> For the complete documentation index, see [llms.txt](/docs/llms.txt) # Apple | FusionAuth Docs Learn about the APIs for creating, retrieving, updating and disabling an Apple identity provider. # Apple [Edit on GitHub](https://github.com/FusionAuth/fusionauth-site/blob/main/astro/src/content/docs/apis/identity-providers/apple.mdx) [View Markdown](/docs/apis/identity-providers/apple.md) Available since version `1.17.0` The Apple identity provider type will use the Sign in with Apple APIs and will provide a Sign in with Apple button on FusionAuth's login page that will either redirect to an Apple sign in page or leverage native controls when using Safari on macOS or iOS. Additionally, this identity provider will call Apple's `/auth/token` API to load additional details about the user and store them in FusionAuth. FusionAuth will also store the Apple `refresh_token` returned from the /auth/token in the `identityProviderLink` object, in the **identityProviderLink.token** field. This object is accessible using the [Link API](/docs/apis/identity-providers/links). The `identityProviderLink` object stores the token so that you can use it in your application to call Apple APIs on behalf of the user if desired. Calling Apple APIs first requires a refresh grant to get a new access token. [More about the refresh grant](https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user) Prior to version `1.28.0`, the token was stored in the `UserRegistration` object, in the `tokens` Map. ## Create an Apple Identity Provider[#](#create-an-apple-identity-provider) ### Request[#](#request) Create an Apple Identity Provider using a randomly generated Id POST/api/identity-provider OpenAPI Spec Create an Apple Identity Provider with the provided unique Id POST/api/identity-provider/{identityProviderId} OpenAPI Spec The **type** in the request JSON is used to determine that you are managing an Apple identity provider. #### Request Parameters[#](#request-parameters) `identityProviderId`UUIDoptionalDefaults to secure random UUIDAvailable since 1.61.0Immutable The Id to use for the new Identity Provider. If an Id is not provided, a secure random UUID is generated. If neither an Id nor **identityProvider.name** are provided, the legacy fixed Apple IdP Id `13d2a5db-7ef9-4d62-b909-0df58612e775` will be used. #### Request Body `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].bundleId`StringoptionalAvailable since 1.43.0 This is an optional Application specific override for the top level **`bundleId`**. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **`buttonText`**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.applicationConfiguration[applicationId].keyId`UUIDoptional This is an optional Application specific override for the top level **`keyId`**. `identityProvider.applicationConfiguration[applicationId].scope`Stringoptional This is an optional Application specific override for the top level **`scope`**. `identityProvider.applicationConfiguration[applicationId].servicesId`Stringoptional This is an optional Application specific override for the top level **`servicesId`**. `identityProvider.applicationConfiguration[applicationId].teamId`Stringoptional This is an optional Application specific override for the top level **`teamId`**. `identityProvider.bundleId`StringoptionalAvailable since 1.43.0 The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. The request must include **`identityProvider.bundleId`** or **`identityProvider.servicesId`**. If **`identityProvider.servicesId`** is omitted, this field is required. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.debug`BooleanoptionalDefaults to false Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.keyId`UUIDrequired The unique Id of the private key downloaded from Apple and imported into Key Master that will be used to sign the client secret. `identityProvider.lambdaConfiguration.reconcileId`UUIDoptional The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. The specified Lambda Id must be of type `AppleReconcile`. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Apple Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.name`StringoptionalAvailable since 1.61.0 The display name of this provider instance. Required when using a provided **`identityProviderId`** or **`identityProvider.tenantId`**. `identityProvider.scope`Stringoptional The top-level space separated scope that you are requesting from Apple. Recommended value is `email name`. `identityProvider.servicesId`Stringoptional The Apple Services identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Services identifier is used to Sign in with Apple from web applications. Available since 1.43.0 The request must include **`identityProvider.bundleId`** or **`identityProvider.servicesId`**. If **`identityProvider.bundleId`** is omitted, this field is required. `identityProvider.teamId`Stringrequired The Apple App ID Prefix, or Team ID found in your Apple Developer Account which has been configured for Sign in with Apple. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `Apple`. *Example Apple Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "bundleId": "com.piedpiper.nativeapp", "buttonText": "Sign in with Apple", "debug": false, "enabled": true, "keyId": "2f81529c-4d39-4ce2-982e-cf5fbb1325f6", "lambdaConfiguration": { "reconcileId": "0d319f4e-faca-4ab8-b212-8fae6d23bf77" }, "scope": "email name", "name": "Apple Provider", "servicesId": "com.piedpiper.webapp", "teamId": "R4NQ1P4UEB", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Apple" } } ``` ### Response[#](#response) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 409 | A conflict was encountered processing this request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration` The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].bundleId`StringAvailable since 1.43.0 This is an optional Application specific override for the top level **bundleId**. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.applicationConfiguration[applicationId].keyId`UUID This is an optional Application specific override for the top level **keyId**. `identityProvider.applicationConfiguration[applicationId].scope`String This is an optional Application specific override for the top level **scope**. `identityProvider.applicationConfiguration[applicationId].servicesId`String This is an optional Application specific override for the top level **servicesId**. `identityProvider.applicationConfiguration[applicationId].teamId`String This is an optional Application specific override for the top level **teamId**. `identityProvider.bundleId`StringAvailable since 1.43.0 The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.debug`BooleanDefaults to false Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The unique Id of the private key downloaded from Apple and imported into Key Master that will be used to sign the client secret. `identityProvider.lambdaConfiguration.reconcileId`UUID The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of the provider. `identityProvider.scope`String The top-level space separated scope that you are requesting from Apple. `identityProvider.servicesId`String The Apple Services identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Services identifier is used to Sign in with Apple from web applications. `identityProvider.teamId`String The Apple App ID Prefix, or Team ID found in your Apple Developer Account which has been configured for Sign in with Apple. