Package ai.vectros.resources.identity

Class AsyncIdentityClient

java.lang.Object
ai.vectros.resources.identity.AsyncIdentityClient
public class AsyncIdentityClient extends Object

  • Field Details

  • Constructor Details

    • AsyncIdentityClient

      public AsyncIdentityClient(ClientOptions clientOptions)

  • Method Details

    • withRawResponse

      public AsyncRawIdentityClient withRawResponse()
      Get responses with HTTP metadata like headers

    • listEntities

      public CompletableFuture<EntityPage> listEntities(String namespace)
      Returns a paginated list of entities in a namespace. Filter by userId (entities owned by a user), by externalId (exact lookup by your own identifier), or by scope (scope=<namespace>:<value> — entities that have that value as a parent, e.g. scope=org:6ba7...). Naming this namespace's own name in scope resolves the entity itself (scope=team:6ba7... on /v1/entities/team returns that team), since an entity is always in its own scope. userId and scope can be combined to narrow on both dimensions at once; externalId identifies a single entity and cannot be combined with either. Requires the entities:r:<namespace> scope.

    • listEntities

      public CompletableFuture<EntityPage> listEntities(String namespace, RequestOptions requestOptions)
      Returns a paginated list of entities in a namespace. Filter by userId (entities owned by a user), by externalId (exact lookup by your own identifier), or by scope (scope=<namespace>:<value> — entities that have that value as a parent, e.g. scope=org:6ba7...). Naming this namespace's own name in scope resolves the entity itself (scope=team:6ba7... on /v1/entities/team returns that team), since an entity is always in its own scope. userId and scope can be combined to narrow on both dimensions at once; externalId identifies a single entity and cannot be combined with either. Requires the entities:r:<namespace> scope.

    • listEntities

      public CompletableFuture<EntityPage> listEntities(String namespace, ListEntitiesRequest request)
      Returns a paginated list of entities in a namespace. Filter by userId (entities owned by a user), by externalId (exact lookup by your own identifier), or by scope (scope=<namespace>:<value> — entities that have that value as a parent, e.g. scope=org:6ba7...). Naming this namespace's own name in scope resolves the entity itself (scope=team:6ba7... on /v1/entities/team returns that team), since an entity is always in its own scope. userId and scope can be combined to narrow on both dimensions at once; externalId identifies a single entity and cannot be combined with either. Requires the entities:r:<namespace> scope.

    • listEntities

      public CompletableFuture<EntityPage> listEntities(String namespace, ListEntitiesRequest request, RequestOptions requestOptions)
      Returns a paginated list of entities in a namespace. Filter by userId (entities owned by a user), by externalId (exact lookup by your own identifier), or by scope (scope=<namespace>:<value> — entities that have that value as a parent, e.g. scope=org:6ba7...). Naming this namespace's own name in scope resolves the entity itself (scope=team:6ba7... on /v1/entities/team returns that team), since an entity is always in its own scope. userId and scope can be combined to narrow on both dimensions at once; externalId identifies a single entity and cannot be combined with either. Requires the entities:r:<namespace> scope.

    • createEntity

      public CompletableFuture<EntityResponse> createEntity(String namespace, EntityRequest body)
      Creates a new entity in the given namespace. This call is idempotent on externalId within the namespace: if an entity with the same externalId already exists, the existing record is returned instead of creating a duplicate (created: false, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set ?upsert=true (also requires the entities:u:<namespace> scope). The namespace must be entity-backed (org/client, or registered via POST /v1/namespaces). Requires the entities:c:<namespace> scope to create. Being returned the existing entity on a collision is a read of that entity's data and additionally requires the entities:r:<namespace> scope — a credential holding entities:c:<namespace> alone receives a 400 ("already in use") on collision instead of the entity.

    • createEntity

      public CompletableFuture<EntityResponse> createEntity(String namespace, EntityRequest body, RequestOptions requestOptions)
      Creates a new entity in the given namespace. This call is idempotent on externalId within the namespace: if an entity with the same externalId already exists, the existing record is returned instead of creating a duplicate (created: false, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set ?upsert=true (also requires the entities:u:<namespace> scope). The namespace must be entity-backed (org/client, or registered via POST /v1/namespaces). Requires the entities:c:<namespace> scope to create. Being returned the existing entity on a collision is a read of that entity's data and additionally requires the entities:r:<namespace> scope — a credential holding entities:c:<namespace> alone receives a 400 ("already in use") on collision instead of the entity.

    • createEntity

      public CompletableFuture<EntityResponse> createEntity(String namespace, CreateEntityRequest request)
      Creates a new entity in the given namespace. This call is idempotent on externalId within the namespace: if an entity with the same externalId already exists, the existing record is returned instead of creating a duplicate (created: false, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set ?upsert=true (also requires the entities:u:<namespace> scope). The namespace must be entity-backed (org/client, or registered via POST /v1/namespaces). Requires the entities:c:<namespace> scope to create. Being returned the existing entity on a collision is a read of that entity's data and additionally requires the entities:r:<namespace> scope — a credential holding entities:c:<namespace> alone receives a 400 ("already in use") on collision instead of the entity.

