Logto

https://openapi.logto.io
Admin
Logto is a comprehensive identity and access management platform providing REST APIs for user...
Tokens:628,497
Snippets:4,568
Trust Score:8.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Response example for GET /api/systems/application

Source: https://openapi.logto.io/operation/operation-getsystemapplicationconfig

Example response for a successful 200 request to GET /api/systems/application, showing the application constants with a protectedApps object containing a defaultDomain string.

```json
{
  "protectedApps": {
    "defaultDomain": "string"
  }
}
```

--------------------------------

### Response example (200) for GET /api/my-account/logto-configs

Source: https://openapi.logto.io/operation/operation-getlogtoconfig

Example 200 response for the GET /api/my-account/logto-configs endpoint. Shows the structure of the exposed logto config fields.

```json
{
  "mfa": {
    "enabled": true,
    "skipped": true,
    "skipMfaOnSignIn": true
  },
  "passkeySignIn": {
    "skipped": true
  }
}
```

--------------------------------

### Response example (200) for GET /api/.well-known/experience

Source: https://openapi.logto.io/operation/operation-getwellknownexperience

Example 200 response for the GET /api/.well-known/experience endpoint. Shows the structure of the returned experience configuration, including tenantId, color, branding, and languageInfo fields.

```json
{
  "tenantId": "string",
  "id": "string",
  "color": {
    "primaryColor": "string",
    "isDarkModeEnabled": true,
    "darkPrimaryColor": "string"
  },
  "branding": {
    "logoUrl": "string",
    "darkLogoUrl": "string",
    "favicon": "string",
    "darkFavicon": "string"
  },
  "hideLogtoBranding": true,
  "languageInfo": {
    "autoDetect": true,
```

--------------------------------

### Response example for GET /api/resources

Source: https://openapi.logto.io/operation/operation-listresources

Example response for a successful 200 request to GET /api/resources. Returns an array of resource objects, each with tenantId, id, name, indicator, isDefault, accessTokenTtl, and an optional scopes array.

```json
[
  {
    "tenantId": "string",
    "id": "string",
    "name": "string",
    "indicator": "string",
    "isDefault": true,
    "accessTokenTtl": 42.0,
    "scopes": [
      {
        "tenantId": "string",
        "id": "string",
        "resourceId": "string",
        "name": "string",
        "description": "string",
        "createdAt": 42.0
      }
    ]
  }
]
```

--------------------------------

### Response example for GET /api/configs/cimd

Source: https://openapi.logto.io/operation/operation-getcimdconfig

Example 200 response showing the CIMD configuration with enabled and addConsentPromptForOfflineAccess fields.

```json
{
  "enabled": true,
  "addConsentPromptForOfflineAccess": true
}
```

--------------------------------

### Response example for GET /api/one-time-tokens

Source: https://openapi.logto.io/operation/operation-listonetimetokens

Example response for a successful GET /api/one-time-tokens request, showing the structure of a one-time token object.

```json
[
  {
    "tenantId": "string",
    "id": "string",
    "email": "string",
    "token": "string",
    "context": {
      "jitOrganizationIds": [
        "string"
      ],
      "interactionEvent": "SignIn"
    },
    "status": "active",
    "createdAt": 42.0,
    "expiresAt": 42.0
  }
]
```

--------------------------------

### Response example (201) for POST /api/resources

Source: https://openapi.logto.io/operation/operation-createresource

Example response when the resource is created successfully. Contains the created resource object with tenantId, id, name, indicator, isDefault, accessTokenTtl, and scopes array.

```json
{
  "tenantId": "string",
  "id": "string",
  "name": "string",
  "indicator": "string",
  "isDefault": true,
  "accessTokenTtl": 42.0,
  "scopes": [
    {
      "tenantId": "string",
      "id": "string",
      "resourceId": "string",
      "name": "string",
      "description": "string",
      "createdAt": 42.0
    }
  ]
}
```