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Apple` *Example Apple Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "bundleId": "com.piedpiper.nativeapp", "buttonText": "Sign in with Apple", "debug": false, "enabled": true, "id": "8d1c7b8f-7c52-4f2c-9ea0-a5ccc8b3f504", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "2f81529c-4d39-4ce2-982e-cf5fbb1325f6", "lambdaConfiguration": { "reconcileId": "0d319f4e-faca-4ab8-b212-8fae6d23bf77" }, "name": "Apple Provider", "scope": "email name", "servicesId": "com.piedpiper.webapp", "teamId": "R4NQ1P4UEB", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Apple" } } ``` ## Retrieve an Apple Identity Provider[#](#retrieve-an-apple-identity-provider) ### Request[#](#request-1) Retrieve an Apple Identity Provider by Id GET/api/identity-provider/{identityProviderId} OpenAPI Spec Retrieve Apple Identity Providers by type GET/api/identity-provider?type=Apple OpenAPI Spec #### Request Parameters[#](#request-parameters-1) `identityProviderId`UUIDrequired The unique Id of the Apple Identity Provider to retrieve. ### Response[#](#response-1) *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration` The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].bundleId`StringAvailable since 1.43.0 This is an optional Application specific override for the top level **bundleId**. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.applicationConfiguration[applicationId].keyId`UUID This is an optional Application specific override for the top level **keyId**. `identityProvider.applicationConfiguration[applicationId].scope`String This is an optional Application specific override for the top level **scope**. `identityProvider.applicationConfiguration[applicationId].servicesId`String This is an optional Application specific override for the top level **servicesId**. `identityProvider.applicationConfiguration[applicationId].teamId`String This is an optional Application specific override for the top level **teamId**. `identityProvider.bundleId`StringAvailable since 1.43.0 The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.debug`BooleanDefaults to false Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The unique Id of the private key downloaded from Apple and imported into Key Master that will be used to sign the client secret. `identityProvider.lambdaConfiguration.reconcileId`UUID The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of the provider. `identityProvider.scope`String The top-level space separated scope that you are requesting from Apple. `identityProvider.servicesId`String The Apple Services identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Services identifier is used to Sign in with Apple from web applications. `identityProvider.teamId`String The Apple App ID Prefix, or Team ID found in your Apple Developer Account which has been configured for Sign in with Apple. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Apple` *Example Apple Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "bundleId": "com.piedpiper.nativeapp", "buttonText": "Sign in with Apple", "debug": false, "enabled": true, "id": "8d1c7b8f-7c52-4f2c-9ea0-a5ccc8b3f504", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "2f81529c-4d39-4ce2-982e-cf5fbb1325f6", "lambdaConfiguration": { "reconcileId": "0d319f4e-faca-4ab8-b212-8fae6d23bf77" }, "name": "Apple Provider", "scope": "email name", "servicesId": "com.piedpiper.webapp", "teamId": "R4NQ1P4UEB", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Apple" } } ``` ## Update an Apple Identity Provider[#](#update-an-apple-identity-provider) This API is used to update an existing Apple Identity Provider. You must specify all of the properties of the Apple Identity Provider when calling this API with the `PUT` HTTP method. When used with `PUT`, this API doesn't merge the existing Apple Identity Provider and your new data. It replaces the existing Apple Identity Provider with your new data. Utilize the `PATCH` HTTP method to send specific changes to merge into an existing Apple Identity Provider. ### Request[#](#request-2) Update an Apple Identity Provider by Id PUT/api/identity-provider/{identityProviderId} OpenAPI Spec PATCH/api/identity-provider/{identityProviderId} OpenAPI Spec For backward compatibility, the `PATCH` method accepts the same media type (specified by a `Content-Type` of `application/json`) and body as the `PUT` request. You can also use the following media types for different behavior: * [JSON Patch/RFC 6902](https://www.rfc-editor.org/rfc/rfc6902): `application/json-patch+json` * [JSON Merge Patch/RFC 7396](https://www.rfc-editor.org/rfc/rfc7396): `merge-patch+json` For details, see the [PATCH documentation](/docs/apis/#the-patch-http-method). Using a media type of `application/json` merges the provided request parameters into the existing object. As a result, all parameters are optional with `PATCH`: only provide the values you want to change. To remove a value, provide a `null` value. Patching an `Array` appends all values in the new list to the old list. Update an Apple Identity Provider by type (deprecated) PUT/api/identity-provider?type=Apple PATCH/api/identity-provider?type=Apple For backward compatibility, the `PATCH` method accepts the same media type (specified by a `Content-Type` of `application/json`) and body as the `PUT` request. You can also use the following media types for different behavior: * [JSON Patch/RFC 6902](https://www.rfc-editor.org/rfc/rfc6902): `application/json-patch+json` * [JSON Merge Patch/RFC 7396](https://www.rfc-editor.org/rfc/rfc7396): `merge-patch+json` For details, see the [PATCH documentation](/docs/apis/#the-patch-http-method). Using a media type of `application/json` merges the provided request parameters into the existing object. As a result, all parameters are optional with `PATCH`: only provide the values you want to change. To remove a value, provide a `null` value. Patching an `Array` appends all values in the new list to the old list. Deprecated since 1.61.0 Prefer updating by Id. Updating by type attempts to update the Identity Provider with the legacy fixed Id `13d2a5db-7ef9-4d62-b909-0df58612e775`. #### Request Parameters[#](#request-parameters-2) `identityProviderId`UUIDrequiredImmutable The unique Id of the Apple Identity Provider to update. #### Request