevokeTrustMarkParams struct {
	TrustMarkID string `json:"trust_mark_id"`
	Sub         string `json:"sub"`
	Reason      string `json:"reason,omitempty"`
}

RevokeTrustMarkParams revokes an issued trust mark for a subject.

type Role 

type Role struct {
	ID          string    `json:"id"`
	OrgID       string    `json:"org_id"`
	Name        string    `json:"name"`
	Description *string   `json:"description,omitempty"`
	IsSystem    bool      `json:"is_system"`
	CreatedAt   time.Time `json:"created_at"`
}

Role represents a named set of permissions within an org.

type RoleService 

type RoleService struct {
	// contains filtered or unexported fields
}

RoleService manages roles and role assignments within an organisation.

func (*RoleService) AddChild 

func (s *RoleService) AddChild(ctx context.Context, orgID, roleID, childID string) error

AddChild makes childID a child of roleID (composite role).

func (*RoleService) AssignToUser 

func (s *RoleService) AssignToUser(ctx context.Context, orgID, roleID, userID string) error

AssignToUser grants roleID to userID.

func (*RoleService) Create 

func (s *RoleService) Create(ctx context.Context, orgID string, p CreateRoleParams) (*Role, error)

Create creates a new role in orgID.

func (*RoleService) Delete 

func (s *RoleService) Delete(ctx context.Context, orgID, roleID string) error

Delete removes a role.

func (*RoleService) List 

func (s *RoleService) List(ctx context.Context, orgID string) ([]Role, error)

List returns all roles in orgID.

func (*RoleService) ListChildren 

func (s *RoleService) ListChildren(ctx context.Context, orgID, roleID string) ([]Role, error)

ListChildren returns the child roles of roleID.

func (*RoleService) RemoveChild 

func (s *RoleService) RemoveChild(ctx context.Context, orgID, roleID, childID string) error

RemoveChild removes childID from the children of roleID.

func (*RoleService) UnassignFromUser 

func (s *RoleService) UnassignFromUser(ctx context.Context, orgID, roleID, userID string) error

UnassignFromUser revokes roleID from userID.

type SCIMService 

type SCIMService struct {
	// contains filtered or unexported fields
}

SCIMService manages SCIM 2.0 bearer tokens for an organisation.

func (*SCIMService) CreateToken 

func (s *SCIMService) CreateToken(ctx context.Context, orgID string) (*CreateTokenResult, error)

CreateToken generates a new SCIM token.

func (*SCIMService) DeleteToken 

func (s *SCIMService) DeleteToken(ctx context.Context, orgID, tokenID string) error

DeleteToken revokes a SCIM token.

func (*SCIMService) ListTokens 

func (s *SCIMService) ListTokens(ctx context.Context, orgID string) ([]SCIMToken, error)

ListTokens returns all SCIM tokens for orgID.

type SCIMToken 

type SCIMToken struct {
	ID        string    `json:"id"`
	OrgID     string    `json:"org_id"`
	Name      string    `json:"name"`
	CreatedAt time.Time `json:"created_at"`
}

SCIMToken is a bearer credential that authorises inbound SCIM provisioning.

type SMTPConfig 

type SMTPConfig struct {
	OrgID    string `json:"org_id"`
	Host     string `json:"host"`
	Port     int    `json:"port"`
	Username string `json:"username"`
	UseTLS   bool   `json:"use_tls"`
	FromName string `json:"from_name"`
	FromAddr string `json:"from_addr"`
}

SMTPConfig holds outbound mail settings for an org.

type SMTPService 

type SMTPService struct {
	// contains filtered or unexported fields
}

SMTPService manages the SMTP settings for an organisation.

func (*SMTPService) Get 

func (s *SMTPService) Get(ctx context.Context, orgID string) (*SMTPConfig, error)

Get returns the SMTP config for orgID.

func (*SMTPService) Put 

func (s *SMTPService) Put(ctx context.Context, orgID string, cfg SMTPConfig) (*SMTPConfig, error)

Put replaces the SMTP config for orgID.

func (*SMTPService) Test 

func (s *SMTPService) Test(ctx context.Context, orgID string) (*SMTPTestResult, error)

Test sends a test email using the current SMTP config.

type SMTPTestResult 

type SMTPTestResult struct {
	Success bool   `json:"success"`
	Message string `json:"message,omitempty"`
}

