canonical: https://jentic.com/apis/forgerock.io/forgerock # Forgerock PingOne Advanced Identity Cloud API Jentic publishes the only available OpenAPI specification for PingOne Advanced Identity Cloud API, keeping it validated and agent-ready. PingOne Advanced Identity Cloud (formerly ForgeRock Identity Cloud) is an enterprise identity platform used to manage tenant configuration, certificates, custom domains, federation, environment promotions, secrets, and variables. The API exposes 67 endpoints across environment management with multiple authentication options including OAuth 2.0, API key plus secret, and basic auth. ## For AI agents Manage Advanced Identity Cloud tenant environments, certificates, custom domains, secrets, variables, and config promotions from agent code. ## Scope Does not handle end-user authentication journeys, OAuth client management, or directory record CRUD - use for PingOne Advanced Identity Cloud tenant environment configuration, certificates, secrets, variables, and promotions only. ## Capabilities - Manage TLS certificates and certificate signing requests for tenant environments - Configure cookie domains, custom domains, and content security policies - Issue and rotate environment secrets and variables - Promote configuration between environments using promotion locks and reports - Configure federation enforcement and SSO settings on a tenant - Read environment counts and inspect promotion state - Authenticate with API key and secret for read-only operations or access tokens for writes ## Use cases ### Tenant Environment Configuration Manage day-two configuration of an Advanced Identity Cloud tenant by automating certificate uploads, custom domains, cookie domains, and CSP rules. The API surfaces these as discrete endpoints under /environment so platform engineers can codify their identity environment alongside other infra-as-code. This eliminates manual portal work for repeatable changes. Example prompt: Upload a new certificate to `/environment/certificates` and then add a custom domain via `/environment/custom-domains` for the supplied hostname. ### Secrets and Variables Management Manage environment secrets and variables through the corresponding endpoints to inject runtime configuration into Identity Cloud journeys and scripts. Useful for rotating secrets without redeploying configuration and for keeping environment-specific values out of journey JSON. Each secret and variable is referenced by ID in journey logic. Example prompt: Rotate the secret named 'auth-signing-key' in `/environment/secrets` and update its value to the new key supplied by the user. ### Config Promotion Workflows Promote configuration changes from a development tenant to staging and production using the promotion endpoints under `/environment/promotion.` Lock the promotion to prevent concurrent changes, run the promotion, and inspect state via the promotion report. This formalises the move from manual exports to a controlled, auditable rollout pipeline. Example prompt: Acquire a promotion lock via `/environment/promotion/lock`, trigger a promotion via `/environment/promotion/promote`, and return the new lock state. ### Federation and SSO Management Use `/environment/federation/enforcement` to enable or disable federation enforcement on a tenant, ensuring SSO requirements match policy. Useful for security teams running periodic compliance checks or enforcing a baseline across multiple tenants. The endpoint returns the current enforcement state and lets you toggle it. Example prompt: Read `/environment/federation/enforcement` and switch enforcement to enabled if it is currently disabled. ### AI Agent Identity Operations via Jentic Agents use Jentic's intent search to find Identity Cloud operations, load the schema for the right environment endpoint, and execute calls under a scoped credential. This is the recommended pattern for platform copilots that automate routine identity admin tasks without exposing the underlying API key, secret, or access token to the model. Example prompt: Use Jentic to search 'list Advanced Identity Cloud certificates', load the GET `/environment/certificates` schema, and return the IDs and expiry dates of all certificates on the tenant. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/environment/certificates` | List installed TLS certificates | | GET | `/environment/certificates/{id}` | Retrieve a certificate by ID | | GET | `/environment/csrs` | List certificate signing requests | | GET | `/environment/custom-domains` | List custom domains | | GET | `/environment/cookie-domains` | List cookie domains | | POST | `/environment/promotion/lock` | Acquire a promotion lock | | POST | `/environment/promotion/promote` | Run a promotion | | GET | `/environment/federation/enforcement` | Read federation enforcement state | ## Key resources - **Certificates and CSRs** — Manage TLS certificates and certificate signing requests. - **Custom Domains** — Configure custom domains attached to tenant realms. - **Cookie Domains** — Manage cookie domains used by the tenant. - **Content Security Policy** — Configure CSP in enforced or report-only mode. - **Secrets** — Issue and rotate environment secrets. - **Variables** — Manage environment variables consumed by journeys and scripts. - **Promotion** — Lock, run, and inspect configuration promotions between environments. - **Federation** — Configure federation enforcement on the tenant. - **Count** — Read environment counts. ## Why Jentic - **Setup:** Wiring the PingOne Advanced Identity Cloud API by hand means picking among its OAuth 2.0 authorization-code flow, its paired x-api-key-id and x-api-key-secret headers, and HTTP Basic auth, then building your own retry and error handling around the environment endpoints. Through Jentic you install once, import it from the API Directory, store the chosen credential once, and your agent calls it. - **Permission scoping:** Advanced Identity Cloud puts the certificate id in the URL path (`/environment/certificates/{id}`), so a rule can pin your agent to reading certificates and related environment records. You choose the operations it may call, so the promotion lock and promote operations that change tenant configuration are not included unless you add them. - **Credential handling:** Your chosen Advanced Identity Cloud credential, whether the API key pair, OAuth client credentials, or Basic auth pair, is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list Advanced Identity Cloud certificates', and Jentic returns the GET `/environment/certificates` operation with its query schema so the agent runs the right call without browsing the Ping Identity docs. ## Related APIs - **Okta API** — Mainstream identity platform with broad SSO and lifecycle features. - **Auth0 API** — Developer-first identity platform with strong CIAM features. - **Slack API** — Team messaging for alerting platform engineers when promotions and certificate changes complete. ## FAQ ### Why is there no official OpenAPI spec for PingOne Advanced Identity Cloud API? Ping Identity publishes reference docs but the only consolidated OpenAPI 3.0 specification is generated and maintained by Jentic so AI agents and developers can call PingOne Advanced Identity Cloud API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the PingOne Advanced Identity Cloud API use? The API supports three schemes: an API key id and secret pair (in headers x-api-key-id and x-api-key-secret) for read-only tenant operations, OAuth 2.0 access tokens for write and access management operations, and basic auth as a fallback. Jentic stores the chosen credential encrypted in your Jentic One instance. ### Can I rotate environment secrets with the PingOne Advanced Identity Cloud API? Yes, the `/environment/secrets` endpoints let you list, create, update, and delete tenant secrets. Rotating a secret in the API immediately makes the new value available to journeys and scripts that reference it by name. ### What are the rate limits for the PingOne Advanced Identity Cloud API? The OpenAPI spec does not declare explicit rate limits. Ping Identity applies tenant-level throughput controls in production - back off on 429 responses and avoid running large promotion or certificate operations in tight loops. ### How do I run a config promotion through Jentic? Search Jentic for 'promote Advanced Identity Cloud config', acquire a lock via `/environment/promotion/lock`, then load and execute `/environment/promotion/promote.` Read `/environment/promotion/lock/state` to confirm the lock has been released. ### Does the PingOne Advanced Identity Cloud API support custom domains? Yes, `/environment/custom-domains` and `/environment/custom-domains/{realm}` let you list and manage custom domains attached to specific realms. Pair this with `/environment/certificates` to upload the matching TLS certificate. ### Can I limit what my agent is allowed to do with the PingOne Advanced Identity Cloud API? Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials your agent may use, and you choose exactly which environment endpoints it can call. Since the certificate id sits in the URL path at `/environment/certificates/{id}`, you can pin the agent to read-only certificate and environment record lookups while excluding write operations. The promotion lock and `/environment/promotion/promote` calls that change tenant configuration stay off limits unless you explicitly add them.