Body `identityProvider.applicationConfiguration`Mapoptional The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].bundleId`StringoptionalAvailable since 1.43.0 This is an optional Application specific override for the top level **`bundleId`**. `identityProvider.applicationConfiguration[applicationId].buttonText`Stringoptional This is an optional Application specific override for the top level **`buttonText`**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanoptionalDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanoptionalDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.applicationConfiguration[applicationId].keyId`UUIDoptional This is an optional Application specific override for the top level **`keyId`**. `identityProvider.applicationConfiguration[applicationId].scope`Stringoptional This is an optional Application specific override for the top level **`scope`**. `identityProvider.applicationConfiguration[applicationId].servicesId`Stringoptional This is an optional Application specific override for the top level **`servicesId`**. `identityProvider.applicationConfiguration[applicationId].teamId`Stringoptional This is an optional Application specific override for the top level **`teamId`**. `identityProvider.bundleId`StringoptionalAvailable since 1.43.0 The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. The request must include **`identityProvider.bundleId`** or **`identityProvider.servicesId`**. If **`identityProvider.servicesId`** is omitted, this field is required. `identityProvider.buttonText`Stringrequired The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.debug`BooleanoptionalDefaults to false Determines if debug is enabled for this provider. When enabled, an Event Log is created each time this provider is invoked to reconcile a login. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanoptionalDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.attributeMappings`MapoptionalAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and must begin with `user.` or `registration.`. Each value is the source expression in the identity provider response payload. A dot-notated value such as `email` or `id_token.given_name` is converted to a JSON Pointer. A value that starts with `/` is treated as a JSON Pointer as-is. This property cannot be used with `identityProvider.lambdaConfiguration.reconcileId`. This property is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. This property defaults to an empty map. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored. Mappings to `user.password` do not set a password. `identityProvider.keyId`UUIDrequired The unique Id of the private key downloaded from Apple and imported into Key Master that will be used to sign the client secret. `identityProvider.lambdaConfiguration.reconcileId`UUIDoptional The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. The specified Lambda Id must be of type `AppleReconcile`. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Apple Identity Provider and the user. Available since 1.65.0 You can **only** change this value when the identity provider is **disabled**. To change the linking strategy for an identity provider that is already enabled, disable the provider, change the value, and then re-enable the provider. The possible values are: * `CreatePendingLink` - Do not automatically link, instead return a pending link identifier that can be used to link to an existing user. * `Disabled` - Disables linking automatically. You must use the API to create links. Available since 1.37.0 * `LinkAnonymously` - Always create a link based upon the unique Id returned by the identify provider. A username or email is not required and will not be used to link the user. A reconcile lambda will not be used in this configuration. * `LinkByEmail` - Link to an existing user based upon email. A user will be created with the email returned by the identity provider if one does not already exist. * `LinkByEmailForExistingUser` - Only link to an existing user based upon email. A user will not be created if one does not already exist with email returned by the identity provider. * `LinkByUsername` - Link to an existing user based upon username. A user will be created with the username returned by the identity provider if one does not already exist. * `LinkByUsernameForExistingUser` - Only link to an existing user based upon username. A user will not be created if one does not already exist with username returned by the identity provider. `identityProvider.name`StringoptionalAvailable since 1.61.0 The display name of this provider instance. Required when using a provided **`identityProviderId`** or **`identityProvider.tenantId`**. `identityProvider.scope`Stringoptional The top-level space separated scope that you are requesting from Apple. Recommended value is `email name`. `identityProvider.servicesId`Stringoptional The Apple Services identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Services identifier is used to Sign in with Apple from web applications. Available since 1.43.0 The request must include **`identityProvider.bundleId`** or **`identityProvider.servicesId`**. If **`identityProvider.bundleId`** is omitted, this field is required. `identityProvider.teamId`Stringrequired The Apple App ID Prefix, or Team ID found in your Apple Developer Account which has been configured for Sign in with Apple. `identityProvider.source`StringoptionalDefaults to SystemAvailable since 1.65.0 The source of this Identity Provider. The maximum length is `191` characters. This value is only used on create. If provided on update, it is ignored and the existing value is preserved. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDoptionalAvailable since 1.62.0 The unique Id of the Tenant. Providing a value creates an identity provider scoped to the specified tenant, otherwise a global identity provider is created. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. Global identity providers can be used with any tenant. This value is read-only once the identity provider is created. `identityProvider.type`Stringrequired This field must be set to `Apple`. *Example Apple Request JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "bundleId": "com.piedpiper.nativeapp", "buttonText": "Sign in with Apple", "debug": false, "enabled": true, "keyId": "2f81529c-4d39-4ce2-982e-cf5fbb1325f6", "lambdaConfiguration": { "reconcileId": "0d319f4e-faca-4ab8-b212-8fae6d23bf77" }, "scope": "email name", "name": "Apple Provider", "servicesId": "com.piedpiper.webapp", "teamId": "R4NQ1P4UEB", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Apple" } } ``` ### Response[#](#response-2) The response for this API contains the Apple Identity Provider. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. The response will contain a JSON body. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you are trying to update doesn't exist. The response will be empty. | | 409 | A conflict was encountered processing this request. If the response has a general error code of `[retryableConflict]`, then the client should exponentially backoff and retry the request. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | #### Response Body[#](#response-body) `identityProvider.applicationConfiguration` The configuration for each Application that the identity provider is enabled for. `identityProvider.applicationConfiguration[applicationId].bundleId`StringAvailable since 1.43.0 This is an optional Application specific override for the top level **bundleId**. `identityProvider.applicationConfiguration[applicationId].buttonText`String This is an optional Application specific override for the top level **buttonText**. `identityProvider.applicationConfiguration[applicationId].createRegistration`BooleanDefaults to true Determines if a UserRegistration is created for the User automatically or not. If a user doesn't exist in FusionAuth and logs in through an identity provider, this boolean controls whether or not FusionAuth creates a registration for the User in the Application they are logging into. `identityProvider.applicationConfiguration[applicationId].enabled`BooleanDefaults to false Determines if this identity provider is enabled for the Application specified by the `applicationId` key. `identityProvider.applicationConfiguration[applicationId].keyId`UUID This is an optional Application specific override for the top level **keyId**. `identityProvider.applicationConfiguration[applicationId].scope`String This is an optional Application specific override for the top level **scope**. `identityProvider.applicationConfiguration[applicationId].servicesId`String This is an optional Application specific override for the top level **servicesId**. `identityProvider.applicationConfiguration[applicationId].teamId`String This is an optional Application specific override for the top level **teamId**. `identityProvider.bundleId`StringAvailable since 1.43.0 The Apple Bundle identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Bundle identifier is used to Sign in with Apple from native applications. `identityProvider.buttonText`String The top-level button text to use on the FusionAuth login page for this Identity Provider. `identityProvider.debug`BooleanDefaults to false Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created. This is useful for debugging purposes, but is not intended to be left on during production. It should be enabled during integration or if you are experiencing an issue with this identity provider. `identityProvider.enabled`BooleanDefaults to false Determines if this provider is enabled. If it is false then it will be disabled globally. `identityProvider.attributeMappings`MapAvailable since 1.65.0 A map of attribute mappings applied during user reconciliation when a reconcile Lambda is not configured. Each key is the FusionAuth target field path and begins with `user.` or `registration.`. Each value is the source expression from the identity provider response payload. This configuration is ignored when `identityProvider.linkingStrategy` is `LinkAnonymously`. Mappings that resolve to null, cannot be extracted, or cannot be written to the target field are ignored at runtime. Mappings to `user.password` do not set a password. `identityProvider.id`UUID The Id of the provider. `identityProvider.insertInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was added to the FusionAuth database. `identityProvider.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the provider was updated in the FusionAuth database. `identityProvider.keyId`UUID The unique Id of the private key downloaded from Apple and imported into Key Master that will be used to sign the client secret. `identityProvider.lambdaConfiguration.reconcileId`UUID The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user. `identityProvider.linkingStrategy`StringoptionalDefaults to LinkByEmailAvailable since 1.28.0 The linking strategy to use when creating the link between the Identity Provider and the user. The possible values are: * `CreatePendingLink` - Create pending link. * `Disabled` - Disables linking automatically. Available since 1.37.0 * `LinkAnonymously` - Anonymous Link. * `LinkByEmail` - Link on email. Create the user if they do not exist. * `LinkByEmailForExistingUser` - Link on email. Do not create the user if they do not exist. * `LinkByUsername` - Link on username. Create the user if they do not exist. * `LinkByUsernameForExistingUser` - Link on username. Do not create the user if they do not exist. `identityProvider.name`String The name of the provider. `identityProvider.scope`String The top-level space separated scope that you are requesting from Apple. `identityProvider.servicesId`String The Apple Services identifier found in your Apple Developer Account which has been configured for Sign in with Apple. The Services identifier is used to Sign in with Apple from web applications. `identityProvider.teamId`String The Apple App ID Prefix, or Team ID found in your Apple Developer Account which has been configured for Sign in with Apple. `identityProvider.source`StringAvailable since 1.65.0 The source for this Identity Provider. `identityProvider.tenantConfiguration`MapAvailable since 1.32.0 The configuration for each Tenant that limits the number of links a user may have for a particular identity provider. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount`ObjectAvailable since 1.32.0 The policy that governs identity provider links on a Tenant. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.enabled`BooleanDefaults to falseAvailable since 1.32.0 When enabled, the number of identity provider links a user may create is enforced by **maximumLinks**. `identityProvider.tenantConfiguration[tenantId].limitUserLinkCount.maximumLinks`IntegerDefaults to 42Available since 1.32.0 The maximum number of links that a user can have for a particular identity provider. This configuration is specific to this IdP. So a user can have more links than this number, but for this particular IdP, the number of links will be limited and enforced. `identityProvider.tenantId`UUIDAvailable since 1.62.0 The unique Id of the Tenant. This value is present if the identity provider is tenant-scoped. Tenant-scoped identity providers can only be used to authenticate in the context of the specified tenant. This value is read-only once the key is created. `identityProvider.type`String The type of this provider, this field will always be set to `Apple` *Example Apple Response JSON* ``` { "identityProvider": { "applicationConfiguration": { "1c212e59-0d0e-6b1a-ad48-f4f92793be32": { "createRegistration": true, "enabled": true } }, "bundleId": "com.piedpiper.nativeapp", "buttonText": "Sign in with