Onelogin MCP

Add an action to a mapping that transforms user attributes. Actions execute when conditions match. Common action types: "add_role" or "set_role" (assign user to role), "set_group" (assign user to group), "set_department" (set department attribute), "set_status" (set user status), "set_value" (assign static value), "copy_value" (copy from another field), "set_macro" (use OneLogin macro like {firstname}.{lastname}), "set_default_if_null" (fallback value), "set_custom_attribute_*" (set custom fields). Use list_mapping_actions to get complete list of available action types for your environment. Va…

Add a condition to a mapping that controls when it executes. Conditions check user attributes (source) against values using operators: "==" (equals), "!=" (not equals), ">" (greater), "<" (less), ">=" (gte), "<=" (lte), "in" (contains), "not_in" (not contains), "~" (regex match). Example: source="department", operator="==", value="Engineering" applies mapping only to Engineering users. Returns created condition with ID and x-request-id.

Create a security policy. IMPORTANT: requires the Custom Security Policies plan feature - without it the API returns 406. `kind` is required and cannot be changed afterwards: "user" for a policy assigned to users and groups (passwords, lockout, sessions, MFA, portal), "app" for a policy assigned to apps via update_app's policy_id (force_authn, per-app MFA, IP restriction, device trust). Fields belonging to the other kind are rejected - each field below is marked USER POLICIES ONLY, APP POLICIES ONLY, or "Both kinds". Creating a policy does not assign it to anyone: use update_user, update_group…

Create a new privilege that defines actions on OneLogin resources. Privileges don't grant access until assigned to a user or role. Use wildcard "*" for super user privileges. Don't mix resource classes in the Action array (e.g., don't combine users: and apps: actions in one statement). Requires Delegated Administration subscription. Returns created privilege ID and x-request-id (API v1 - Rate Limited).

Create a new risk-based authentication rule to enforce conditional access. Required: name, type (ip_range, geo_location, device_trust, impossible_travel, user_behavior), target (scope: all/app_id/role_id). Configure filters based on type: IP ranges (CIDR notation), country codes (ISO), device trust level, travel velocity, behavior anomaly score. Set action: "block" (deny access), "challenge" (step-up auth), "require_mfa" (force MFA), "allow" (bypass MFA). Rules execute in priority order. Returns created rule with ID and x-request-id.

Create a new role with optional apps, users, and admins assigned during creation. Can assign multiple apps (array of app IDs) and users (array of user IDs) in a single call for efficient setup. Returns created role data with new role ID and x-request-id.

Authenticate a user and create a session token for custom login flows. Provide username/email and password. If MFA not required: returns session_token immediately for SSO access. If MFA required: returns state_token, devices (available MFA factors with device_id), and user info - must then call verify_session_factor. Use subdomain parameter to specify OneLogin account. Returns authentication result with session data or MFA challenge and x-request-id.

Create a new Smart Hook to execute custom logic on OneLogin events. Required: type and function. There are ONLY two hook types: "pre-authentication" (modify auth flow) and "user-migration" (sync users) - no other value is accepted. Each type is synchronous, so an account can only have ONE hook of each type; creating a second returns 409. function must be base64-encoded JavaScript (max 20000 chars). The API also requires disabled, runtime, timeout, retries, env_vars and packages - this tool defaults them (runtime nodejs24.x, timeout 1, retries 0, env_vars [], packages {}, disabled false) so you…

Create an account-scoped Smart Hook environment variable. Creates ONE variable per call - to add several, call this repeatedly. Variables are encrypted at rest and readable in hook code via process.env.NAME. Creating a variable does NOT attach it to any hook: you must also list its name in that hook's env_vars array via create_smart_hook or update_smart_hook, or the hook cannot see it. name must match ^[a-zA-Z_][a-zA-Z0-9_]*$ (2-100 chars) and is immutable afterwards; value is 1-5000 chars. Returns the new variable's id and x-request-id.

Create a new user in OneLogin. Users without a password get status 7 (Password Pending) and cannot log in until password is set. PKI certificates require this initial status. IMPORTANT: No invite email is sent when users are created via this API. Mappings run async by default (use mappings=sync query parameter to get mapped values in response). Returns created user data and x-request-id.

Create a new custom attribute field definition in OneLogin. This creates the field schema (definition), not a value for a specific user. After creating the field, you can set values for individual users using update_user with custom_attributes. Returns the created custom attribute definition and x-request-id.

Permanently delete an API authorization. WARNING: This removes OAuth scope definitions and revokes all associated client access. Existing access tokens for this authorization become invalid. Client apps will receive authorization errors. Returns 204 No Content on success and x-request-id.

Delete an app from OneLogin. WARNING: This operation is final and cannot be undone. If you don't know the app ID, use list_apps to find it. Returns 204 No Content on success and x-request-id.

Delete a custom parameter from an app. WARNING: This operation is final and cannot be undone. You cannot delete connector-level parameters (defined on underlying connector) - only custom app-specific parameters can be deleted. If you don't know the parameter ID, use get_app to retrieve app configuration with parameter IDs. Returns 204 No Content on success or 403 Forbidden if attempting to delete connector parameter. Returns x-request-id.