SMTPTestResult holds the result of an SMTP send test.

type SSFPendingEvent 

type SSFPendingEvent struct {
	// JTI is the JWT ID — use it to acknowledge the event after processing.
	JTI       string `json:"jti"`
	EventType string `json:"event_type"`
	// Payload is the compact JWS of the Security Event Token.
	Payload   string    `json:"payload"`
	CreatedAt time.Time `json:"created_at"`
	ExpiresAt time.Time `json:"expires_at"`
}

SSFPendingEvent is a SET waiting to be consumed from a poll stream.

type SSFService 

type SSFService struct {
	// contains filtered or unexported fields
}

SSFService manages Shared Signals Framework (RFC 8935 / RFC 8936) streams.

SSF lets your app receive real-time security events (session revocation, account compromise, credential changes) from Clavex via push or poll. 

// Register a push stream
stream, err := client.SSF.Create(ctx, orgID, clavex.CreateSSFStreamParams{
    EventTypes:     []string{"session_revoked", "credential_changed"},
    DeliveryMethod: "https://schemas.openid.net/secevent/risc/delivery-method/push",
    EndpointURL:    "https://app.example.com/ssf/events",
})

func (*SSFService) Acknowledge 

func (s *SSFService) Acknowledge(ctx context.Context, orgID, streamID string, jtis []string) error

Acknowledge removes the given JTIs from the poll queue.

func (*SSFService) Create 

func (s *SSFService) Create(ctx context.Context, orgID string, p CreateSSFStreamParams) (*SSFStream, error)

Create registers a new SSF stream for orgID.

func (*SSFService) Delete 

func (s *SSFService) Delete(ctx context.Context, orgID, streamID string) error

Delete removes an SSF stream.

func (*SSFService) Get 

func (s *SSFService) Get(ctx context.Context, orgID, streamID string) (*SSFStream, error)

Get retrieves a single SSF stream.

func (*SSFService) List 

func (s *SSFService) List(ctx context.Context, orgID string) ([]SSFStream, error)

List returns all SSF streams for orgID.

func (*SSFService) Poll 

func (s *SSFService) Poll(ctx context.Context, orgID, streamID string, maxEvents int) ([]SSFPendingEvent, error)

Poll fetches pending SETs (Security Event Tokens) from a poll-delivery stream. Returns the raw SETs as compact JWTs. Call Acknowledge once processed. 

sets, err := client.SSF.Poll(ctx, orgID, streamID, 100)
jtis := make([]string, len(sets))
for i, set := range sets { jtis[i] = set.JTI }
_ = client.SSF.Acknowledge(ctx, orgID, streamID, jtis)

func (*SSFService) Update 

func (s *SSFService) Update(ctx context.Context, orgID, streamID string, p UpdateSSFStreamParams) (*SSFStream, error)

Update modifies an SSF stream (e.g. to pause or update event types).

func (*SSFService) Verify 

func (s *SSFService) Verify(ctx context.Context, orgID, streamID string) error

Verify fires a test SET to verify push endpoint connectivity.

type SSFStream 

type SSFStream struct {
	ID              string     `json:"id"`
	OrgID           string     `json:"org_id"`
	Description     string     `json:"description,omitempty"`
	Status          string     `json:"status"` // "enabled" | "paused" | "disabled"
	DeliveryMethod  string     `json:"delivery_method"`
	EndpointURL     *string    `json:"endpoint_url,omitempty"`
	EventTypes      []string   `json:"event_types"`
	CreatedAt       time.Time  `json:"created_at"`
	UpdatedAt       time.Time  `json:"updated_at"`
	LastDeliveredAt *time.Time `json:"last_delivered_at,omitempty"`
}

SSFStream represents a registered Shared Signals stream.

type SSHCAParams 

type SSHCAParams struct {
	VaultAddr            string `json:"vault_addr"`
	VaultToken           string `json:"vault_token"`
	VaultMount           string `json:"vault_mount,omitempty"`
	VaultRole            string `json:"vault_role"`
	CertTTLSeconds       int    `json:"cert_ttl_seconds,omitempty"`
	RequireAccessRequest bool   `json:"require_access_request"`
}

SSHCAParams configures the SSH CA (HashiCorp Vault-backed).

