<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Identity Fabric Architecture

## Identity Provider APIs

### Azure AD / Entra ID (Microsoft Graph)

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v1.0/users` | GET | List directory users |
| `/v1.0/groups` | GET | List groups and memberships |
| `/v1.0/applications` | GET | List registered applications |
| `/v1.0/servicePrincipals` | GET | List service principals |
| `/v1.0/identity/conditionalAccess/policies` | GET | List Conditional Access policies |

### Okta API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/v1/users` | GET | List users |
| `/api/v1/apps` | GET | List applications |
| `/api/v1/idps` | GET | List identity providers |
| `/api/v1/policies` | GET | List authentication policies |
| `/api/v1/logs` | GET | System log events |

## Protocol Standards

### SCIM 2.0 Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/scim/v2/Users` | GET | List provisioned users |
| `/scim/v2/Users` | POST | Create user |
| `/scim/v2/Users/{id}` | PATCH | Update user attributes |
| `/scim/v2/Groups` | GET | List groups |
| `/scim/v2/Schemas` | GET | Discover schema |

### OIDC Discovery

| Endpoint | Description |
|----------|-------------|
| `/.well-known/openid-configuration` | Provider metadata |
| `/authorize` | Authorization endpoint |
| `/token` | Token endpoint |
| `/userinfo` | User claims endpoint |
| `/jwks` | JSON Web Key Set |

## Identity Orchestration Platforms

| Platform | Type | Key Feature |
|----------|------|-------------|
| Ping Identity | Commercial | Adaptive authentication flows |
| ForgeRock | Commercial | Identity gateway + AM |
| Keycloak | Open Source | SAML/OIDC IdP + federation |
| Ory | Open Source | Cloud-native identity APIs |
| Auth0 | Commercial | Developer-friendly identity |