Delete an app rule permanently. WARNING: This operation cannot be undone. Users who were previously affected by this rule will NOT have their existing mappings reverted - deletion only prevents the rule from executing in future. To reverse existing mappings, create a new rule with opposite actions before deletion, then trigger "Reapply Entitlement Mappings" in UI. If you don't know the rule ID, use list_app_rules to find it. Returns 204 No Content on success and x-request-id (API v2).

Remove a claim from an API authorization. Claim will no longer appear in newly issued access tokens. Existing tokens with this claim remain valid until expiration. Use to remove unnecessary user data exposure from tokens. Returns success status and x-request-id (API v2).

Permanently delete a brand. WARNING: Apps using this brand will revert to the account default brand. Custom branding settings are lost and cannot be recovered. If you don't know the brand ID, use list_brands to find it. Returns 204 No Content on success and x-request-id.

Delete a group from OneLogin. WARNING: This operation is final and cannot be undone. Users in the group will not be deleted, only the group membership is removed. The group itself is permanently deleted. Returns 204 No Content on success and x-request-id for log tracing.

Permanently delete a user mapping. WARNING: This operation cannot be undone. Users will no longer have this mapping applied during provisioning. If you don't know the mapping ID, use list_mappings to find it. Returns 204 No Content on success and x-request-id.

Remove an action from a mapping. The attribute transformation defined by this action will no longer execute. Mapping continues to run other configured actions. Returns 204 No Content on success and x-request-id.

Remove a condition from a mapping. Mapping will execute less selectively after condition removal. If all conditions removed, mapping applies to all users (subject to match criteria). Returns 204 No Content on success and x-request-id.

Delete a security policy. WARNING: this cannot be undone. Users, groups and apps assigned to the policy are not deleted - their policy assignment is cleared, so they fall back to the account default policy. The account default policy itself cannot be deleted (422) - use set_default_policy to hand that role to another policy first. Returns 204 No Content on success and x-request-id (API v2).

Delete a privilege. IMPORTANT: Requires Delegated Administration subscription. This removes the privilege definition and unassigns it from all users/roles. Returns success status and x-request-id (API v1 - Rate Limited).

Permanently delete a risk rule. WARNING: This operation cannot be undone. Security controls enforced by this rule will no longer apply. Users previously blocked or challenged by this rule will authenticate normally (subject to other rules). If you don't know the rule ID, use list_risk_rules to find it. Returns 204 No Content on success and x-request-id.

Delete a role from OneLogin. WARNING: This operation is final and cannot be undone. Returns 204 No Content on success and x-request-id.

Permanently delete a Smart Hook. WARNING: This operation cannot be undone. Events will no longer trigger this hook logic. Any automation depending on this hook will stop working. If you don't know the hook ID, use list_smart_hooks to find it. Returns 202 Accepted, NOT 204: deletion is asynchronous and only queued, so the hook can still appear in list_smart_hooks and get_smart_hook briefly afterwards. Do not treat its continued presence as a failed delete, and do not retry on that basis. Returns x-request-id.

Delete an account Smart Hook environment variable by ID. WARNING: env vars are account-scoped and shared, so this removes it from EVERY hook referencing it, not just one. Any hook code reading process.env for this name will break. To detach a variable from a single hook instead, remove its name from that hook's env_vars array via update_smart_hook and leave the variable itself alone. Returns 204 No Content on success and x-request-id.

Permanently delete a user from OneLogin. WARNING: This operation cannot be undone. The user will be deleted and will no longer be able to log in. If you don't know the user's ID, use list_users to find it. Returns 204 No Content on success and x-request-id.

Delete a custom attribute field definition from OneLogin. WARNING: This operation cannot be undone. Deleting a custom attribute field will remove the field definition and all values stored in this field for all users. Returns 204 No Content on success and x-request-id.

Invalidate a session token (logout user). The token immediately becomes invalid and cannot be used for authentication. User must re-authenticate to get a new session. Use for explicit logout or to revoke compromised sessions. Returns success status and x-request-id.

Initiate MFA enrollment for a user. Requires factor_id from get_available_factors. Status will be "pending" if OTP confirmation required (Google Authenticator, OneLogin Protect) or "accepted" if verified=true (SMS, Voice, Email with pre-verified values). For OTP factors, response includes registration_id for verification. Supports custom_message for SMS (max 160 chars), redirect_to for Email MagicLink, and expires_in (120-900 seconds). Returns registration data with registration_id and status.

Generate a password reset invite link for an existing user in OneLogin. Returns the link URL but does NOT send any email - use send_invite_link to email it. Provide link to user to enable them to set password and access OneLogin portal. Email parameter is case-sensitive. Returns invite link and x-request-id (API v1 - Rate Limited).

Generate temporary MFA bypass token for account recovery when MFA device is lost. Token can be used in place of MFA for set time period. expires_in defaults to 259200 seconds (72 hours max). reusable defaults to false (single use). Returns mfa_token string, expires_at timestamp, reusable flag, and device_id.

DEPRECATED: use run_report (synchronous JSON rows) or run_report_background (CSV by email) instead; this name is kept only so existing clients do not break and will be removed in a future release. The previous report_type/date filter contract never worked because the API has no report-generation endpoint. Now runs an existing saved report: with report_id only it behaves like run_report; with report_id and email it behaves like run_report_background (any supplied email, even empty, selects the background path and is validated there). Requires the API credential to have been created by a super u…

Generate a SAML assertion for user authentication to an app. If MFA is not required: returns SAML assertion data immediately. If MFA is required: returns state_token, devices (with device_id for each factor), callback_url, and user info - must then call verify_saml_assertion_factor. Works with ip_address parameter to honor MFA IP allow-listing. Returns assertion data or MFA challenge and x-request-id (API v2).