--------------------------------

### Response example for GET /api/configs/actions

Source: https://openapi.logto.io/operation/operation-listactions

Example JSON response showing the structure of action configurations, including key, script, environmentVariables, contextSample, enabled, and onExecutionError.

```json
[
  {
    "key": "action.postFirstFactorVerification",
    "value": {
      "script": "string",
      "environmentVariables": {
        "additionalProperty1": "string",
        "additionalProperty2": "string"
      },
      "contextSample": {},
      "enabled": true,
      "onExecutionError": "block"
    }
  }
]
```

--------------------------------

### Response example for GET /api/my-account/grants

Source: https://openapi.logto.io/operation/operation-getgrants

Example response for a successful 200 request to GET /api/my-account/grants. Shows the structure of the grants array with payload and application objects.

```json
{
  "grants": [
    {
      "id": "string",
      "payload": {
        "exp": 42.0,
        "iat": 42.0,
        "jti": "string",
        "kind": "string",
        "clientId": "string",
        "accountId": "string"
      },
      "expiresAt": 42.0,
      "application": {
        "id": "string",
        "name": "string"
      }
    }
  ]
}
```

--------------------------------

### Response example for GET /api/sign-in-exp

Source: https://openapi.logto.io/operation/operation-getsigninexp

Shows the JSON structure returned by the endpoint, including all sign-in experience settings such as branding, sign-in methods, password policy, MFA, and more.

```json
{
  "tenantId": "string",
  "id": "string",
  "color": {
    "primaryColor": "string",
    "isDarkModeEnabled": true,
    "darkPrimaryColor": "string"
  },
  "branding": {
    "logoUrl": "string",
    "darkLogoUrl": "string",
    "favicon": "string",
    "darkFavicon": "string"
  },
  "hideLogtoBranding": true,
  "languageInfo": {
    "autoDetect": true,
    "fallbackLanguage": "af-ZA"
  },
  "termsOfUseUrl": "string",
  "privacyPolicyUrl": "string",
  "agreeToTermsPolicy": "Automatic",
  "signIn": {
    "methods": [
      {
        "identifier": "username",
        "password": true,
        "verificationCode": true,
        "isPasswordPrimary": true
      }
    ]
  },
  "signUp": {
    "identifiers": [
      "username"
    ],
    "password": true,
    "verify": true,
    "secondaryIdentifiers": [
      {
        "identifier": "username",
        "verify": true
      }
    ]
  },
  "socialSignIn": {
    "automaticAccountLinking": true,
    "skipRequiredIdentifiers": true
  },
  "socialSignInConnectorTargets": [
    "string"
  ],
  "signInMode": "SignIn",
  "customCss": "string",
  "customContent": {
    "additionalProperty1": "string",
    "additionalProperty2": "string"
  },
  "customUiAssets": {
    "id": "string",
    "createdAt": 42.0
  },
  "customUiCsp": {
    "scriptSrc": [
      "string"
    ],
    "connectSrc": [
      "string"
    ]
  },
  "passwordPolicy": {
    "length": {
      "min": 8,
      "max": 256
    },
    "characterTypes": {
      "min": 1
    },
    "rejects": {
      "pwned": true,
      "repetitionAndSequence": true,
      "userInfo": true,
      "words": []
    }
  },
  "mfa": {
    "factors": [
      "Totp"
    ],
    "policy": "UserControlled",
    "organizationRequiredMfaPolicy": "NoPrompt"
  },
  "adaptiveMfa": {
    "enabled": true
  },
  "trustedDevice": {
    "enabled": true,
    "durationDays": 42.0
  },
  "singleSignOnEnabled": true,
  "supportEmail": "string",
  "supportWebsiteUrl": "string",
  "unknownSessionRedirectUrl": "string",
  "captchaPolicy": {
    "enabled": true
  },
  "sentinelPolicy": {
    "maxAttempts": 42.0,
    "lockoutDuration": 42.0
  },
  "emailBlocklistPolicy": {
    "blockDisposableAddresses": true,
    "blockSubaddressing": true,
    "customAllowlist": [
      "string"
    ],
    "customBlocklist": [
      "string"
    ]
  },
  "verificationCodePolicy": {
    "expirationDuration": 42.0,
    "maxRetryAttempts": 42.0
  },
  "forgotPasswordMethods": [
    "EmailVerificationCode"
  ],
  "passkeySignIn": {
    "enabled": true,
    "showPasskeyButton": true,
    "allowAutofill": true
  },
  "signUpProfileFields": [
    {
      "name": "string"
    }
  ],
  "passwordExpiration": {},
  "usernamePolicy": {}
}
```

