TrueCaaS is a customer access control platform that helps B2B SaaS teams manage customer identity, enterprise federation, tenant-aware authorization, backend entitlement checks, and explainable access decisions in one product-aware control plane.

Who is TrueCaaS built for?

TrueCaaS is built for B2B SaaS teams, partner portals, API platforms, and agent-era applications that need external user access, customer administrators, tenant boundaries, and auditable authorization decisions.

Which authentication and federation patterns does TrueCaaS support?

TrueCaaS is designed for hosted login, OIDC, OAuth2, SAML, LDAP, Active Directory, passkeys, TOTP MFA, email MFA, and SMS MFA depending on the deployment and plan.

How does TrueCaaS handle authorization?

TrueCaaS models tenants, environments, applications, users, roles, privileges, policy context, and entitlement checks so product teams can enforce access at app, API, service, and AI-agent boundaries.

What deployment models does TrueCaaS support?

TrueCaaS supports three deployment paths: hosted SaaS, managed private deployment, and licensed or offline-capable deployment for regulated or infrastructure-controlled environments.

What audit and decision visibility does TrueCaaS provide?

TrueCaaS is designed to emit audit trails, webhook events, entitlement outcomes, and IRP-backed decision records so engineering, security, support, and customers can understand why access was allowed or denied.

API reference

The public shape of the TrueCaaS V1 externalized API.

Review the tenant-routed API surface that TrueCaaS exposes to customer applications. This is a shape-only public reference: tenant IDs, app IDs, client secrets, internal operations APIs, and executable examples stay inside the authenticated product.

Externalized only

Only /api/v1 paths and tenant OIDC discovery are represented here.

Authentication required

Real calls require a tenant context and bearer token from the configured TrueCaaS issuer.

No tenant wiring exposed

This page does not publish tenant IDs, application IDs, redirect URIs, or secrets.

Server template

https://{tenant-host}

Replace {tenant-host} with the hosted-auth domain or tenant API host supplied inside an active TrueCaaS tenant.

Download YAML Start with a tenant

Endpoint families

188

Externalized operations represented

API version shape

Identity and login context

Resolve the current subject, available applications, licensing context, and OIDC discovery for a tenant-routed host.

GET/.well-known/openid-configurationTenant OIDC discovery document

GET/api/v1/auth/resolve-login-contextResolve hosted-login routing context

GET/api/v1/meCurrent authenticated subject

GET/api/v1/me/applicationsApplications available to the current subject

GET/api/v1/me/licensingLicense posture visible to the current subject

Tenant administration

Manage tenant profile, security posture, licensing refreshes, and user-facing notifications inside a paid or trial tenant.

GET/api/v1/tenant/{tenantId}Read tenant profile

PATCH/api/v1/tenant/{tenantId}Update tenant profile

GET/api/v1/tenant/{tenantId}/settings/securityRead tenant security settings

PATCH/api/v1/tenant/{tenantId}/settings/securityUpdate tenant security settings

GET/api/v1/tenant/{tenantId}/licensingRead tenant licensing state

POST/api/v1/tenant/{tenantId}/licensing/refreshRefresh tenant licensing state

GET/api/v1/tenant/{tenantId}/notificationsList tenant notifications

POST/api/v1/tenant/{tenantId}/notifications/readMark tenant notifications as read

Tenant users and migration

Create, import, update, credential-reset, and inspect tenant-level users and identity migration workflows.