Get a specific child account by ID. Requires reseller privileges. Returns account data including id, name, address (address1, address2, city, state, zip, country), phone, homepage, notes, created_at, updated_at, and assigned roles. Returns x-request-id for log tracing.

Get detailed configuration of a specific API authorization by ID. Returns complete authorization definition including name, description, audience (unique identifier in JWT tokens), configuration (token lifetime, refresh settings), associated scopes, and authorized client apps. Use to review OAuth resource server configuration. Returns authorization data and x-request-id.

Get configuration settings of an app. Useful for backing up app configuration or cloning apps - take the response and POST it to create_app to clone. Response payload is broken into sections (parameters, sso settings, configuration) that vary based on app type (SAML, OpenId Connect, etc.). Returns complete app configuration and x-request-id for log tracing.

Get detailed configuration of a specific app rule by ID. Returns complete rule definition including name, match type (all=AND conditions, any=OR conditions), enabled status, position in execution order, conditions array (each with source field, operator, and value), and actions array (each with action type and value). Use to review mapping logic or clone rules to other apps. Returns x-request-id (API v2).

Get a list of users assigned to an app (max 1000 users per page). Supports standard pagination. Returns user list with ID, firstname, lastname, username, and email for each user. Use to audit app access or find users to remove. Returns x-request-id for log tracing.

Get available MFA factors for user enrollment. Returns factors configured in user's policy that are not yet enrolled. Each factor includes factor_id needed for enrollment. Supports OneLogin SMS, Voice, Email, Protect, and authenticator apps. Returns factor list with IDs and x-request-id.

Get detailed configuration of a specific brand by ID. Returns complete brand settings including name, enabled status, customization options: logo (header, login page, favicon), colors (primary, secondary, navigation), background images, custom CSS, login page copy (title, tagline), email templates, and apps using this brand. Use to review or backup branding configuration. Returns brand data and x-request-id.

Get a list of apps currently using a specific brand. Returns app list with IDs, names, and connector info. Use to understand brand impact before making changes or to audit which apps share branding. Returns app data and x-request-id.

Get detailed configuration for a specific connector by ID. Returns complete connector definition including name, description, logo_url, auth_method (0=Password, 2=SAML, 8=OIDC, etc.), icon_url, allows_new_parameters (can add custom SAML attributes), default parameters (required config fields), provisioning capabilities (create/update/delete users), and supported features. Use to understand connector requirements before creating an app. Returns connector data and x-request-id.

Get enrolled MFA factors (devices) for a user. Returns all factors the user has registered. Each device includes device_id needed for activation and removal. Use before activate_factor or remove_factor to get device IDs. Returns device list with IDs, types, and status.

Get a single event by ID with complete event details including user names, timestamps, IP addresses, risk scores, and resolution data. Returns event data and x-request-id (API v1 - Rate Limited).

Get a single group by ID. Returns group data with ID, name, and reference. Returns x-request-id for log tracing.

Get users assigned to a group. Returns a list of users who are members of the specified group with details including ID, email, firstname, lastname. Use this to see group membership. Returns x-request-id for log tracing.

Generate a logout URL for OneLogin session termination. Returns logout_url that when visited will end the user's OneLogin session across all apps. Optionally provide redirect_uri parameter to send user to specific page after logout. Use in custom portals to provide logout functionality. Returns logout URL and x-request-id.

Get detailed configuration of a specific user mapping by ID. Returns complete mapping definition including match criteria (all/any), conditions array, actions array, enabled status, position in execution order, and x-request-id. Use to understand how a specific mapping transforms user data.

Get all actions configured for a mapping. Actions define the transformations applied to user attributes when mapping conditions match. Common actions: set field value, copy field, transform with macros, map to app parameter. Returns actions array with action type, target fields, values, and x-request-id.

Get all conditions for a mapping. Conditions determine when a mapping applies - they compare user attributes against values using operators (equals, contains, in, etc). Returns conditions array with source field, operator, value, and x-request-id. Use to understand mapping triggering logic.

Get a single security policy with its full settings. IMPORTANT: the response only contains fields that apply to that policy's kind - an app policy will not include password, session or account-recovery fields at all, and their absence does not mean they are unset. Returns id, name, kind, is_default, every applicable setting, authentication_factor_ids, and x-request-id (API v2).

Return a single privilege by ID. IMPORTANT: Requires Delegated Administration subscription. Returns privilege data with ID, name, description, and policy statement (Version, Statement with Effect/Action/Scope). If privilege not found, returns 404. Returns x-request-id (API v1 - Rate Limited).

Get list of roles that have been assigned to a specific privilege. IMPORTANT: Requires Delegated Administration subscription. Returns role list with IDs and names and x-request-id (API v1 - Rate Limited).

Get list of users that have been directly assigned to a specific privilege. IMPORTANT: Requires Delegated Administration subscription. Returns user list with IDs and names and x-request-id (API v1 - Rate Limited).

