How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

AppOmni Identity and Access API

Unified identities that stitch a person's monitored-service accounts together by email, plus AppOmni platform users, limited users, groups, roles, permissions and the API authorization tokens used to call this API.

AppOmni Identity and Access API is one of 9 APIs that AppOmni publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Identity, Access Management, and Zero Trust. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 24 operations across 22 paths, organized into 3 resource areas, and defines 1 schema. It is described by OpenAPI 3.1.0, at version 1.0.0.

Requests are made against a single base URL, https://{instance}.appomni.com.

24 operations 22 paths 1 schemas 1 DELETE15 GET1 PATCH5 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.1.0
API Version
1.0.0
Base URL
https://{instance}.appomni.com
Authentication
HTTP Bearer
Contact
Resource Areas
3

Authentication & Security 1

AppOmni Identity and Access API declares 1 security scheme for authenticating requests. It accepts HTTP bearer tokens (bearerAuth). By default, every request must be authenticated.

  • bearerAuth — AppOmni API access token, created and managed in the AppOmni platform under Settings API Settings. Sent as Authorization: Bearer .

Paths & Operations 24

Across 22 paths, the API surfaces 24 operations — 1 DELETE, 15 GET, 1 PATCH, 5 POST, 2 PUT. They span 3 resource areas: Identity, Users and Roles, Authorization Tokens. Each is listed below with its method, path, parameters, and response codes.

Identity 8

A Unified Identity represents a person and is composed of the different monitored service user accounts of that person, associated by email addresses. Monitored service users are…

GET
/api/v1/core/unifiedidentity/annotated_list/
List unified identities
listUnifiedIdentities → 200401403
GET
/api/v1/core/unifiedidentity/{identity_id}/
Unified identity details
unifiedIdentityDetails 1 param → 200401403
GET
/api/v1/core/unifiedidentity/{identity_id}/users
List monitored service users linked to a unified identity
listMonitoredServiceUsersLinkedToAUnifiedIdentity 1 param → 200401403
GET
/api/v1/lucid/svcexp/{service_org_id}/user/{user_id}
Get monitored service user details
getMonitoredServiceUserDetails 2 params → 200401403
GET
/api/v1/identity/unifiedidentity/
List Unified Identities
listUnifiedIdentities2 → 200401403
GET
/api/v1/identity/unifiedidentity/{identity_id}/
Get Unified Identity
getUnifiedIdentity 1 param → 200401403
GET
/api/v1/identity/user/
List Service Users
listServiceUsers → 200401403
GET
/api/v1/identity/user/{user_id}
Get Service User
getServiceUser 1 param → 200401403
Users and Roles 9
GET
/api/v1/core/user/
List Users
listUsers → 200401403
POST
/api/v1/core/user/
Add User
addUser body → 200401403
GET
/api/v1/core/limited-user/
List users for roles with limited permissions
listUsersForRolesWithLimitedPermissions → 200401403
GET
/api/v1/core/limited-user/{id}/
List users by ID for roles with limited permissions
listUsersByIDForRolesWithLimitedPermissions 1 param → 200401403
GET
/api/v1/core/group/
List RBAC Roles
listRBACRoles → 200401403
GET
/api/v1/core/user/{id}/
Get user details and roles
getUserDetailsAndRoles 1 param → 200401403
PATCH
/api/v1/core/user/{id}/
Deactivate or Activate User
deactivateOrActivateUser 1 param body → 200401403
PUT
/api/v1/core/user/{user_id}/enable_breakglass
Enable breakglass access for emergencies
enableBreakglassAccessForEmergencies 1 param → 200401403
PUT
/api/v1/core/user/{user_id}/disable_breakglass
Disable breakglass access for emergencies
disableBreakglassAccessForEmergencies 1 param → 200401403
Authorization Tokens 7
POST
/oauth/token/
Exchange refresh token for new access token
exchangeRefreshTokenForNewAccessToken → 200401403
POST
/api/v1/core/oauthaccesstoken/manual/
Manually Grant Access Token with Specific Expiration Date
manuallyGrantAccessTokenWithSpecificExpirationDate body → 200401403
GET
/oauth/introspect/
Introspect Access Token
introspectAccessToken → 200401403
POST
/oauth/revoke/
Revoke Refresh Token
revokeRefreshToken → 200401403
DELETE
/api/v1/core/oauthrefreshtoken/{token_id}/
Revoke Refresh Token by Token ID
revokeRefreshTokenByTokenID 1 param → 200401403
GET
/api/v1/core/oauthapplication/
Get API Application by Client ID
getAPIApplicationByClientID 1 param → 200401403
POST
/api/v1/core/oauthapplication/{app_id}/rotate_client_secret/
Rotate an API Application's Client Secret
rotateAnAPIApplicationSClientSecret 1 param → 200401403

Schemas 1

The contract defines 1 schema that model the data the API accepts and returns. The most detailed is Error (1 property). Each schema is shown below with its type and property counts.

Error
object
Standard Django REST Framework error envelope returned by the AppOmni API.
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

appomni-identity-api-openapi.yml Raw ↑

Other APIs AppOmni publishes across the network.

AppOmni Posture Findings API
AppOmni Policies API
AppOmni Compliance and Reports API
AppOmni Monitored Services API
AppOmni SCIM 2.0 API
AppOmni Discovery, Insights and Audit API
AppOmni Developer Platform API
AppOmni AI API
Where this information came from

This is an independent, third-party profile of AppOmni Identity and Access API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.