Forgerock PingOne Advanced Identity Cloud API

Name: PingOne Advanced Identity Cloud API
Brand: PingOne Advanced Identity Cloud API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth2, apiKey, basic67 EndpointsREST

For Agents

Install Jentic One Beta

Connect the PingOne Advanced Identity Cloud API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PingOne Advanced Identity Cloud API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PingOne Advanced Identity Cloud API.

Manage TLS certificates and certificate signing requests for tenant environments

Configure cookie domains, custom domains, and content security policies

Issue and rotate environment secrets and variables

GET STARTED

Start building with PingOne Advanced Identity Cloud API

Explore with Jentic

View OpenAPI Document

Use for: I need to upload a new TLS certificate to a PingOne Advanced Identity Cloud environment, I want to list all custom domains configured on this tenant, Find a specific environment secret by ID, Get the current state of a promotion lock

Not supported: Does not handle end-user authentication journeys, OAuth client management, or directory record CRUD — use for PingOne Advanced Identity Cloud tenant environment configuration, certificates, secrets, variables, and promotions only.

Use Cases

Patterns agents use PingOne Advanced Identity Cloud API for, with concrete tasks.

★ Tenant Environment Configuration

Manage day-two configuration of an Advanced Identity Cloud tenant by automating certificate uploads, custom domains, cookie domains, and CSP rules. The API surfaces these as discrete endpoints under /environment so platform engineers can codify their identity environment alongside other infra-as-code. This eliminates manual portal work for repeatable changes.

Upload a new certificate to /environment/certificates and then add a custom domain via /environment/custom-domains for the supplied hostname.

Secrets and Variables Management

Manage environment secrets and variables through the corresponding endpoints to inject runtime configuration into Identity Cloud journeys and scripts. Useful for rotating secrets without redeploying configuration and for keeping environment-specific values out of journey JSON. Each secret and variable is referenced by ID in journey logic.

Rotate the secret named 'auth-signing-key' in /environment/secrets and update its value to the new key supplied by the user.

Config Promotion Workflows

Promote configuration changes from a development tenant to staging and production using the promotion endpoints under /environment/promotion. Lock the promotion to prevent concurrent changes, run the promotion, and inspect state via the promotion report. This formalises the move from manual exports to a controlled, auditable rollout pipeline.

Acquire a promotion lock via /environment/promotion/lock, trigger a promotion via /environment/promotion/promote, and return the new lock state.

Federation and SSO Management

Use /environment/federation/enforcement to enable or disable federation enforcement on a tenant, ensuring SSO requirements match policy. Useful for security teams running periodic compliance checks or enforcing a baseline across multiple tenants. The endpoint returns the current enforcement state and lets you toggle it.

Read /environment/federation/enforcement and switch enforcement to enabled if it is currently disabled.

AI Agent Identity Operations via Jentic

Agents use Jentic's intent search to find Identity Cloud operations, load the schema for the right environment endpoint, and execute calls under a scoped credential. This is the recommended pattern for platform copilots that automate routine identity admin tasks without exposing the underlying API key, secret, or access token to the model.

Use Jentic to search 'list Advanced Identity Cloud certificates', load the GET /environment/certificates schema, and return the IDs and expiry dates of all certificates on the tenant.

Key Endpoints

67 endpoints — jentic publishes the only available openapi specification for pingone advanced identity cloud api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/environment/certificates

List installed TLS certificates

GET

/environment/certificates/{id}

Retrieve a certificate by ID

GET

/environment/csrs

List certificate signing requests

GET

/environment/custom-domains

List custom domains

GET

/environment/cookie-domains

List cookie domains

POST

/environment/promotion/lock

Acquire a promotion lock

POST

/environment/promotion/promote

Run a promotion

GET

/environment/federation/enforcement

Read federation enforcement state

GET

/environment/certificates

List installed TLS certificates

GET

/environment/certificates/{id}

Retrieve a certificate by ID

GET

/environment/csrs

List certificate signing requests

GET

/environment/custom-domains

List custom domains

GET

/environment/cookie-domains

List cookie domains

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The Identity Cloud API key id, secret, OAuth client credentials, or basic auth pair are stored encrypted in the Jentic vault (MAXsystem). Agents receive a scoped execution token and never see the underlying credentials, which is critical when the API can change tenant security configuration.

Intent-based discovery

Agents search by intent (e.g. 'list Advanced Identity Cloud certificates') and Jentic returns the GET /environment/certificates operation with its query schema, so the agent runs the right call without browsing Ping Identity docs.

Time to first call

Direct Identity Cloud integration: 1-2 weeks for authentication choice, environment configuration, and promotion automation. Through Jentic: under an hour — search, load, execute.

FAQs

Specific to using PingOne Advanced Identity Cloud API through Jentic.

Why is there no official OpenAPI spec for PingOne Advanced Identity Cloud API?

Ping Identity publishes reference docs but the only consolidated OpenAPI 3.0 specification is generated and maintained by Jentic so AI agents and developers can call PingOne Advanced Identity Cloud API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the PingOne Advanced Identity Cloud API use?

The API supports three schemes: an API key id and secret pair (in headers x-api-key-id and x-api-key-secret) for read-only tenant operations, OAuth 2.0 access tokens for write and access management operations, and basic auth as a fallback. Jentic stores the chosen credential encrypted in the MAXsystem vault.

Can I rotate environment secrets with the PingOne Advanced Identity Cloud API?

Yes, the /environment/secrets endpoints let you list, create, update, and delete tenant secrets. Rotating a secret in the API immediately makes the new value available to journeys and scripts that reference it by name.

What are the rate limits for the PingOne Advanced Identity Cloud API?

The OpenAPI spec does not declare explicit rate limits. Ping Identity applies tenant-level throughput controls in production — back off on 429 responses and avoid running large promotion or certificate operations in tight loops.

How do I run a config promotion through Jentic?

Search Jentic for 'promote Advanced Identity Cloud config', acquire a lock via /environment/promotion/lock, then load and execute /environment/promotion/promote. Read /environment/promotion/lock/state to confirm the lock has been released.

Does the PingOne Advanced Identity Cloud API support custom domains?

Yes, /environment/custom-domains and /environment/custom-domains/{realm} let you list and manage custom domains attached to specific realms. Pair this with /environment/certificates to upload the matching TLS certificate.