type SamlSP 

type SamlSP struct {
	ID           string    `json:"id"`
	OrgID        string    `json:"org_id"`
	EntityID     string    `json:"entity_id"`
	Name         string    `json:"name"`
	ACSURL       string    `json:"acs_url"`
	SLOURL       *string   `json:"slo_url,omitempty"`
	NameIDFormat string    `json:"name_id_format"`
	IsActive     bool      `json:"is_active"`
	CreatedAt    time.Time `json:"created_at"`
}

SamlSP is a registered SAML service provider.

type SamlSpService 

type SamlSpService struct {
	// contains filtered or unexported fields
}

SamlSpService manages SAML service providers (Clavex as IdP).

func (*SamlSpService) Create 

func (s *SamlSpService) Create(ctx context.Context, orgID string, p CreateSamlSpParams) (*SamlSP, error)

func (*SamlSpService) Delete 

func (s *SamlSpService) Delete(ctx context.Context, orgID, spID string) error

func (*SamlSpService) List 

func (s *SamlSpService) List(ctx context.Context, orgID string) ([]SamlSP, error)

type ScimPushService 

type ScimPushService struct {
	// contains filtered or unexported fields
}

ScimPushService manages outbound SCIM provisioning targets.

func (*ScimPushService) Create 

func (s *ScimPushService) Create(ctx context.Context, orgID string, p CreateScimPushParams) (map[string]interface{}, error)

func (*ScimPushService) Delete 

func (s *ScimPushService) Delete(ctx context.Context, orgID, id string) error

func (*ScimPushService) List 

func (s *ScimPushService) List(ctx context.Context, orgID string) ([]map[string]interface{}, error)

func (*ScimPushService) ListDeliveries 

func (s *ScimPushService) ListDeliveries(ctx context.Context, orgID, id string) ([]map[string]interface{}, error)

ListDeliveries returns the delivery log for a SCIM push target.

func (*ScimPushService) RetryDelivery 

func (s *ScimPushService) RetryDelivery(ctx context.Context, orgID, id, deliveryID string) error

RetryDelivery re-attempts a failed delivery.

func (*ScimPushService) Update 

func (s *ScimPushService) Update(ctx context.Context, orgID, id string, p UpdateScimPushParams) (map[string]interface{}, error)

type SecurityPosture 

type SecurityPosture struct {
	OrgID            string                  `json:"org_id"`
	Score            int                     `json:"score"` // 0–100
	MFAAdoptionPct   float64                 `json:"mfa_adoption_pct"`
	UnverifiedEmails int                     `json:"unverified_emails"`
	InactiveUsers    int                     `json:"inactive_users"`
	Recommendations  []PostureRecommendation `json:"recommendations,omitempty"`
}

SecurityPosture is the org-level security health summary.

type SendVCIOfferParams 

type SendVCIOfferParams struct {
	Channel string `json:"channel"` // "sms"|"email"
	To      string `json:"to,omitempty"`
}

SendVCIOfferParams selects the delivery channel for an offer deep-link.

type ServiceAccount 

type ServiceAccount struct {
	ID          string     `json:"id"`
	OrgID       string     `json:"org_id"`
	Name        string     `json:"name"`
	Description *string    `json:"description,omitempty"`
	ClientID    string     `json:"client_id"`
	Scopes      []string   `json:"scopes"`
	IsActive    bool       `json:"is_active"`
	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
	UpdatedAt   time.Time  `json:"updated_at"`
}

ServiceAccount is a machine-to-machine service account.

type ServiceAccountService 

type ServiceAccountService struct {
	// contains filtered or unexported fields
}

ServiceAccountService manages machine-to-machine service accounts.

func (*ServiceAccountService) Create 

func (s *ServiceAccountService) Create(ctx context.Context, orgID string, p CreateServiceAccountParams) (*ServiceAccountWithSecret, error)

func (*ServiceAccountService) Delete 

func (s *ServiceAccountService) Delete(ctx context.Context, orgID, id string) error

func (*ServiceAccountService) Get 

func (s *ServiceAccountService) Get(ctx context.Context, orgID, id string) (*ServiceAccount, error)

func (*ServiceAccountService) List 

func (s *ServiceAccountService) List(ctx context.Context, orgID string) ([]ServiceAccount, error)

func (*ServiceAccountService) RotateSecret 

func (s *ServiceAccountService) RotateSecret(ctx context.Context, orgID, id string) (*ServiceAccountWithSecret, error)