Get current rate limit information for the authenticated client. Shows remaining API calls and reset time for rate limiting. Useful for monitoring API usage and avoiding rate limit errors. Returns rate limit data including limit, remaining count, reset timestamp, and x-request-id.

Get current rate limit status for your API client. OneLogin enforces rate limits to prevent API abuse (typically 5000 requests per hour per client_id). Returns current status including limit (max requests per window), remaining (requests left in current window), reset_at (when limit resets, Unix timestamp), window_size (typically 3600 seconds), and throttled (whether you are currently being rate limited). Use before making batch API calls to avoid 429 errors. Returns status data and x-request-id.

Get rate limit configuration for all OneLogin API endpoints. Different endpoint categories have different limits (e.g., authentication endpoints may have stricter limits than read-only endpoints). Returns comprehensive rate limit rules including endpoint_patterns (URL patterns), methods (GET, POST, PUT, DELETE), limits (requests per hour), burst_limits (requests per minute), and exemptions (privileged API clients with higher limits). Use to understand API quotas and plan integration architecture. Returns limits configuration and x-request-id.

Get a single saved report by ID (id, name, report_type). The API has no per-report endpoint, so this fetches the report list and filters it client-side; it returns status 404 if the ID is not in the list. Requires the API credential to have been created by a super user. Returns report data and x-request-id (API v2).

Get detailed configuration of a specific risk rule by ID. Returns complete rule definition including name, type (IP-based, location-based, device-based, impossible-travel, user-behavior), target (who it applies to: all users, specific apps, specific roles), filters (IP ranges, country codes, risk scores), action (block, challenge, require-mfa, allow), priority, enabled status, and x-request-id. Use to review security policy logic.

Get the base role object by ID. Role users, apps, and administrators are returned using sub-endpoints (get_role_users, get_role_apps, get_role_admins). Returns role data with ID and name, plus x-request-id for log tracing.

Get role administrators (users who can manage this role). Supports pagination. Can include admins not currently assigned using include_unassigned parameter. Supports filtering on first name, last name, username, and email address via name parameter. Returns admin list with ID, name, username, added_by info, added_at timestamp, and assigned status. Returns x-request-id for log tracing.

Get applications assigned to a role. Supports pagination. Use assigned=false parameter to return apps not yet assigned to the role. Returns app list with ID, name, and icon_url, plus x-request-id for log tracing.

Get users assigned to a role. Supports pagination. Can include users not currently assigned using include_unassigned parameter. Supports filtering on first name, last name, username, and email address via name parameter. Returns user list with ID, name, username, added_by info, added_at timestamp, and assigned status. Returns x-request-id for log tracing.

Get detailed information about a session token including user data, expiration, and session metadata. Returns user object with ID, email, username, firstname, lastname, session status (active/expired), created_at timestamp, expires_at timestamp, and x-request-id. Use to validate sessions or check session status. Returns 401 if token invalid or expired.

Get detailed configuration of a specific Smart Hook by ID. Returns complete hook definition including type (determines when it triggers), disabled (whether it runs), status (READ-ONLY deploy state such as ready or update-queued - NOT whether the hook is enabled), runtime environment, function code (base64), packages (npm dependencies), env var names (values are never returned), options, conditions, retries, timeout settings, and x-request-id. Use to review or backup hook logic, and to see which options flags a hook has enabled.

Get a single account Smart Hook environment variable by its ID. Returns id, name and timestamps - the value is never returned, as values are write-only for security. Use list_smart_hook_env_vars to find the ID from a name. Returns x-request-id.

Get execution logs for a Smart Hook including console.log output from hook code. Logs include request_id (unique per execution), correlation_id (links related executions), created_at timestamp, and events array with logged messages. Use for debugging hook logic, troubleshooting errors, or monitoring execution. Can filter by request_id or correlation_id. Defaults to 100 per page. Returns array of log objects with execution details and x-request-id (API v2).

Get a single user from a OneLogin account by user ID. If you don't know the user's ID, use list_users to find it. Returns complete user data including custom attributes, roles, status, and x-request-id for log tracing.

Get a list of apps assigned to a given user. Use ignore_visibility parameter (defaults to false) to return all apps regardless of portal visibility setting. Returns app list with provisioning status, icons, and login IDs, plus x-request-id for log tracing.

Get details of a specific custom attribute field definition by ID. Returns the custom attribute schema including name, shortname, user-editable flag, and x-request-id. Use list_user_custom_attributes to get a list of all custom attribute IDs.

Get effective privileges for a user including both directly assigned privileges and privileges inherited through role membership. IMPORTANT: Requires Delegated Administration subscription. Returns comprehensive privilege list showing complete user permissions. Use to understand actual user access. Returns x-request-id.

Get all privileges directly assigned to a user (does not include privileges inherited through roles). IMPORTANT: Requires Delegated Administration subscription. Returns privilege list with IDs, names, descriptions, and policy statements. Use to audit user permissions. Returns x-request-id.

List child accounts under your reseller account. Requires reseller privileges. Returns account data including id, name, address, city, state, country, zip, phone, homepage, notes, created_at, and updated_at. Returns the full list in one response (the API does not paginate this endpoint). Returns x-request-id for log tracing.