GET/api/v1/tenant/{tenantId}/usersList tenant users

POST/api/v1/tenant/{tenantId}/usersCreate tenant user

POST/api/v1/tenant/{tenantId}/users/importImport tenant users

POST/api/v1/tenant/{tenantId}/users/import/directoryImport tenant users from directory data

GET/api/v1/tenant/{tenantId}/users/{userId}Read tenant user

PATCH/api/v1/tenant/{tenantId}/users/{userId}Update tenant user

DELETE/api/v1/tenant/{tenantId}/users/{userId}Delete tenant user

POST/api/v1/tenant/{tenantId}/users/{userId}/reset-passwordIssue tenant user password reset

POST/api/v1/tenant/{tenantId}/users/{userId}/reset-mfaReset tenant user MFA state

GET/api/v1/tenant/{tenantId}/users/{userId}/access-visualizerInspect tenant user access context

GET/api/v1/tenant/{tenantId}/migrations/identity/adaptersList identity migration adapters

POST/api/v1/tenant/{tenantId}/migrations/identity/dry-runPreview identity migration impact

POST/api/v1/tenant/{tenantId}/migrations/identity/applyApply identity migration batch

Environments and applications

Model environments, applications, public registration settings, and app readiness for tenant-owned products.

GET/api/v1/tenant/{tenantId}/environmentsList environments

POST/api/v1/tenant/{tenantId}/environmentsCreate environment

GET/api/v1/tenant/{tenantId}/environments/{env}Read environment

PATCH/api/v1/tenant/{tenantId}/environments/{env}Update environment

DELETE/api/v1/tenant/{tenantId}/environments/{env}Delete environment

GET/api/v1/tenant/{tenantId}/environments/{env}/applicationsList applications

POST/api/v1/tenant/{tenantId}/environments/{env}/applicationsCreate application

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Read application

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Update application

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Delete application

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/securityRead application security settings

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/securityUpdate application security settings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/public-registrationRead public registration settings

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/public-registrationUpdate public registration settings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/readinessRead application readiness

App users and RBAC

Manage application users, roles, privileges, assignments, and effective access inside a specific tenant environment.

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/usersList application users

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/usersCreate application user

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Read application user

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Update application user

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Delete application user

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/reset-passwordIssue application user password reset

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/rolesList application roles

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/rolesCreate application role

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}Update application role

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}Delete application role

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/privilegesList application privileges

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/privilegesCreate application privilege

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}/users/{appUserId}Assign user to role

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}/users/{appUserId}Remove user from role

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/privilegesRead effective user privileges

Entitlements and governed actions

Evaluate authorization decisions, manage explainable ABAC policy decisions with hydrated attribute provenance, and coordinate governed action request, approval, consumption, and evidence flows.

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/entitlements/checkEvaluate entitlement decision

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/settingsRead ABAC settings

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/settingsUpdate ABAC settings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/operations/dashboardRead ABAC operational metrics, alerts, and policy error signals

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policiesList ABAC policies

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/effectiveList effective inherited ABAC policies

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policiesCreate ABAC policy

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}Read ABAC policy

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}Update ABAC policy

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}Retire ABAC policy

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/submitSubmit ABAC policy for approval

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/approveApprove ABAC policy

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/activateActivate approved ABAC policy

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/impactAnalyze activation impact

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/versionsList ABAC policy versions

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/policies/{policyId}/rollbackRestore an ABAC policy version

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groupsList ABAC groups

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groupsCreate ABAC group

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groups/{groupId}Read ABAC group

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groups/{groupId}Update ABAC group

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groups/{groupId}Retire ABAC group

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groups/{groupId}/membersAdd ABAC group member

DELETE

/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/groups/{groupId}/members/{principalType}/{principalId}

Remove ABAC group member

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/attributesList ABAC attribute source and normalization definitions

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/attributesCreate ABAC attribute source and missing-behavior definition

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/attributes/{attributeId}Read ABAC attribute source and provenance definition

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/attributes/{attributeId}Update ABAC attribute source, normalizer, and trust definition

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/attributes/{attributeId}Retire ABAC attribute definition

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectorsList ABAC attribute source connectors

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectorsCreate ABAC source connector mappings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectors/{connectorId}Read ABAC source connector mapping

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectors/{connectorId}Update ABAC source connector mapping

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectors/{connectorId}Retire ABAC source connector mapping