RotateSecret generates a new client secret (shown only once).

func (*ServiceAccountService) Update 

func (s *ServiceAccountService) Update(ctx context.Context, orgID, id string, p UpdateServiceAccountParams) (*ServiceAccount, error)

type ServiceAccountWithSecret 

type ServiceAccountWithSecret struct {
	ServiceAccount ServiceAccount `json:"service_account"`
	ClientSecret   string         `json:"client_secret"`
	SecretNote     string         `json:"secret_note,omitempty"`
}

ServiceAccountWithSecret is returned by create / rotate-secret; the secret is shown only once.

type SessionService 

type SessionService struct {
	// contains filtered or unexported fields
}

SessionService manages active user sessions.

func (*SessionService) ListByOrg 

func (s *SessionService) ListByOrg(ctx context.Context, orgID string) ([]ActiveSession, error)

ListByOrg returns all active sessions in an organisation.

func (*SessionService) ListByUser 

func (s *SessionService) ListByUser(ctx context.Context, orgID, userID string) ([]ActiveSession, error)

ListByUser returns active sessions for a specific user.

func (*SessionService) Revoke 

func (s *SessionService) Revoke(ctx context.Context, orgID, sessionID string) error

Revoke terminates a specific session.

func (*SessionService) RevokeAllByUser 

func (s *SessionService) RevokeAllByUser(ctx context.Context, orgID, userID string) error

RevokeAllByUser terminates every session for the given user.

type SignSSHKeyResult 

type SignSSHKeyResult struct {
	SignedKey    string   `json:"signed_key"`
	Principals   []string `json:"principals"`
	TTL          int      `json:"ttl"`
	ExpiresAt    string   `json:"expires_at"`
	Instructions string   `json:"instructions,omitempty"`
}

SignSSHKeyResult is the signed SSH certificate.

type SimulateParams 

type SimulateParams struct {
	// UserID is the user to evaluate (UUID). If empty, only IP/country/client
	// conditions are checked.
	UserID string `json:"user_id,omitempty"`
	// ClientID is the OIDC client_id being used in the flow.
	ClientID string `json:"client_id,omitempty"`
	// IPAddress to simulate (defaults to the calling IP).
	IPAddress string `json:"ip_address,omitempty"`
	// Country is the ISO 3166-1 alpha-2 override.
	Country string `json:"country,omitempty"`
	// UserAgent string.
	UserAgent string `json:"user_agent,omitempty"`
	// RequestTime overrides the evaluation clock (ISO 8601).
	RequestTime string `json:"request_time,omitempty"`
}

SimulateParams is the body for the policy dry-run endpoint.

type SimulateResult 

type SimulateResult struct {
	Outcome     PolicyOutcome       `json:"outcome"`
	MFARequired bool                `json:"mfa_required"`
	Trace       []SimulateTraceItem `json:"trace"`
	EvaluatedAt time.Time           `json:"evaluated_at"`
}

SimulateResult is the response from the policy dry-run endpoint.

type SimulateTraceItem 

type SimulateTraceItem struct {
	RuleName string `json:"rule_name"`
	Priority int    `json:"priority"`
	Enabled  bool   `json:"enabled"`
	Matched  bool   `json:"matched"`
	Action   string `json:"action"`
}

SimulateTraceItem describes one rule and whether it matched.

type StartSessionParams 

type StartSessionParams struct {
	AccessRequestID *string `json:"access_request_id,omitempty"`
	SessionType     string  `json:"session_type"`
	TargetHost      *string `json:"target_host,omitempty"`
	TargetPort      *int    `json:"target_port,omitempty"`
	TargetUser      *string `json:"target_user,omitempty"`
}

StartSessionParams begins a recorded privileged session.

type TestConnectionResult 

type TestConnectionResult struct {
	Success bool   `json:"success"`
	Message string `json:"message"`
}

TestConnectionResult holds the result of an LDAP connectivity test.

type TrustMarkType 

type TrustMarkType struct {
	TrustMarkID     string    `json:"trust_mark_id"`
	Name            string    `json:"name"`
	Description     string    `json:"description,omitempty"`
	LogoURI         string    `json:"logo_uri,omitempty"`
	RefURI          string    `json:"ref_uri,omitempty"`
	LifetimeSeconds int       `json:"lifetime_seconds,omitempty"`
	CreatedAt       time.Time `json:"created_at"`
}