Apple", "debug": false, "enabled": true, "id": "8d1c7b8f-7c52-4f2c-9ea0-a5ccc8b3f504", "insertInstant": 1595361142909, "lastUpdateInstant": 1595361143101, "keyId": "2f81529c-4d39-4ce2-982e-cf5fbb1325f6", "lambdaConfiguration": { "reconcileId": "0d319f4e-faca-4ab8-b212-8fae6d23bf77" }, "name": "Apple Provider", "scope": "email name", "servicesId": "com.piedpiper.webapp", "teamId": "R4NQ1P4UEB", "tenantConfiguration": { "e872a880-b14f-6d62-c312-cb40f22af465": { "limitUserLinkCount": { "enabled": false, "maximumLinks": 42 } } }, "type": "Apple" } } ``` ## Delete an Apple Identity Provider[#](#delete-an-apple-identity-provider) ### Request[#](#request-3) Delete an Apple Identity Provider by Id DELETE/api/identity-provider/{identityProviderId} OpenAPI Spec Delete an Apple Identity Provider by type (deprecated) DELETE/api/identity-provider?type=Apple Deprecated since 1.61.0 Prefer deleting by Id. Deleting by type attempts to delete the Identity Provider with the legacy fixed Id `13d2a5db-7ef9-4d62-b909-0df58612e775`. #### Request Parameters[#](#request-parameters-3) `identityProviderId`UUIDrequired The unique Id of the Apple Identity Provider to delete. ### Response[#](#response-3) This API does not return a JSON response body. *Response Codes* | Code | Description | | --- | --- | | 200 | The request was successful. | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. | | 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](/docs/apis/authentication). | | 404 | The object you requested doesn't exist. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | ## Complete the Apple Login[#](#complete-the-apple-login) This API allows you to complete a Apple login after authenticating a user using the Apple API. If you are using the FusionAuth login UI with the Apple button you will not utilize this API directly. This API is intended to be used if you want to build your own login page and you have added the Apple login button to your own login page and you then need to complete the login with FusionAuth. For example, if you built your own login page, you could add a "Login with Apple" button and complete the Apple authentication. When you complete the Apple authentication you will have been returned an id token from Apple. Using this API you can pass that id token to FusionAuth and we will complete the login workflow and reconcile the user to FusionAuth. The user does not need to exist yet in FusionAuth to utilize this API, depending on the configured [linking strategy](/docs/lifecycle/authenticate-users/identity-providers/#linking-strategies). The id token returned from Apple will be used to retrieve the user's email address or username and if that user does not yet exist in FusionAuth the user may be created. If **createRegistration** has been enabled for this identity provider and the user does not yet have a registration for this application, a registration will be automatically created for the user. The user will be assigned any default roles configured for the application. If **createRegistration** has not been enabled, a registration will not be created if one does not yet exist. This is useful if you wish to manually provision users and then subsequently allow them to login with Apple. Apple requires you use a hybrid grant. At a high level, the steps you'll follow are: * Begin the Authorization Code grant with Apple using a hybrid grant: `response_type=code id_token`. * Collect the two values, `code` and `id_token` sent to you by Apple on the redirect URL specified by the `redirect_uri` query parameter. * Send these values to the FusionAuth IdP Login API to complete the login process. The API call, parameters to provide, and response are described below. Do not complete the Authorization Code exchange with Apple using the Token endpoint. ### Request[#](#request-4) Complete Apple Login POST/api/identity-provider/login OpenAPI Spec #### Request Headers[#](#request-headers) `X-Forwarded-For`Stringoptional The IP address of a client requesting authentication. If the IP address is provided it will be stored in the user's login record. It is generally preferred to specify the IP address in the request body. If it is not provided in the request body this header value will be used if available. However, the request body value takes precedence. `X-FusionAuth-TenantId`Stringoptional The unique Id of the tenant used to scope this API request. The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required. Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result. See [Making an API request using a Tenant Id](/docs/apis/authentication#making-an-api-request-using-a-tenant-id) for additional information. #### Request Body `applicationId`UUIDrequired The Id of the Application the user is to be logged into. This application must have Apple login enabled for this request to succeed. `data.appleUser`Stringoptional The Apple user object. The first time a user completes the Sign in with Apple flow a user object will be returned, when this occurs pass it in using this property. During subsequent authentication requests to Apple the user object will not be returned. `data.code`Stringoptional The authorization code returned from the Sign in with Apple. `data.id_token`Stringoptional The Apple `id_token` returned during Sign in with Apple. `data.isNativeApp`StringoptionalDefaults to falseAvailable since 1.43.0 Set this property equal to `"true"` for login from a mobile app to use the **`bundleId`** from the IdP configuration instead of the **`servicesId`**. `data.redirect_uri`Stringoptional The authorized redirect URI from your Sign in with Apple configuration. Apple calls this a **Return URL**. This value will be the publicly available URL of FusionAuth with the `/oauth2/callback` suffix. Available since 1.43.0 **`data.redirect_uri`** is no longer a required field for mobile app logins when **`data.isNativeApp`** is `"true"`. `identityProviderId`UUIDrequired The unique Id of the identity provider to process this login request. `connectionTestId`StringoptionalAvailable since 1.65.0 The Id of an identity provider connection test returned by the [Start an Identity Provider Connection Test](/docs/apis/identity-providers/test#start-an-identity-provider-connection-test) API. `ipAddress`Stringoptional The IP address of the end-user that is logging into FusionAuth. If this value is omitted FusionAuth will attempt to obtain the IP address of the client, the value will be that of the `X-Forwarded-For` header if provided or the last proxy that sent the request. The IP address will be stored in the User login history. `metaData.device.description`Stringoptional A human readable description of the device represented by the `device` parameter. `metaData.device.lastAccessedAddress`Stringoptional The IP address of this login request. `metaData.device.name`Stringoptional A human readable name of the device represented by the `device` parameter. `metaData.device.type`Stringoptional