Get a list of all API authorizations (resource servers) configured in OneLogin. API authorizations define protected resources that client apps can request access to via OAuth 2.0 scopes. Each authorization has a unique audience identifier and set of allowed scopes. Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns authorization list with IDs, names, descriptions, audiences, a pagination block, and x-request-id.

Get available actions for creating app rules. Returns array of action objects showing what operations can be performed in rule actions (e.g., add_role, remove_role, set_attribute, set_parameter_value). Each action includes action type, display label, required value format, and description of effect. Actions vary by app type - SAML apps support different actions than OpenID Connect apps. Use this before creating rules to discover valid action types for the app. Returns x-request-id (API v2).

Get available condition sources for creating app rules. Returns array of condition objects showing what user/group attributes can be used in rule conditions (e.g., has_role, department, group_id, last_login). Each condition includes source name, display label, data type, and supported operators (~, =, !=, >, <, in, not_in, etc.). Use this before creating rules to discover valid condition sources for the app type. Returns x-request-id (API v2).

Get all mapping rules for an app. App rules act like "if this then that" logic to automate user attribute management, parameters, and entitlements. Each rule has conditions (the "if") and actions (the "then"). IMPORTANT: Rules are not applied automatically when added/modified via API - a user event (create/update) or "Reapply Entitlement Mappings" in UI is required to trigger rule execution. Returns array of rules with ID, name, match type (all/any), enabled status, position, conditions, and actions. Returns x-request-id (API v2).

Get a list of all apps in a OneLogin account with pagination support (max 1000 per page). Can filter by connector_id or auth_method (0=Password, 1=OpenId, 2=SAML, 3=API, 4=Google, 6=Forms, 7=WSFED, 8=OpenId Connect). Use name parameter with wildcard (*) for partial name search (e.g., name=workday*). Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns app data, a pagination block (total_count, current_page, cursors) and x-request-id for log tracing.

List the authentication factors configured on the account, each with id, name and type (OneLogin Protect, SMS, Voice, Email, Yubikey, authenticator apps, etc). Use this to get the IDs for a policy's authentication_factor_ids or reset_password_authentication_factor_ids. IMPORTANT: these are account-level factor definitions, NOT a user's enrolled devices - for those use get_enrolled_factors, and for what a specific user may still enrol use get_available_factors. Returns the factor list and x-request-id (API v2).

Get all custom claims defined for an API authorization. Claims are user attributes (email, roles, custom fields) included in access tokens as JWT claims. Returns claim list with IDs, names, user attribute mappings, transformations, and x-request-id. Use to audit what user data is exposed in tokens (API v2).

Get all OAuth 2.0 scopes defined for an API authorization. Scopes control granular permissions (read:users, write:data, etc.). Returns scope list with values, descriptions, and x-request-id. Use to audit what permissions can be requested from this authorization.

Get list of client apps (API credentials) authorized to request tokens for this API authorization. Returns client list with IDs, names, client_id values, and granted scopes. Use to audit which apps can access this protected resource. Returns client data and x-request-id.

Get catalog of all available OAuth 2.0 scopes across all API authorizations in your OneLogin account. Returns comprehensive scope list with values, descriptions, and which authorizations they belong to. Use to discover existing scopes before creating new ones or to standardize scope naming. Returns scope catalog and x-request-id.

Get a list of all branding configurations in your OneLogin account. Brands control the visual appearance of login pages, portals, and emails. Each brand can be assigned to specific apps or used account-wide. Returns the full list in one response (the API does not paginate this endpoint). Returns brand list with IDs, names, enabled status, custom settings (logo URLs, colors, background images), and x-request-id.

Get a list of all available app connectors in the OneLogin catalog. Connectors are pre-built integration templates for SaaS apps (Salesforce, Slack, AWS, Office 365, etc.). Each connector defines SSO configuration, provisioning rules, and attribute mappings. Filter by name to find specific apps (use *wildcards* for partial matches - this is the only search the API offers). Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns connector list with IDs, names, descriptions, logos, auth methods (SAML, OIDC, etc.), a pagination block, and…

Get a paginated list of events in a OneLogin account (50 events per page). Can filter by event_type_id, user_id, client_id, directory_id, resolution, and date range (since/until with millisecond precision). Pagination is cursor-based: set limit, then pass the response's pagination.after_cursor (next page) or pagination.before_cursor (previous page) back in; there is no page parameter. Returns event data with user_name/actor_user_name (first+last name or email fallback), risk scores, IP addresses, and full event details. Returns x-request-id (API v1 - Rate Limited).

Get a list of groups in a OneLogin account with pagination and filtering support. Can filter by name (supports wildcards) or reference. To find which group a user belongs to, use get_user. To add/remove users from groups, use update_user. Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns group data with ID, name, and reference, a pagination block, and x-request-id for log tracing.

Get the complete list of available mapping action types that can be used when creating or updating mappings. Returns all supported actions with their display names and values (e.g., "Set Role"/"add_role", "Set Group"/"set_group", "Set Department"/"set_department"). Use this to discover what action types are available for your OneLogin environment before creating mapping actions. Returns actions list and x-request-id (API v2).

Get a list of all user attribute mappings configured in OneLogin. Mappings control how user data flows between OneLogin and connected apps during provisioning. Filter by enabled status, by condition/action type (builtin, custom, none), or by a specific condition/action in <name>:<value> form. Returns the full list in one response (the API does not support pagination). Returns mapping list with IDs, names, match criteria, enabled status, and x-request-id.