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/connectors/{connectorId}/testTest ABAC source connector hydration against sample context

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/resource-contractsList governed ABAC resource type contracts

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/resource-contractsCreate governed ABAC resource type contract

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/resource-contracts/{resourceTypeId}Read governed ABAC resource type contract

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/resource-contracts/{resourceTypeId}Update governed ABAC resource type contract

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/resource-contracts/{resourceTypeId}Retire governed ABAC resource type contract

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/testsList ABAC policy tests

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/testsCreate ABAC policy test

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/tests/{testId}Read ABAC policy test

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/tests/{testId}Update ABAC policy test

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/tests/{testId}Retire ABAC policy test

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/tests/runRun ABAC policy tests in bulk and return a promotion report

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/tests/{testId}/runRun ABAC policy test

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/packageExport ABAC policy package

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/package/validateValidate ABAC policy package

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/package/diffDiff ABAC policy package

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/package/importImport ABAC policy package

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/simulateSimulate ABAC decision with hydration summary

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/evaluate/batchBatch evaluate ABAC PDP requests with provenance-aware results

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/decisionsList ABAC decisions with trace, explanation, provenance, and missing attributes

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/abac/decisions/{decisionId}/replayReplay a stored ABAC decision from captured context

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/actionsList governed actions

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/actionsCreate governed action

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requestsList governed action requests

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requestsCreate governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/approveApprove governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/rejectReject governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/consumeConsume governed action approval

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/evidenceAttach governed action evidence

AI governance

Manage the tenant-level AI agent registry, agent-reachable tool catalog, governance policies, and action-level decision evidence.

GET/api/v1/tenant/{tenantId}/ai-governance/dashboardRead AI governance dashboard metrics and recent decisions

GET/api/v1/tenant/{tenantId}/ai-governance/agentsList registered AI agents

POST/api/v1/tenant/{tenantId}/ai-governance/agentsRegister an AI agent

PUT/api/v1/tenant/{tenantId}/ai-governance/agents/{agentId}Update an AI agent registration

DELETE/api/v1/tenant/{tenantId}/ai-governance/agents/{agentId}Retire an AI agent registration

GET/api/v1/tenant/{tenantId}/ai-governance/toolsList agent-reachable tools and actions

POST/api/v1/tenant/{tenantId}/ai-governance/toolsRegister an agent-reachable tool or action

PUT/api/v1/tenant/{tenantId}/ai-governance/tools/{toolId}Update an agent-reachable tool or action

DELETE/api/v1/tenant/{tenantId}/ai-governance/tools/{toolId}Retire an agent-reachable tool or action

GET/api/v1/tenant/{tenantId}/ai-governance/policiesList AI governance policies

POST/api/v1/tenant/{tenantId}/ai-governance/policiesCreate an AI governance policy record

PUT/api/v1/tenant/{tenantId}/ai-governance/policies/{policyId}Update an AI governance policy record

DELETE/api/v1/tenant/{tenantId}/ai-governance/policies/{policyId}Retire an AI governance policy record

POST/api/v1/tenant/{tenantId}/ai-governance/evaluatePreflight an agent tool/action through the AI governance runtime evaluator

GET/api/v1/tenant/{tenantId}/ai-governance/approvalsList AI governance privileged execution approval requests

POST/api/v1/tenant/{tenantId}/ai-governance/approvals/{requestId}/approveApprove a pending AI governance privileged execution request

POST/api/v1/tenant/{tenantId}/ai-governance/approvals/{requestId}/rejectReject a pending AI governance privileged execution request

GET/api/v1/tenant/{tenantId}/ai-governance/decisionsList AI governance decisions

POST/api/v1/tenant/{tenantId}/ai-governance/decisionsRecord an AI governance decision

Audit, reporting, and SIEM

Query authentication events, security audit streams, SIEM exports, IRP records, and generated report artifacts.