The type of device represented by the `device` parameter. Prior to version `1.46.0`, this value was restricted to the following types: * `BROWSER` * `DESKTOP` * `LAPTOP` * `MOBILE` * `OTHER` * `SERVER` * `TABLET` * `TV` * `UNKNOWN` In version `1.46.0` and beyond, this value can be any string value you'd like, have fun with it! `newDevice`BooleanoptionalDefaults to false Indicates that this device has never been used by this user to log in before. One of many signals used to decide whether to issue an MFA challenge as part of [Intelligent MFA](/docs/lifecycle/authenticate-users/contextual-multi-factor#intelligent-mfa) or the [MFA Requirement Lambda](/docs/extend/code/lambdas/mfa-requirement). When `true`, triggers the [New Device Webhook](/docs/extend/events-and-webhooks/events/user/login/user-login-new-device). `noJWT`BooleanoptionalDefaults to false When this value is set to true a JWT will not be issued as part of this request. The response body will not contain the `token` field, and the `access_token` and `refresh_token` cookies will not be written to the HTTP response. This optional parameter may be helpful when performing high volume authentication requests and the JWT is not being used, in this scenario removing the additional latency required to issue and sign the JWT may have a measurable cumulative effect on performance. `noLink`BooleanoptionalDefaults to falseAvailable since 1.29.0 When this value is set to `true`, if a link does not yet exist to a FusionAuth user, a `404` status code will be returned instead of using the requested linking strategy. This may be useful if you want to identify if a link exists before starting a full interactive workflow with the user to complete a link. *Example Request JSON* ``` { "applicationId": "10000000-0000-0002-0000-000000000001", "data": { "appleUser": "{ \"name\": { \"firstName\": \"Jared\", \"lastName\": \"Dunn\" } }", "code": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4", "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJqYXJlZEBwaWVkcGlwZXIuY29tIiwiaWF0IjoxNTE2MjM5MDIyfQ.DCS2UDnaIA5pz3ATBCd2nME49ZhbO5uhVFiaRB7_azIU0pKlXG0Ho7YthIG8nuyV0ea_gon98RIQgLBEMDG2t7LSu2eHD5wRn5dbAlziA_GVVVVQKI0OzsoN-rSVCovA7bMj5F79V2otuMOTDfi7AzcaiNeMkxnpLkWcEBb6ThHUVGF4a5BTcFgL-nwWajsLi_uCxnYg_VZrYpMc4Aw2rCIGdXWzhmlTntIpGwXuKqsLW62G9M9nI9Xkekmo_I76xFCHBB-kEY2QXfZ7fTAHgV9mQrWxrMyDa_oedyHgvPa8AoE6CZA3r9Mxdw-6I9yu6W-0KWAomqW5qhGV9F1EJQ", "redirect_uri": "https://login.piedpiper.com/oauth2/callback" }, "identityProviderId": "13d2a5db-7ef9-4d62-b909-0df58612e775", "ipAddress": "192.168.1.42" } ``` *Example Native Request JSON* ``` { "applicationId": "10000000-0000-0002-0000-000000000001", "data": { "appleUser": "{ \"name\": { \"firstName\": \"Jared\", \"lastName\": \"Dunn\" } }", "code": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4", "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJqYXJlZEBwaWVkcGlwZXIuY29tIiwiaWF0IjoxNTE2MjM5MDIyfQ.DCS2UDnaIA5pz3ATBCd2nME49ZhbO5uhVFiaRB7_azIU0pKlXG0Ho7YthIG8nuyV0ea_gon98RIQgLBEMDG2t7LSu2eHD5wRn5dbAlziA_GVVVVQKI0OzsoN-rSVCovA7bMj5F79V2otuMOTDfi7AzcaiNeMkxnpLkWcEBb6ThHUVGF4a5BTcFgL-nwWajsLi_uCxnYg_VZrYpMc4Aw2rCIGdXWzhmlTntIpGwXuKqsLW62G9M9nI9Xkekmo_I76xFCHBB-kEY2QXfZ7fTAHgV9mQrWxrMyDa_oedyHgvPa8AoE6CZA3r9Mxdw-6I9yu6W-0KWAomqW5qhGV9F1EJQ", "isNativeApp": "true" }, "identityProviderId": "13d2a5db-7ef9-4d62-b909-0df58612e775", "ipAddress": "192.168.1.42" } ``` ### Response[#](#response-4) The response for this API contains the User object. *Response Codes* | Code | Description | | --- | --- | | 200 | The authentication was successful. The response will contain the User object that was authenticated. | | 202 | The user was authenticated successfully. The user is not registered for the application specified by `applicationId` on the request. The response will contain the User object that was authenticated. | | 203 | The user was authenticated successfully. The user is required to change their password, the response will contain the `changePasswordId` to be used on the [Change Password](/docs/apis/users/change-password) API. *Example Response JSON* ``` { "changePasswordId": "XOgai4Ro68xfGiex0ngXiJ2bbhduM4Pm7h3lvF0xibQ", "changePasswordReason": "Expired" } ``` | | 204 | The login is pending action by the end user. Wait and try the request again. | | 212 | The user's email address has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **emailVerificationId** that was generated for the user. | | 213 | The user's registration has not yet been verified. The response will contain the User object that was authenticated. If the verification strategy has been set to `FormField`, the response will contain the **registrationVerificationId** that was generated for the user. Prior to version `1.27.0`, this status code was not returned, and you will see a `200` instead. | | 232 | The user is completing a login with an Identity Provider configured to use the `Create a pending link` linking strategy and this user does not have a link established. The API response will only contain the `pendingIdPLinkId` and, possibly, `threatsDetected`. A call to the Link API's [Complete a Pending Link](/docs/apis/identity-providers/links#complete-a-pending-link) endpoint is required. Once the user is linked, calling this API again will allow login to succeed. *Example Response JSON* ``` { "pendingIdPLinkId": "0TxfELqDE0d2Y6PqCkztz4o-lXdRyAscAXh8EAyRZsx" } ``` | | 242 | The user was authenticated successfully. The user has two-factor authentication enabled. Since version `1.42.0`, this status code is also returned when two-factor authentication is required. The response will contain the `twoFactorId` to be used on the [Complete Two-Factor Authentication](/docs/apis/login/complete-mfa). *Example Response JSON* ``` { "methods": [ { "authenticator": { "algorithm": "HmacSHA1", "codeLength": 6, "timeStep": 30 }, "id": "2KSZ", "method": "authenticator" }, { "email": "richard@fusionauth.io", "id": "KLRT", "method": "email" } ], "twoFactorId": "YkQY5Gsyo4RlfmDciBGRmvfj3RmatUqrbjoIZ19fmw4" } ``` | | 400 | The request was invalid and/or malformed. The response will contain an [Errors](/docs/apis/errors) JSON Object with the specific errors. | | 401 | Unable to complete the login request. The user cannot be reconciled or logged in using the external identity provider. | | 404 | The user was not found, the password was incorrect, the linking strategy is set to `disabled`, or the value `noLink: true` is passed on the linking request. The response will be empty. | | 409 | The user is currently in an action that has prevented login. The response will contain the actions that prevented login. *Example Response JSON* ``` { "actions": [ { "actionId": "00000000-0000-0000-0000-000000000042", "actionerUserId": "00000000-0000-0001-0000-000000000000", "expiry": 1571786483322, "localizedName": "Prevent Login Action", "localizedReason": "Hard