Get a list of security policies in a OneLogin account. Filter by kind ("user" for policies assigned to users and groups, "app" for policies assigned to apps) or by name (partial match). IMPORTANT: list responses are brief - only id, name, kind and is_default. Call get_policy for a policy's actual settings. Returns 50 policies per page (max 1000); read total_count from the pagination block to count without paging. Returns x-request-id for log tracing (API v2).

List privileges created in a OneLogin account. IMPORTANT: Requires Delegated Administration subscription. Privileges define actions that can be performed on resources but don't grant access until assigned to a user or role. Returns the full list in one response (the API does not paginate this endpoint). Returns privilege data with ID, name, description, and policy statement (API v1 - Rate Limited). Returns x-request-id.

List the saved reports available in the OneLogin account (built-in reports plus any custom reports created in the admin console). Each entry has id, name, and report_type (e.g. events, app_details, user_details). Returns the full list in one response (no pagination). Use this to find the report_id for run_report / run_report_background. IMPORTANT: the Reports API cannot define new reports or apply ad-hoc filters; reports are configured in the admin console under Reports. Requires the API credential to have been created by a super user. Returns reports array and x-request-id (API v2).

Get a list of all risk-based authentication rules configured in OneLogin. Risk rules enforce conditional access by requiring MFA, blocking access, or challenging users based on context like IP address, geolocation, device trust, impossible travel, or user behavior anomalies. Filter by name or enabled status. Returns the full list in one response (the API does not paginate this endpoint). Returns rule list with IDs, names, types, targets, enabled status, priority order, and x-request-id.

Get a list of roles with pagination and sorting support (max 650 per page). Can filter by name, app_id, or app_name. Use fields parameter to include related data (apps, users, admins) in response. Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor (sent alone; the cursor already encodes limit and sort). Returns role data, a pagination block, and x-request-id for log tracing.

List the Smart Hook environment variables defined for the account. IMPORTANT: env vars are account-scoped, NOT owned by a single hook - there is no per-hook env var endpoint. A hook opts in to one by listing its NAME in the hook's env_vars array (see create_smart_hook / update_smart_hook); to see which a given hook uses, call get_smart_hook and read env_vars. Returns each variable's id, name and timestamps - values are never returned. Use the id with get/update/delete_smart_hook_env_var. Returns x-request-id.

Get a list of all Smart Hooks configured in your OneLogin account. Smart Hooks are serverless functions that execute custom logic in response to OneLogin events. Can filter by hook type - there is NO disabled filter, so to find disabled hooks list them and read each hook's disabled field. Returns hook list with IDs, types, status, runtime, created/updated timestamps, and x-request-id. Report the runtime from the response rather than assuming a value - new hooks default to nodejs24.x, but hooks predating the runtime upgrade still report older values. Defaults to 100 per page.

Get a list of all custom attribute field definitions (schema) available in your OneLogin account. Returns the shortnames of custom fields that can be used when setting custom_attributes in create_user or update_user. IMPORTANT: This returns the field SCHEMA (which fields exist), NOT user-specific values. To set values for a user, use update_user with the custom_attributes object. Example: If this returns ["employee_id", "department"], you can then set these via update_user: {"custom_attributes": {"employee_id": "12345"}}. Returns custom attribute shortnames and x-request-id.

Get a paginated list of users in a OneLogin account (50 users per page). Can filter by user properties including custom attributes. For efficient syncing between OneLogin and another system, use the updated_since parameter to return only users that changed since last check. The response includes a `pagination` object whose `total_count` is the total number of users matching the filters across ALL pages. To answer "how many users" questions, make a single call (e.g. limit=1) and read `pagination.total_count` — do NOT page through every user and count them yourself. Paginate with limit/page, or …

Remove OAuth 2.0 scopes from an API authorization. Provide scope_ids — the numeric `id` values from list_authorization_scopes (NOT the string scope values). The underlying API deletes one scope per call; we iterate and report per-scope status. Client apps can no longer request removed scopes; existing access tokens remain valid until expiration. Returns a results array with per-scope ok/error status.

Revoke OIDC client apps from this API authorization. Provide app_ids — the OIDC app IDs (`app_id` field) as returned by list_authorized_clients, NOT a separate client_id. Clients can no longer request new tokens; existing tokens remain valid until expiration. Returns a results array with per-app ok/error status.

Remove an enrolled MFA factor (device) from a user. Requires device_id from get_enrolled_factors. Returns 204 No Content on success. WARNING: This cannot be undone - user will need to re-enroll the factor.

Remove a user from role administrators. The user will no longer be able to manage this role. Returns success status and x-request-id.

Remove a role assignment from a privilege, revoking the privilege's actions from the role's users. IMPORTANT: Requires Delegated Administration subscription. Returns success status and x-request-id (API v1 - Rate Limited).

Remove one or more roles from a OneLogin user. Returns updated user data and x-request-id.

Remove a user assignment from a privilege, revoking the privilege's actions from the user. IMPORTANT: Requires Delegated Administration subscription. Returns success status and x-request-id (API v1 - Rate Limited).