GET/api/v1/tenant/{tenantId}/eventsList tenant events

GET/api/v1/tenant/{tenantId}/audit/eventsList tenant audit events

GET/api/v1/tenant/{tenantId}/audit/siem/eventsExport SIEM-compatible audit events

GET/api/v1/tenant/{tenantId}/irp/recordsList IRP-backed decision records

GET/api/v1/tenant/{tenantId}/reports/jobsList report jobs

POST/api/v1/tenant/{tenantId}/reports/jobsCreate report job

GET/api/v1/tenant/{tenantId}/reports/jobs/{jobId}Read report job status

GET/api/v1/tenant/{tenantId}/reports/jobs/{jobId}/artifactDownload report artifact

Webhooks and outbound integrations

GET/api/v1/tenant/{tenantId}/webhooks/event-typesList webhook event types

GET/api/v1/tenant/{tenantId}/webhooks/subscriptionsList webhook subscriptions

POST/api/v1/tenant/{tenantId}/webhooks/subscriptionsCreate webhook subscription

GET/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Read webhook subscription

PATCH/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Update webhook subscription

DELETE/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Delete webhook subscription

GET/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/secretRead webhook secret metadata

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/secretCreate webhook secret

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/rotateRotate webhook secret

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/testSend webhook test delivery

GET/api/v1/tenant/{tenantId}/webhooks/deliveriesList webhook deliveries

Federation and MFA

Configure OIDC clients, SAML connections, LDAP connectors, and end-user MFA enrollment flows.

GET/api/v1/oauth2/clientsList OIDC clients

POST/api/v1/oauth2/clientsCreate OIDC client

PATCH/api/v1/oauth2/clients/{clientId}Update OIDC client

DELETE/api/v1/oauth2/clients/{clientId}Delete OIDC client

GET/api/v1/saml/connectionsList SAML connections

POST/api/v1/saml/connectionsCreate SAML connection

PATCH/api/v1/saml/connections/{connectionId}Update SAML connection

DELETE/api/v1/saml/connections/{connectionId}Delete SAML connection

GET/api/v1/tenant/{tenantId}/settings/ldapRead LDAP settings

PATCH/api/v1/tenant/{tenantId}/settings/ldapUpdate LDAP settings

GET/api/v1/tenant/{tenantId}/settings/ldap/connectorsList LDAP connectors

POST/api/v1/tenant/{tenantId}/settings/ldap/connectorsCreate LDAP connector

POST/api/v1/mfa/totp/enrollEnroll TOTP MFA

POST/api/v1/mfa/totp/enableEnable TOTP MFA

POST/api/v1/mfa/sms/enrollEnroll SMS MFA

POST/api/v1/mfa/passkeys/register/optionsCreate passkey registration options

POST/api/v1/mfa/passkeys/register/verifyVerify passkey registration

Managed tenants and messaging

Support account-managed tenants, bootstrap handoff, and tenant-scoped email/SMS messaging operations.

GET/api/v1/tenant/{tenantId}/managed-tenantsList managed tenants

POST/api/v1/tenant/{tenantId}/managed-tenantsCreate managed tenant

GET/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Read managed tenant

PATCH/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Update managed tenant

DELETE/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Delete managed tenant

POST/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}/bootstrapBootstrap managed tenant handoff

POST/api/v1/tenant/{tenantId}/messaging/email/sendSend tenant email

GET/api/v1/tenant/{tenantId}/messaging/email/logsList tenant email logs

GET/api/v1/tenant/{tenantId}/messaging/sms/logsList tenant SMS logs

GET/api/v1/tenant/{tenantId}/messaging/sms/ledgerRead tenant SMS ledger

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/sendSend app-scoped email

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/logsList app-scoped email logs

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/sms/logsList app-scoped SMS logs

MCP integration surface

Invoke tenant-aware MCP paths where the tenant has enabled agent/tool integration patterns.

POST/api/v1/mcpInvoke root MCP endpoint

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/mcpInvoke app-scoped MCP endpoint