--------------------------------

### 200 response example for GET access-control

Source: https://openapi.logto.io/operation/operation-getapplicationaccesscontrol

Example 200 response body for the GET access-control endpoint, showing the structure with userIds, userRoleIds, organizationIds, and organizationRoleRules arrays.

```json
{
  "userIds": [
    "string"
  ],
  "userRoleIds": [
    "string"
  ],
  "organizationIds": [
    "string"
  ],
  "organizationRoleRules": [
    {
      "organizationId": "string",
      "organizationRoleIds": [
        "string"
      ]
    }
  ]
}
```

--------------------------------

### Create role response example (200)

Source: https://openapi.logto.io/operation/operation-createrole

Example response for a successful role creation (HTTP 200). Contains the created role's tenantId, id, name, description, type, and isDefault.

```json
{
  "tenantId": "string",
  "id": "string",
  "name": "string",
  "description": "string",
  "type": "User",
  "isDefault": true
}
```

--------------------------------

### Response example for GET /api/sso-connectors

Source: https://openapi.logto.io/operation/operation-listssoconnectors

Example 200 response for GET /api/sso-connectors, showing the structure of a single SSO connector object with fields such as tenantId, providerName, config, branding, and providerConfig.

```json
[
  {
    "tenantId": "string",
    "id": "string",
    "providerName": "OIDC",
    "connectorName": "string",
    "config": {},
    "domains": [
      "string"
    ],
    "branding": {
      "displayName": "string",
      "logo": "string",
      "darkLogo": "string"
    },
    "syncProfile": true,
    "enableTokenStorage": true,
    "createdAt": 42.0,
    "name": "string",
    "providerType": "oidc",
    "providerLogo": "string",
    "providerLogoDark": "string",
    "providerConfig": {}
  }
]
```

--------------------------------

### Response example (201) for organization scope creation

Source: https://openapi.logto.io/operation/operation-createorganizationscope

Example response (201) for a successful organization scope creation. Contains tenantId, id, name, and description.

```json
{
  "tenantId": "string",
  "id": "string",
  "name": "string",
  "description": "string"
}
```

--------------------------------

### Response example (200) for GET /api/experience/sso-connectors

Source: https://openapi.logto.io/operation/operation-getenabledssoconnectors

Example 200 response body for the GET /api/experience/sso-connectors endpoint. Returns the list of enabled SSO connectorIds, or an empty array if none are found.

```json
{
  "connectorIds": [
    "string"
  ]
}
```

--------------------------------

### Response example (200) for POST /api/experience/verification/sign-in-passkey/authentication

Source: https://openapi.logto.io/operation/operation-createsigninpasskeyauthenticationwithidentifier

Example 200 response containing verificationId and authenticationOptions with challenge, timeout, rpId, allowCredentials, userVerification, and extensions.

```json
{
  "verificationId": "string",
  "authenticationOptions": {
    "challenge": "string",
    "timeout": 42.0,
    "rpId": "string",
    "allowCredentials": [
      {
        "type": "string",
        "id": "string",
        "transports": [
          "usb"
        ]
      }
    ],
    "userVerification": "required",
    "extensions": {
      "appid": "string",
      "credProps": true,
      "hmacCreateSecret": true
    }
  }
}
```

--------------------------------

### Response example (200)

Source: https://openapi.logto.io/operation/operation-listorganizationapplicationroles