TrustMarkType is a trust-mark type definition issued by this trust anchor.

type TrustedDevice 

type TrustedDevice struct {
	ID           string     `json:"id"`
	UserID       string     `json:"user_id"`
	OrgID        string     `json:"org_id"`
	Name         string     `json:"name,omitempty"`
	UserAgent    string     `json:"user_agent,omitempty"`
	IPAddress    string     `json:"ip_address,omitempty"`
	LastSeenAt   *time.Time `json:"last_seen_at,omitempty"`
	RegisteredAt time.Time  `json:"registered_at"`
}

TrustedDevice is a device the user has registered as trusted.

type UpdateClientParams 

type UpdateClientParams struct {
	Name                *string  `json:"name,omitempty"`
	RedirectURIs        []string `json:"redirect_uris,omitempty"`
	PostLogoutRedirects []string `json:"post_logout_redirect_uris,omitempty"`
	GrantTypes          []string `json:"grant_types,omitempty"`
	ResponseTypes       []string `json:"response_types,omitempty"`
	IsActive            *bool    `json:"is_active,omitempty"`
}

UpdateClientParams are the mutable fields of a client.

type UpdateCredentialParams 

type UpdateCredentialParams struct {
	Name                 *string `json:"name,omitempty"`
	Description          *string `json:"description,omitempty"`
	Username             *string `json:"username,omitempty"`
	Secret               *string `json:"secret,omitempty"`
	TargetHost           *string `json:"target_host,omitempty"`
	CheckoutDuration     *int    `json:"checkout_duration,omitempty"`
	RequireAccessRequest *bool   `json:"require_access_request,omitempty"`
	IsActive             *bool   `json:"is_active,omitempty"`
	RotationIntervalDays *int    `json:"rotation_interval_days,omitempty"`
}

UpdateCredentialParams are the mutable fields of a credential.

type UpdateLoginFlowParams 

type UpdateLoginFlowParams struct {
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
	IsDefault   bool    `json:"is_default"`
	IsActive    bool    `json:"is_active"`
}

UpdateLoginFlowParams updates a login flow.

type UpdateOrgParams 

type UpdateOrgParams struct {
	Name        *string `json:"name,omitempty"`
	LogoURL     *string `json:"logo_url,omitempty"`
	IsActive    *bool   `json:"is_active,omitempty"`
	MFARequired *bool   `json:"mfa_required,omitempty"`
}

UpdateOrgParams are the mutable fields of an Organisation.

type UpdatePolicyRuleParams 

type UpdatePolicyRuleParams struct {
	Name       *string          `json:"name,omitempty"`
	Priority   *int             `json:"priority,omitempty"`
	Enabled    *bool            `json:"enabled,omitempty"`
	Action     *string          `json:"action,omitempty"`
	Conditions PolicyConditions `json:"conditions,omitempty"`
}

UpdatePolicyRuleParams defines the mutable fields of a policy rule.

type UpdateSSFStreamParams 

type UpdateSSFStreamParams struct {
	EventTypes  []string `json:"event_types,omitempty"`
	EndpointURL *string  `json:"endpoint_url,omitempty"`
	Status      *string  `json:"status,omitempty"` // "enabled" | "paused" | "disabled"
	Description *string  `json:"description,omitempty"`
}

UpdateSSFStreamParams holds the mutable fields of an SSF stream.

type UpdateScimPushParams 

type UpdateScimPushParams struct {
	Name          *string  `json:"name,omitempty"`
	EndpointURL   *string  `json:"endpoint_url,omitempty"`
	BearerToken   *string  `json:"bearer_token,omitempty"`
	EnabledEvents []string `json:"enabled_events,omitempty"`
	IsActive      *bool    `json:"is_active,omitempty"`
}

UpdateScimPushParams updates an outbound SCIM target.

type UpdateServiceAccountParams 

type UpdateServiceAccountParams struct {
	Name        *string  `json:"name,omitempty"`
	Description *string  `json:"description,omitempty"`
	Scopes      []string `json:"scopes,omitempty"`
	IsActive    *bool    `json:"is_active,omitempty"`
}

UpdateServiceAccountParams are the mutable fields of a service account.