Lock", "name": "Prevent Login Action", "reason": "Hard Lock", "reasonCode": "hard_lock" } ] } ``` | | 410 | The user has expired. The response will be empty. | | 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. | | 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. | | 504 | One or more Webhook endpoints returned an invalid response or were unreachable. Based on the transaction configuration for this event your action cannot be completed. A stack trace is provided and logged in the FusionAuth log files. | #### Response Body[#](#response-body) `emailVerificationId`String An email verification Id, which is needed when performing your own email verification using the `/api/user/verify-email` API. This field is only returned when the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. `identityVerificationId`StringAvailable since 1.59.0 An identity verification Id, which is needed when performing your own identity verification using the `/api/identity/verify` API. This field is only returned under the following conditions, based on the identity that was used to log in: * An email address - the **tenant.emailConfiguration.verificationStrategy** is set to `FormField`. * A phone number - the **tenant.phoneConfiguration.verificationStrategy** is set to `FormField`. `pendingIdPLinkId`StringAvailable since 1.28.0 The pending identity provider link Id. This value is created when logging in with an identity provider configured with a linking strategy of `Create a pending link`. It will only be included in the response body when this strategy is configured and a link does not yet exist for the user. It is used in conjunction with the [Link APIs](/docs/apis/identity-providers/links) to complete a pending link. `refreshToken`String The refresh token that can be used to obtain a new access token once the provided one has expired. Because a refresh token is per user and per application, this value will only be returned when an **applicationId** was provided on the login request and the user is registered to the application. You must explicitly allow generation of refresh tokens when using the Login API. Configure the **application.loginConfiguration.generateRefreshTokens** setting via the API or enable the setting by navigating to the Application -> My Application -> Security tab. `refreshTokenId`StringAvailable since 1.37.0 When the **refreshToken** is returned in the response, this field will also be returned. This unique Id is the persistent identifier for this refresh token, and will not change even when using one-time use refresh tokens. This value may optionally be used to revoke the token using the [Refresh Token API](/docs/apis/jwt/revoke-refresh-tokens). `state`Object If authenticated using a One Time Password and **state** was provided during the Change Password request this value will be returned exactly as it was provided. `token`StringAvailable since 1.16.0 The access token, this string is an encoded JSON Web Token (JWT). When the user will be sent a setup password email or sms message, this token will not be returned. `tokenExpirationInstant`LongAvailable since 1.33.0 The [instant](/docs/reference/data-types#instants) the **token** will expire. If the response does not contain a **token**, this field will also be omitted from the response. `user.active`Boolean True if the User is active. False if the User has been deactivated. Deactivated Users will not be able to log in. `user.birthDate`String The User's birthdate formatted as `YYYY-MM-DD` `user.breachedPasswordLastCheckedInstant`Long The [instant](/docs/reference/data-types#instants) this user's password was last checked to determine if it is compromised. `user.connectorId`UUIDAvailable since 1.18.0 The unique Id of the [Connector](/docs/lifecycle/migrate-users/connectors/) associated with the System of Record being used to authenticate the user. `user.cleanSpeakId`UUID This Id is used by FusionAuth when the User's username is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.data`Object An object that can hold any information about the User that should be persisted. `user.data.email`String This field will be used as the email address if no **user.email** field is found. This feature was removed in version 1.26.0 and added back in 1.27.2. `user.email`String The User's email address. `user.expiry`Long The expiration [instant](/docs/reference/data-types#instants) of the User's account. An expired user is not permitted to log in. `user.firstName`String The first name of the User. `user.fullName`String The User's full name as a separate field that is not calculated from **firstName** and **lastName**. `user.id`UUID The User's unique Id. `user.identities`ArrayAvailable since 1.59.0 The list of identities that exist for a User. `user.identities[x].displayValue`StringAvailable since 1.59.0 The display value for the identity. Only used for `username` type identities. If the unique username feature is not enabled, this value will be the same as **user.identities\[x\].value**. Otherwise, it will be the username the User has chosen. For primary username identities, this will be the same value as **user.username**. `user.identities[x].insertInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was created. `user.identities[x].lastLoginInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last used to log in. If a User has multiple identity types (`username`, `email`, and `phoneNumber`), then this value will represent the specific identity they last used to log in. This contrasts with **user.lastLoginInstant**, which represents the last time any of the User's identities was used to log in. Identity provider logins will not be reflected here (see **user.lastLoginInstant** for a field that includes identity provider logins). `user.identities[x].lastUpdateInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when the identity was last updated. `user.identities[x].moderationStatus`StringAvailable since 1.59.0 The current status of the username. This is used if you are moderating usernames via CleanSpeak. The possible values are: * `ACTIVE` - the username is active * `PENDING` - the username is pending approval/moderation * `REJECTED` - the username was rejected during moderation If a username has been rejected, it is still possible to allow the User to update it and have the new one moderated again. Only used for `username` type identities. For primary username identities, this will be the same value as **user.usernameStatus**. `user.identities[x].type`StringAvailable since 1.59.0 The identity type. The possible values are: * `email` - identities defined by an email address * `phoneNumber` - identities defined by a phone number * `username` - identities defined by a username `user.identities[x].value`StringAvailable since 1.59.0 The value represented by the identity. The contents of this field depend on **user.identities\[x\].type**and will be one of the following: * Email address - The User's email address, always lower cased. For primary email identities, this will be the same value as **user.email** * Phone number - The User's phone number, in E.164 canonical format. For primary phone number identities, this will be the same value as **user.phoneNumber** * Username - User's username - this will be the same as **user.identities\[x\].displayValue**. For primary username identities, this will be the same value as **user.username** This value is unique within a tenant for a particular **user.identities\[x\].type**. If the unique usernames feature is enabled, `value` will be the unique username (within the tenant). For primary username identities, this will also be the same value as **user.uniqueUsername**. `user.identities[x].verified`BooleanAvailable since 1.59.0 Whether verification was actually performed on the identity by FusionAuth. This is used in combination with the **user.identities\[x\].verifiedReason** to decide whether an identity needs verification. `user.identities[x].verifiedInstant`LongAvailable since 1.59.0 The [instant](/docs/reference/data-types#instants) when verification was performed on the identity. This field is only populated when verification was actually performed on the identity by FusionAuth. `user.identities[x].verifiedReason`StringAvailable since 1.59.0 The reason the User's identity was verified or not verified. The possible values are: * `Skipped` - Verification was skipped due to the `skipVerification` parameter on the request * `Trusted` - Identity was created via an identity provider or a connector * `Unverifiable` - FusionAuth doesn't know how to verify this identity type. Usernames are an example * `Implicit` - Verification was implicitly performed by sending a set password or passwordless message * `Pending` - Tenant policy requires verification but no verification has been performed yet * `Completed` - Verification was performed by FusionAuth * `Disabled` - Tenant policy did not require verification * `Import` - User was imported so verification was not performed by FusionAuth If this field is `Disabled`, `Import`, `Skipped`, `Trusted`, or `Unverifiable`, then verification will not be required, regardless of the **user.identities\[x\].verified** value. For `Implicit`, `Pending`, or `Completed`, the identity will require verification if **user.identities\[x\].verified** is false. `user.imageUrl`String The URL that points to an image file that is the User's profile image. `user.insertInstant`Long The [instant](/docs/reference/data-types#instants) when the user was created. `user.lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) when the User logged in last. See **user.identities\[x\].lastLoginInstant** for more granular information based on identity. `user.lastName`String The User's last name. `user.lastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) when the User was last updated. `user.legacyIdentifier`StringAvailable since 1.67 Used to override the `sub` claim in tokens issued by the Legacy Identity Provider Adapter. This value is immutable after the user is created and is unique within the tenant when non-null. `user.memberships`Array The list of memberships for the User. `user.memberships[x].data`Object An object that can hold any information about the User for this membership that should be persisted. `user.memberships[x].groupId`UUID The Id of the Group of this membership. `user.memberships[x].id`UUID The unique Id of this membership. `user.memberships[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that the membership was created. `user.middleName`String The User's middle name. `user.mobilePhone`String The User's mobile phone number. This is useful if you will be sending push notifications or SMS messages to the User. This differs from **user.phoneNumber** and cannot be used to log in. `user.parentEmail`StringAvailable since 1.7.0 The email address of the user's parent or guardian. If this value was provided during a create or update operation, this value will only remain until the child is claimed by a parent. `user.passwordChangeRequired`Boolean Indicates that the User's password needs to be changed during their next login attempt. `user.passwordLastUpdateInstant`Long The [instant](/docs/reference/data-types#instants) that the User last changed their password. Since version 1.59.0, if a user does not currently have a password, this field will not be returned in the response. `user.phoneNumber`StringAvailable since 1.59.0 The User's primary phone number. The phone number is stored and returned in E.164 canonical format, however a phone number is considered unique regardless of the format. `303-555-1212` is considered equal to `+13035551212` so either version of this phone number can be used whenever providing it as input to an API. This differs from **user.mobilePhone** in that **user.phoneNumber** can be used to log in, just like an email address or a username. `user.preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages. These are important for email templates and other localizable text. See [Locales](/docs/reference/data-types#locales). `user.registrations`Array The list of registrations for the User. This will include registrations for inactive applications. `user.registrations[x].applicationId`UUID The Id of the Application that this registration is for. `user.registrations[x].authenticationToken`String The Authentication Token for this registration (if one exists). `user.registrations[x].cleanSpeakId`UUID This Id is used by FusionAuth when the User's username for this registration is sent to CleanSpeak to be moderated (filtered and potentially sent to the approval queue). It is the **content Id** of the username inside CleanSpeak. `user.registrations[x].data`Object An object that can hold any information about the User for this registration that should be persisted. `user.registrations[x].id`UUID The Id of this registration. `user.registrations[x].insertInstant`Long The [instant](/docs/reference/data-types#instants) that this registration was created. `user.registrations[x].lastLoginInstant`Long The [instant](/docs/reference/data-types#instants) that the User last logged into the Application for this registration. `user.registrations[x].preferredLanguages`Array An array of locale strings that give, in order, the User's preferred languages for this registration. These are important for email templates and other localizable text. `user.registrations[x].roles`Array The list of roles that the User has for this registration. The string is the role's `Name` not the role's `Id`, e.g. `admin` or `user-role`. `user.registrations[x].timezone`String The User's preferred timezone for this registration. The string will be in an [IANA](https://www.iana.org/time-zones) time zone format. `user.registrations[x].tokens`Map