Example response for a successful 200 request, showing a list of roles with fields tenantId, id, name, description, and type.

```json
[
  {
    "tenantId": "string",
    "id": "string",
    "name": "string",
    "description": "string",
    "type": "User"
  }
]
```

--------------------------------

### GET /api/.well-known/sign-in-exp

Source: https://openapi.logto.io/operation/operation-getsigninexperienceconfig

Documentation for the GET /api/.well-known/sign-in-exp endpoint, including response schema and example.

```APIDOC
## GET /api/.well-known/sign-in-exp

### Description
Retrieves the sign-in experience configuration for the tenant, including branding, language settings, and custom profile fields.

### Method
GET

### Endpoint
/api/.well-known/sign-in-exp

### Parameters
None

### Request Example
```
curl --request GET 'https://[tenant_id].logto.app/api/.well-known/sign-in-exp'
```

### Response
#### Success Response (200)
- **tenantId** (string) - The tenant identifier.
- **id** (string) - The sign-in experience configuration ID.
- **color** (object) - Color settings including primaryColor, isDarkModeEnabled, and darkPrimaryColor.
- **branding** (object) - Branding settings including logoUrl, darkLogoUrl, favicon, and darkFavicon.
- **hideLogtoBranding** (boolean) - Whether to hide Logto branding.
- **languageInfo** (object) - Language settings including autoDetect.
- **customProfileFields** (array[object]) - Custom profile fields configuration.
  - **tenantId** (string) - Tenant ID, max length 21.
  - **id** (string) - Field ID, min 1, max 21.
  - **name** (string) - Field name, min 1, max 128.
  - **type** (string) - Field type: Text, Number, Date, Checkbox, Select, Url, Regex, Address, or Fullname.
  - **label** (string) - Field label, max 128.
  - **description** (string|null) - Field description, max 256.
  - **required** (boolean) - Whether the field is required.
  - **config** (object) - Field configuration.
    - **placeholder** (string) - Placeholder text, max 256.
    - **minLength** (number) - Minimum length.
    - **maxLength** (number) - Maximum length.
    - **minValue** (number) - Minimum value.
    - **maxValue** (number) - Maximum value.
    - **format** (string) - Format string, max 128.
    - **customFormat** (string) - Custom format string, max 128.
    - **options** (array[object]) - Options for select fields.
      - **label** (string) - Option label.
      - **value** (string) - Option value (required).
    - **defaultValue** (string) - Default value.
    - **parts** (array[object]) - Parts for composite fields.
      - **enabled** (boolean) - Whether the part is enabled.
      - **name** (string) - Part name.
      - **type** (string) - Part type: Text, Number, Date, Checkbox, Select, Url, Regex, Address, or Fullname.
      - **label** (string) - Part label, min 1.
      - **description** (string) - Part description.
      - **required** (boolean) - Whether the part is required.
      - **config** (object) - Part configuration (same structure as config).
  - **createdAt** (number) - Creation timestamp.
  - **sieOrder** (number) - Order in sign-in experience.
- **customProfileFieldCatalog** (array[object]) - Catalog of available custom profile fields (same structure as customProfileFields).

#### Response Example
```
{
  "tenantId": "string",
  "id": "string",
  "color": {
    "primaryColor": "string",
    "isDarkModeEnabled": true,
    "darkPrimaryColor": "string"
  },
  "branding": {
    "logoUrl": "string",
    "darkLogoUrl": "string",
    "favicon": "string",
    "darkFavicon": "string"
  },
  "hideLogtoBranding": true,
  "languageInfo": {
    "autoDetect": true
  }
}
```

### Error Responses
#### 400 Bad Request
Bad Request response.
```