type UpdateUserParams 

type UpdateUserParams struct {
	Email      *string           `json:"email,omitempty"`
	Username   *string           `json:"username,omitempty"`
	FirstName  *string           `json:"first_name,omitempty"`
	LastName   *string           `json:"last_name,omitempty"`
	IsActive   *bool             `json:"is_active,omitempty"`
	Attributes map[string]string `json:"attributes,omitempty"`
}

UpdateUserParams are the mutable fields of a user.

type UpsertActionTargetParams 

type UpsertActionTargetParams struct {
	TargetType    string  `json:"target_type"`
	URL           string  `json:"url"`
	SandboxCode   *string `json:"sandbox_code,omitempty"`
	TimeoutMs     int     `json:"timeout_ms,omitempty"`
	SigningSecret *string `json:"signing_secret,omitempty"`
	IsActive      *bool   `json:"is_active,omitempty"`
}

UpsertActionTargetParams defines an action target (webhook/sandbox).

type UpsertCIBANotificationConfigParams 

type UpsertCIBANotificationConfigParams struct {
	WebhookURL            *string           `json:"webhook_url,omitempty"`
	WebhookSecret         *string           `json:"webhook_secret,omitempty"`
	WebhookHeaders        map[string]string `json:"webhook_headers,omitempty"`
	EmailEnabled          bool              `json:"email_enabled"`
	SMSEnabled            bool              `json:"sms_enabled"`
	BaseURL               *string           `json:"base_url,omitempty"`
	PushEnabled           bool              `json:"push_enabled"`
	APNsKeyP8             *string           `json:"apns_key_p8,omitempty"`
	APNsKeyID             *string           `json:"apns_key_id,omitempty"`
	APNsTeamID            *string           `json:"apns_team_id,omitempty"`
	APNsBundleID          *string           `json:"apns_bundle_id,omitempty"`
	APNsProduction        bool              `json:"apns_production"`
	FCMServiceAccountJSON *string           `json:"fcm_service_account_json,omitempty"`
}

UpsertCIBANotificationConfigParams creates or replaces the notification config. Secret fields (webhook_secret, apns_key_p8, fcm_service_account_json) are write-only; omit them to leave the stored value unchanged is NOT supported — the endpoint replaces the whole config.

type UpsertTrustMarkTypeParams 

type UpsertTrustMarkTypeParams struct {
	TrustMarkID     string `json:"trust_mark_id"`
	Name            string `json:"name"`
	Description     string `json:"description,omitempty"`
	LogoURI         string `json:"logo_uri,omitempty"`
	RefURI          string `json:"ref_uri,omitempty"`
	LifetimeSeconds int    `json:"lifetime_seconds,omitempty"`
}

UpsertTrustMarkTypeParams creates or replaces a trust-mark type.

type UsageService 

type UsageService struct {
	// contains filtered or unexported fields
}

UsageService provides tenant usage analytics for billing dashboards and security posture reports. 

usage, err := client.Usage.Get(ctx, orgID)
fmt.Printf("MAU: %d, DAU: %d\n", usage.MAU, usage.DAU)

func (*UsageService) Get 

func (s *UsageService) Get(ctx context.Context, orgID string) (*OrgUsage, error)

Get returns the usage statistics for orgID over the trailing 30 days.

func (*UsageService) SecurityPosture 

func (s *UsageService) SecurityPosture(ctx context.Context, orgID string) (*SecurityPosture, error)

SecurityPosture returns the security health summary for orgID. 

posture, err := client.Usage.SecurityPosture(ctx, orgID)
fmt.Println(posture.Score, posture.Recommendations)

type User 

type User struct {
	ID              string                 `json:"id"`
	OrgID           string                 `json:"org_id"`
	Email           string                 `json:"email"`
	FirstName       *string                `json:"first_name,omitempty"`
	LastName        *string                `json:"last_name,omitempty"`
	AvatarURL       *string                `json:"avatar_url,omitempty"`
	IsActive        bool                   `json:"is_active"`
	IsEmailVerified bool                   `json:"is_email_verified"`
	MFARequired     bool                   `json:"mfa_required"`
	RequiredActions []string               `json:"required_actions,omitempty"`
	Metadata        map[string]interface{} `json:"metadata,omitempty"`
	CreatedAt       time.Time              `json:"created_at"`
	UpdatedAt       time.Time              `json:"updated_at"`
	LastLoginAt     *time.Time             `json:"last_login_at,omitempty"`
}