Change the execution order of app rules by providing a new sorted array of rule IDs. Rules execute in the order specified by their position, which affects mapping outcomes when multiple rules modify the same attribute. The rule_ids array must include ALL rule IDs for the app in the desired execution order (first ID = position 1, second ID = position 2, etc.). IMPORTANT: Reordering does NOT auto-apply - changes take effect on next user event or when "Reapply Entitlement Mappings" is triggered in UI. Returns success status and x-request-id (API v2).

Revoke an OAuth 2.0 access token immediately. Use this to invalidate a token before its natural expiration (tokens normally expire after 10 hours). Once revoked, the token cannot be used for API requests. Requires the actual access_token value (not the client credentials). Returns success status and x-request-id.

Run a saved report synchronously and return its rows as JSON. Get report_id from list_reports. Returns { report: [ {column: value, ...}, ... ] } with column names derived from the report's configured columns. IMPORTANT: the server enforces a 20-second limit; large reports return status 422 with a timeout message, in which case use run_report_background instead. No filters or pagination can be passed; the report runs exactly as configured in the admin console. Requires the API credential to have been created by a super user (otherwise 401). Returns report rows and x-request-id (API v2).

Run a saved report asynchronously and email the result as a CSV attachment. Use this for large reports that time out in run_report. Required: report_id (from list_reports) and email (the recipient; must be a valid address or the API returns 422). Returns immediately with a confirmation message; there is no job ID or status endpoint to poll, the CSV simply arrives by email. Requires the API credential to have been created by a super user (otherwise 401). Returns message and x-request-id (API v2).

Send a password reset invite link email to an existing user in OneLogin. User clicks link to set password and access OneLogin portal. Email parameter is case-sensitive. Use personal_email to send to different address than user's OneLogin email. Returns success message with recipient email and x-request-id (API v1 - Rate Limited).

Make a user policy the account default, applied to every user without a policy of their own or one inherited from a group. IMPORTANT: only works on kind=user policies - an app policy returns 422. This changes authentication behaviour account-wide immediately, so confirm the target policy with get_policy first. The previous default keeps existing and simply stops being the default. Returns the policy with is_default true and x-request-id (API v2).

Assign applications to a role. IMPORTANT: Provide the complete list of app IDs to assign - this replaces all existing apps. To add or remove apps, you must submit the full desired app list, not a partial list. For example, if role has apps [123, 456] and you want to add 789, submit [123, 456, 789]. Returns array of assigned app IDs and x-request-id.

Reorder mapping execution priority by providing array of mapping IDs in desired order. IMPORTANT: Mappings execute sequentially in position order during provisioning - earlier mappings can affect values that later mappings see. Provide complete ordered list of all mapping IDs. Missing mappings may be disabled or repositioned unpredictably. Returns success status and x-request-id.

Unlock a locked user in OneLogin. The API checks if the user is locked, calls for an unlock, and returns a JSON response with successful or unsuccessful completion. Returns "User unlocked" message on success or error if user cannot be unlocked. Returns status and x-request-id.

Update a child account. Requires reseller privileges. Partial updates supported - only provide fields to change within the account object (name, address1, address2, city, state, zip, country, phone, homepage, notes). Optionally include api_credential to create new API credentials for the account (requires allow_assuming_users on the account). Returns updated account data and x-request-id for log tracing.

Update an existing API authorization configuration. The OneLogin API requires BOTH auth_id and name on update (it is not a true partial update). Can modify description and nested configuration (audiences, resource_identifier, token expirations). Top-level audience/audiences/resource_identifier/*_expiration_minutes are hoisted into configuration. NOTE: connector_id, scopes, and claims cannot be changed here — connector_id is read-only on the model, and scopes/claims are only accepted on create; use add_authorization_scopes / add_authorization_claim etc. to manage them afterwards. IMPORTANT: Cha…

Update an existing OneLogin app. Supports partial updates - only provide the fields you want to change. For OIDC apps, use the configuration object to set login_url, redirect_uri, etc. For a complete list of configuration fields for a given app type, use get_app on an existing app with the same connector. Returns updated app data and x-request-id.

Update an existing app rule. Can modify name, match type, enabled status, position, conditions, or actions. Partial updates supported - only provide fields to change. IMPORTANT: Rules do NOT auto-apply after modification - changes take effect on next user event or when "Reapply Entitlement Mappings" is triggered in UI. Changing position affects execution order which may alter mapping results. Returns updated rule data and x-request-id (API v2).

Update an existing claim configuration for an API authorization. Can modify name, user attribute mappings, macros, and transformations. Partial updates supported - only provide fields to change. IMPORTANT: Changing claim mapping will affect all future access tokens. Existing tokens retain old claim values until expiration. Returns updated claim data and x-request-id (API v2).

Update an existing brand configuration. Can modify name, enabled status, and any customization settings (logos, colors, backgrounds, custom copy). Partial updates supported - only provide fields to change. Changes apply immediately to login pages and portals using this brand. Returns updated brand data and x-request-id.

Update an existing group. Partial updates are supported - only provide the fields you want to change (name, reference, policy_id). Name and reference must remain unique within the account. Returns updated group data and x-request-id for log tracing.