--------------------------------

### Example response for GET /api/organizations/{id}/users

Source: https://openapi.logto.io/operation/operation-listorganizationusers

Example 200 response for the GET /api/organizations/{id}/users endpoint. Shows the structure of a user object with organization roles and identity details.

```json
[
  {
    "id": "string",
    "username": "string",
    "primaryEmail": "string",
    "primaryPhone": "string",
    "name": "string",
    "avatar": "string",
    "customData": {},
    "identities": {
      "additionalProperty1": {
        "userId": "string",
        "details": {}
      },
      "additionalProperty2": {
        "userId": "string",
        "details": {}
      }
    },
    "lastSignInAt": 42.0,
    "createdAt": 42.0,
    "updatedAt": 42.0,
    "profile": {
      "familyName": "string",
      "givenName": "string",
      "middleName": "string",
      "nickname": "string",
      "preferredUsername": "string",
      "profile": "string",
      "website": "string",
      "gender": "string",
      "birthdate": "string",
      "zoneinfo": "string",
      "locale": "string",
      "address": {
        "formatted": "string",
        "streetAddress": "string",
        "locality": "string",
        "region": "string",
        "postalCode": "string",
        "country": "string"
      }
    },
    "applicationId": "string",
    "cimdClientId": "string",
    "isSuspended": true,
    "organizationRoles": [
      {
        "id": "string",
        "name": "string"
      }
    ]
  }
]
```

--------------------------------

### Create domain response example (201)

Source: https://openapi.logto.io/operation/operation-createdomain

Example response (201) for a successful domain creation. Includes the domain id, domain name, status (PendingVerification, PendingSsl, Active, or Error), errorMessage, dnsRecords, and createdAt timestamp.

```json
{
  "id": "string",
  "domain": "string",
  "status": "PendingVerification",
  "errorMessage": "string",
  "dnsRecords": [
    {
      "name": "string",
      "type": "string",
      "value": "string"
    }
  ],
  "createdAt": 42.0
}
```

--------------------------------

### GET /api/.well-known/sign-in-exp

Source: https://openapi.logto.io/operation/operation-getsigninexperienceconfig

Retrieves the sign-in experience configuration for a tenant. The response includes custom profile fields, branding, and language settings.

```bash
curl \
 --request GET 'https://[tenant_id].logto.app/api/.well-known/sign-in-exp'
```

--------------------------------

### Response example for GET /api/domains

Source: https://openapi.logto.io/operation/operation-listdomains

Example response for a successful 200 request to GET /api/domains. Shows the structure of a domain object including id, domain, status, errorMessage, dnsRecords, and createdAt.

```json
[
  {
    "id": "string",
    "domain": "string",
    "status": "PendingVerification",
    "errorMessage": "string",
    "dnsRecords": [
      {
        "name": "string",
        "type": "string",
        "value": "string"
      }
    ],
    "createdAt": 42.0
  }
]
```

--------------------------------

### Response example for GET /api/resources/{id}

Source: https://openapi.logto.io/operation/operation-getresource

Example response body for a successful (200) request, showing the resource details including tenantId, id, name, indicator, isDefault, and accessTokenTtl.

```json
{
  "tenantId": "string",
  "id": "string",
  "name": "string",
  "indicator": "string",
  "isDefault": true,
  "accessTokenTtl": 42.0
}
```

--------------------------------

### Response example for GET /api/applications/{applicationId}/roles

Source: https://openapi.logto.io/operation/operation-listapplicationroles

Example response (200) for the GET /api/applications/{applicationId}/roles endpoint. Shows the structure of an array of API resource roles assigned to the application.

```json
[
  {
    "tenantId": "string",
    "id": "string",
    "name": "string",
    "description": "string",
    "type": "User",
    "isDefault": true
  }
]
```

--------------------------------

### Response example (200) for Get connector factory

Source: https://openapi.logto.io/operation/operation-getconnectorfactory

Example 200 response for the GET /api/connector-factories/{id} endpoint. Shows the structure of connector factory data, including type, formItems, and platform fields.

```json
{
  "type": "Email",
  "isDemo": true,
  "id": "string",
  "target": "string",
  "name": {},
  "description": {},
  "logo": "string",
  "logoDark": "string",
  "readme": "string",
  "configTemplate": "string",
  "formItems": [
    {
      "type": "string",
      "selectItems": [
        {
          "value": "string",
          "title": "string"
        }
      ],
      "key": "string",
      "label": "string",
      "placeholder": "string",
      "required": true,
      "showConditions": [
        {
          "targetKey": "string"
        }
      ],
      "description": "string",
      "tooltip": "string",
      "isConfidential": true,
      "isDevFeature": true
    }
  ],
  "customData": {},
  "fromEmail": "string",
  "platform": "Native",
  "isStandard": true,
  "isTokenStorageSupported": true
}
```