User represents a Clavex user account.

type UserService 

type UserService struct {
	// contains filtered or unexported fields
}

UserService manages users within an organisation.

func (*UserService) Create 

func (s *UserService) Create(ctx context.Context, orgID string, p CreateUserParams) (*User, error)

Create creates a new user inside orgID.

func (*UserService) Delete 

func (s *UserService) Delete(ctx context.Context, orgID, userID string) error

Delete permanently removes a user.

func (*UserService) Get 

func (s *UserService) Get(ctx context.Context, orgID, userID string) (*User, error)

Get retrieves a single user.

func (*UserService) Impersonate 

func (s *UserService) Impersonate(ctx context.Context, orgID, userID string) (*LoginResponse, error)

Impersonate creates a short-lived session for the user and returns a JWT that can be used on behalf of that user.

func (*UserService) ImportUsers 

func (s *UserService) ImportUsers(ctx context.Context, orgID string, p ImportUsersParams) error

ImportUsers bulk-imports users into orgID.

func (*UserService) List 

func (s *UserService) List(ctx context.Context, orgID string) ([]User, error)

List returns every user in orgID.

func (*UserService) ListSessions 

func (s *UserService) ListSessions(ctx context.Context, orgID, userID string) ([]ActiveSession, error)

ListSessions returns all active sessions for a user.

func (*UserService) PatchAttributes 

func (s *UserService) PatchAttributes(ctx context.Context, orgID, userID string, attrs map[string]string) error

PatchAttributes merges custom attributes into the user record.

func (*UserService) RevokeAllSessions 

func (s *UserService) RevokeAllSessions(ctx context.Context, orgID, userID string) error

RevokeAllSessions terminates every active session for a user.

func (*UserService) SendPasswordReset 

func (s *UserService) SendPasswordReset(ctx context.Context, orgID, userID string) error

SendPasswordReset sends a password-reset email to the user.

func (*UserService) SetRequiredActions 

func (s *UserService) SetRequiredActions(ctx context.Context, orgID, userID string, actions []string) error

SetRequiredActions overwrites the list of actions the user must complete on next login (e.g. "VERIFY_EMAIL", "UPDATE_PASSWORD").

func (*UserService) Update 

func (s *UserService) Update(ctx context.Context, orgID, userID string, p UpdateUserParams) (*User, error)

Update modifies a user.

type VCICredentialConfig 

type VCICredentialConfig struct {
	ID            string                 `json:"id"`
	OrgID         string                 `json:"org_id"`
	VCT           string                 `json:"vct"`
	DisplayName   string                 `json:"display_name"`
	Description   *string                `json:"description,omitempty"`
	ClaimsMapping map[string]interface{} `json:"claims_mapping,omitempty"`
	TTLSeconds    int                    `json:"ttl_seconds"`
	Category      string                 `json:"category,omitempty"`
	SchemaFields  []VCISchemaField       `json:"schema_fields,omitempty"`
	IsActive      bool                   `json:"is_active"`
}

VCICredentialConfig is a credential-type configuration (SD-JWT VC issuance).

type VCIIssuedCredential 

type VCIIssuedCredential struct {
	ID               string     `json:"id"`
	OrgID            string     `json:"org_id"`
	UserID           *string    `json:"user_id,omitempty"`
	VCT              string     `json:"vct"`
	IssuedAt         time.Time  `json:"issued_at"`
	ExpiresAt        *time.Time `json:"expires_at,omitempty"`
	IsRevoked        bool       `json:"is_revoked"`
	RevokedAt        *time.Time `json:"revoked_at,omitempty"`
	RevocationReason *string    `json:"revocation_reason,omitempty"`
}

VCIIssuedCredential is an issued SD-JWT VC record.

type VCIOffer 

type VCIOffer struct {
	ID        string                 `json:"id"`
	OrgID     string                 `json:"org_id"`
	UserID    *string                `json:"user_id,omitempty"`
	VCT       string                 `json:"vct"`
	Status    string                 `json:"status"`
	ExpiresAt time.Time              `json:"expires_at"`
	CreatedAt time.Time              `json:"created_at"`
	Payload   map[string]interface{} `json:"payload,omitempty"`
}

VCIOffer is a pre-authorized credential offer.