Update an existing user mapping configuration. IMPORTANT: The OneLogin API requires ALL fields when updating - you must provide name, match, enabled, position, conditions (array), and actions (array) even if you only want to change one field. This is a full-replacement API pattern, not a partial update. Best practice: use get_mapping first to retrieve current values, then modify only what you need to change. Returns updated mapping data and x-request-id.

Update an existing mapping action configuration. Can change action type (add_role, set_role, set_group, set_department, set_value, etc.), target fields, or transformation values. Use list_mapping_actions to see available action types. Use to modify how user attributes are transformed without recreating the action. Returns updated action data and x-request-id (API v2).

Update an existing mapping condition. Can change source attribute, operator, or comparison value. Use to adjust when a mapping applies without recreating the entire condition. Returns updated condition data and x-request-id.

Update a security policy. Partial updates are supported - only supply the fields you want to change. IMPORTANT: `kind` cannot be changed, and a field belonging to the other kind is rejected with 422 naming the field, so check the policy's kind with get_policy first. authentication_factor_ids and reset_password_authentication_factor_ids REPLACE the whole set rather than adding to it - send the full list you want, and read the current one from get_policy first. Changes take effect on the next authentication for every user, group or app the policy is assigned to. Returns the updated policy and x-…

Update an existing privilege definition. Can update name, description, and/or the policy statement. Requires Delegated Administration subscription. Returns updated privilege data and x-request-id (API v1 - Rate Limited).

Update an existing risk rule configuration. Can modify name, type, target scope, filters (IP ranges, countries, etc.), action (block/challenge/require-mfa/allow), priority, or enabled status. Partial updates supported - only provide fields to change. Use to adjust security policies as threat landscape evolves. IMPORTANT: Changing action from "allow" to "block" may immediately lock out users. Returns updated rule data and x-request-id.

Update an existing role. Partial role updates are supported - you only need to provide the fields you want to change. Returns updated role ID and x-request-id.

Update an existing Smart Hook configuration. Can modify function code, packages, env var names, retries, timeout, disabled, conditions and options. type CANNOT be changed after creation (attempting it is a 422), and status is read-only - it reports deploy state, so use disabled to enable/disable a hook. Partial updates supported - pass only the fields to change, and this tool reads the current hook and merges them, because the underlying API replaces the whole hook and rejects a partial body. Note this means an update costs a GET plus a PUT, and concurrent updates can overwrite each other. IMP…

Update the value of an existing account Smart Hook environment variable. Only the value can change - the name is immutable, so to rename you must delete and recreate (and update any hook env_vars arrays referencing the old name). The new value takes effect for every hook referencing this variable. Returns x-request-id.

Update user attributes including passwords, group membership, trusted IDP, and custom attributes. CUSTOM ATTRIBUTES: Set values using the custom_attributes object, e.g., {"custom_attributes": {"employee_id": "12345"}}. This is the correct way to update custom attribute values for a user. OTHER OPTIONS: Mappings run async by default (use mappings=sync for immediate response). Passwords validate against User Policy by default (use validate_policy=false to skip). Returns updated user data and x-request-id.

Update an existing custom attribute field definition. This updates the field schema (definition), not values for specific users. To update values for a user, use update_user with custom_attributes instead. Returns the updated custom attribute definition and x-request-id.

Authenticate OTP code for SMS, Email, or Authenticator factors. Requires verification_id from activate_factor. Provide the OTP the user entered. Returns success/error status. For Push/Voice/MagicLink factors, use verify_factor_poll instead.

Verify enrollment using OTP code. Use after enroll_factor returns "pending" status. Provide the registration_id from enrollment response and the OTP the user received/generated. On success, factor becomes active. Works for Google Authenticator, SMS, Email, and Voice factors.

Poll enrollment status for OneLogin Voice and Protect factors. Use after enroll_factor for these factor types. Poll periodically until status changes from "pending" to "accepted". For Voice: user types OTP into phone. For Protect: user approves on device. Returns registration status.

Poll verification status for Push, Voice, and MagicLink factors. Use after activate_factor for these factor types. Poll periodically until status changes to approved/denied. Returns verification status indicating whether user approved the push or completed voice/magiclink.

Calculate risk score for a specific authentication context without performing actual authentication. Provide context: ip_address (requester IP), user_id (authenticating user), app_id (target app), device_id (trusted device ID). Returns risk assessment with overall risk_score (0-100, higher = riskier), risk_level (low/medium/high/critical), matched_rules (which risk rules triggered), risk_factors (contributing elements: new_device, impossible_travel, suspicious_ip, behavior_anomaly), recommended_action (allow/challenge/block), and x-request-id. Use for testing risk policies or building custom a…

Verify OTP for second factor when MFA is required for SAML authentication. Use in conjunction with generate_saml_assertion. For some factors (SMS): OTP not immediately required, returns pending status. For others (Google Authenticator): OTP required immediately. For OneLogin Protect: first call triggers push notification, subsequent calls poll with do_not_notify=true to check status. Returns SAML assertion on success or error and x-request-id (API v2).

Complete MFA verification during session login to obtain session token. Use in conjunction with create_session_login_token after MFA challenge. Provide device_id (from MFA challenge) and state_token. For OTP factors (SMS, Email, Authenticator): include otp_token. For OneLogin Protect: first call triggers push, subsequent calls poll with do_not_notify=true. Returns session_token on success or pending status for push factors. Returns session data and x-request-id.