--------------------------------

### Response example (201) for creating an organization role

Source: https://openapi.logto.io/operation/operation-createorganizationrole

Example response body for a successful (201) creation of an organization role. Contains the created role's tenantId, id, name, description, and type.

```json
{
  "tenantId": "string",
  "id": "string",
  "name": "string",
  "description": "string",
  "type": "User"
}
```

--------------------------------

### 200 Response Example for GET /api/connectors/{id}

Source: https://openapi.logto.io/operation/operation-getconnector

Example 200 response body for the GET /api/connectors/{id} endpoint. Shows the full connector data structure including metadata, formItems, and configuration fields.

```json
{
  "id": "string",
  "syncProfile": true,
  "enableTokenStorage": true,
  "config": {},
  "metadata": {
    "target": "string",
    "name": {},
    "logo": "string",
    "logoDark": "string"
  },
  "connectorId": "string",
  "target": "string",
  "name": {},
  "description": {},
  "logo": "string",
  "logoDark": "string",
  "readme": "string",
  "configTemplate": "string",
  "formItems": [
    {
      "type": "string",
      "selectItems": [
        {
          "value": "string",
          "title": "string"
        }
      ],
      "key": "string",
      "label": "string",
      "placeholder": "string",
      "required": true,
      "showConditions": [
        {
          "targetKey": "string"
        }
      ],
      "description": "string",
      "tooltip": "string",
      "isConfidential": true,
      "isDevFeature": true
    }
  ],
  "customData": {},
  "fromEmail": "string",
  "platform": "Native",
  "isStandard": true,
  "isTokenStorageSupported": true,
  "type": "Email",
  "isDemo": true,
  "extraInfo": {},
  "usage": 42.0
}
```

--------------------------------

### Response example (200) for application sign-in experience

Source: https://openapi.logto.io/operation/operation-getapplicationsigninexperience

Example response body for a successful 200 request to the application sign-in experience endpoint. Shows the structure of the returned object including color, branding, and URL fields.

```json
{
  "tenantId": "string",
  "applicationId": "string",
  "color": {
    "primaryColor": "string",
    "isDarkModeEnabled": true,
    "darkPrimaryColor": "string"
  },
  "branding": {
    "logoUrl": "string",
    "darkLogoUrl": "string",
    "favicon": "string",
    "darkFavicon": "string"
  },
  "customCss": "string",
  "termsOfUseUrl": "string",
  "privacyPolicyUrl": "string",
  "displayName": "string"
}
```

--------------------------------

### Response example (200) for GET user SSO identity

Source: https://openapi.logto.io/operation/operation-getuserssoidentity

Example 200 response for the GET /api/users/{userId}/sso-identities/{ssoConnectorId} endpoint. Shows the structure of the SSO identity and the desensitized token secret when included.

```json
{
  "ssoIdentity": {
    "tenantId": "string",
    "id": "string",
    "userId": "string",
    "issuer": "string",
    "identityId": "string",
    "detail": {},
    "createdAt": 42.0,
    "updatedAt": 42.0,
    "ssoConnectorId": "string"
  },
  "tokenSecret": {
    "tenantId": "string",
    "id": "string",
    "userId": "string",
    "type": "string",
    "metadata": {
      "scope": "string",
      "expiresAt": 42.0,
      "tokenType": "string",
      "hasRefreshToken": true
    },
    "createdAt": 42.0,
    "updatedAt": 42.0,
    "ssoConnectorId": "string",
    "issuer": "string",
    "identityId": "string"
  }
}
```
Tokens:
Raw