type VCISchemaField 

type VCISchemaField struct {
	Name      string `json:"name"`
	Label     string `json:"label"`
	Type      string `json:"type"` // "string"|"date"|"number"|"url"
	Mandatory bool   `json:"mandatory"`
}

VCISchemaField describes one credential payload field for the admin issue UI.

type VPSession 

type VPSession struct {
	ID                     string                 `json:"id"`
	Status                 string                 `json:"status"`
	PresentationDefinition map[string]interface{} `json:"presentation_definition,omitempty"`
	DCQLQuery              map[string]interface{} `json:"dcql_query,omitempty"`
	Nonce                  string                 `json:"nonce,omitempty"`
	ExpiresAt              time.Time              `json:"expires_at"`
	VerifiedClaims         map[string]interface{} `json:"verified_claims,omitempty"`
	CreatedAt              time.Time              `json:"created_at"`
}

VPSession is an OID4VP presentation session.

type VerifyElevateParams 

type VerifyElevateParams struct {
	Method     string          `json:"method"` // "totp"|"webauthn"
	Code       string          `json:"code,omitempty"`
	Credential json.RawMessage `json:"credential,omitempty"`
}

VerifyElevateParams completes a step-up challenge.

type Webhook 

type Webhook struct {
	ID        string    `json:"id"`
	OrgID     string    `json:"org_id"`
	URL       string    `json:"url"`
	Events    []string  `json:"events"`
	IsActive  bool      `json:"is_active"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

Webhook is an outbound HTTP subscription.

type WebhookService 

type WebhookService struct {
	// contains filtered or unexported fields
}

WebhookService manages outbound webhooks for an organisation.

func (*WebhookService) Create 

func (s *WebhookService) Create(ctx context.Context, orgID string, p CreateWebhookParams) (*Webhook, error)

Create registers a new webhook.

func (*WebhookService) Delete 

func (s *WebhookService) Delete(ctx context.Context, orgID, webhookID string) error

Delete removes a webhook.

func (*WebhookService) List 

func (s *WebhookService) List(ctx context.Context, orgID string) ([]Webhook, error)

List returns all webhooks in orgID.

func (*WebhookService) Update 

func (s *WebhookService) Update(ctx context.Context, orgID, webhookID string, p CreateWebhookParams) (*Webhook, error)

Update modifies a webhook.

type WsfedRP 

type WsfedRP struct {
	ID                   string            `json:"id"`
	OrgID                string            `json:"org_id"`
	Name                 string            `json:"name"`
	Realm                string            `json:"realm"`
	WreplyURIs           []string          `json:"wreply_uris"`
	TokenLifetimeSeconds int               `json:"token_lifetime_seconds"`
	ClaimsMapping        map[string]string `json:"claims_mapping"`
	IsActive             bool              `json:"is_active"`
	CreatedAt            time.Time         `json:"created_at"`
	UpdatedAt            time.Time         `json:"updated_at"`
}

WsfedRP is a WS-Federation relying party.

type WsfedRpParams 

type WsfedRpParams struct {
	Name                 string            `json:"name"`
	Realm                string            `json:"realm"`
	WreplyURIs           []string          `json:"wreply_uris,omitempty"`
	TokenLifetimeSeconds int               `json:"token_lifetime_seconds,omitempty"`
	ClaimsMapping        map[string]string `json:"claims_mapping,omitempty"`
}

WsfedRpParams defines a WS-Fed relying party.

type WsfedRpService 

type WsfedRpService struct {
	// contains filtered or unexported fields
}

WsfedRpService manages WS-Federation relying parties.

func (*WsfedRpService) Create 

func (s *WsfedRpService) Create(ctx context.Context, orgID string, p WsfedRpParams) (*WsfedRP, error)

func (*WsfedRpService) Delete 

func (s *WsfedRpService) Delete(ctx context.Context, orgID, rpID string) error

func (*WsfedRpService) Get 

func (s *WsfedRpService) Get(ctx context.Context, orgID, rpID string) (*WsfedRP, error)

func (*WsfedRpService) List 

func (s *WsfedRpService) List(ctx context.Context, orgID string) ([]WsfedRP, error)

func (*WsfedRpService) Update 

func (s *WsfedRpService) Update(ctx context.Context, orgID, rpID string, p WsfedRpParams) (*WsfedRP, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.