    • createEntity

      public CompletableFuture<EntityResponse> createEntity(String namespace, CreateEntityRequest request, RequestOptions requestOptions)
      Creates a new entity in the given namespace. This call is idempotent on externalId within the namespace: if an entity with the same externalId already exists, the existing record is returned instead of creating a duplicate (created: false, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set ?upsert=true (also requires the entities:u:<namespace> scope). The namespace must be entity-backed (org/client, or registered via POST /v1/namespaces). Requires the entities:c:<namespace> scope to create. Being returned the existing entity on a collision is a read of that entity's data and additionally requires the entities:r:<namespace> scope — a credential holding entities:c:<namespace> alone receives a 400 ("already in use") on collision instead of the entity.

    • getEntity

      public CompletableFuture<EntityResponse> getEntity(String namespace, String id)
      Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the entities:r:<namespace> scope.

    • getEntity

      public CompletableFuture<EntityResponse> getEntity(String namespace, String id, RequestOptions requestOptions)
      Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the entities:r:<namespace> scope.

    • getEntity

      public CompletableFuture<EntityResponse> getEntity(String namespace, String id, GetEntityRequest request)
      Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the entities:r:<namespace> scope.

    • getEntity

      public CompletableFuture<EntityResponse> getEntity(String namespace, String id, GetEntityRequest request, RequestOptions requestOptions)
      Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the entities:r:<namespace> scope.

    • updateEntity

      public CompletableFuture<EntityResponse> updateEntity(String namespace, String id, EntityRequest body)
      Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the payload object is replaced in full when supplied. Providing scopes replaces the entity's parent edges. Requires the entities:u:<namespace> scope.

    • updateEntity

      public CompletableFuture<EntityResponse> updateEntity(String namespace, String id, EntityRequest body, RequestOptions requestOptions)
      Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the payload object is replaced in full when supplied. Providing scopes replaces the entity's parent edges. Requires the entities:u:<namespace> scope.

    • updateEntity

      public CompletableFuture<EntityResponse> updateEntity(String namespace, String id, UpdateEntityRequest request)
      Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the payload object is replaced in full when supplied. Providing scopes replaces the entity's parent edges. Requires the entities:u:<namespace> scope.

    • updateEntity

      public CompletableFuture<EntityResponse> updateEntity(String namespace, String id, UpdateEntityRequest request, RequestOptions requestOptions)
      Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the payload object is replaced in full when supplied. Providing scopes replaces the entity's parent edges. Requires the entities:u:<namespace> scope.

    • deleteEntity

      public CompletableFuture<Void> deleteEntity(String namespace, String id)
      Permanently deletes an entity. This action cannot be undone. Requires the entities:d:<namespace> scope.

    • deleteEntity

      public CompletableFuture<Void> deleteEntity(String namespace, String id, RequestOptions requestOptions)
      Permanently deletes an entity. This action cannot be undone. Requires the entities:d:<namespace> scope.

    • deleteEntity

      public CompletableFuture<Void> deleteEntity(String namespace, String id, DeleteEntityRequest request)
      Permanently deletes an entity. This action cannot be undone. Requires the entities:d:<namespace> scope.

    • deleteEntity

      public CompletableFuture<Void> deleteEntity(String namespace, String id, DeleteEntityRequest request, RequestOptions requestOptions)
      Permanently deletes an entity. This action cannot be undone. Requires the entities:d:<namespace> scope.

    • lookupEntities

      public CompletableFuture<EntityPage> lookupEntities(String namespace, IdentityLookupRequest body)
      Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the type/field/value lookup on GET /v1/entities/{namespace}, which rejects sensitive-field values and directs you here. Requires the entities:r:<namespace> scope.

    • lookupEntities

      public CompletableFuture<EntityPage> lookupEntities(String namespace, IdentityLookupRequest body, RequestOptions requestOptions)
      Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the type/field/value lookup on GET /v1/entities/{namespace}, which rejects sensitive-field values and directs you here. Requires the entities:r:<namespace> scope.

    • lookupEntities

      public CompletableFuture<EntityPage> lookupEntities(String namespace, LookupEntitiesRequest request)
      Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the type/field/value lookup on GET /v1/entities/{namespace}, which rejects sensitive-field values and directs you here. Requires the entities:r:<namespace> scope.

    • lookupEntities

      public CompletableFuture<EntityPage> lookupEntities(String namespace, LookupEntitiesRequest request, RequestOptions requestOptions)
      Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the type/field/value lookup on GET /v1/entities/{namespace}, which rejects sensitive-field values and directs you here. Requires the entities:r:<namespace> scope.

    • getEntityVersions

      public CompletableFuture<ModelDataVersionPage> getEntityVersions(String namespace, String id)
      Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the entities:r:<namespace> scope.

    • getEntityVersions

      public CompletableFuture<ModelDataVersionPage> getEntityVersions(String namespace, String id, RequestOptions requestOptions)
      Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the entities:r:<namespace> scope.

    • getEntityVersions

      public CompletableFuture<ModelDataVersionPage> getEntityVersions(String namespace, String id, GetEntityVersionsRequest request)
      Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the entities:r:<namespace> scope.

    • getEntityVersions

      public CompletableFuture<ModelDataVersionPage> getEntityVersions(String namespace, String id, GetEntityVersionsRequest request, RequestOptions requestOptions)
      Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the entities:r:<namespace> scope.

    • getNamespace

      public CompletableFuture<NamespaceResponse> getNamespace(String namespace)
      Retrieves a single scope-namespace registration by name.

    • getNamespace

      public CompletableFuture<NamespaceResponse> getNamespace(String namespace, RequestOptions requestOptions)
      Retrieves a single scope-namespace registration by name.

    • getNamespace

      public CompletableFuture<NamespaceResponse> getNamespace(String namespace, GetNamespaceRequest request)
      Retrieves a single scope-namespace registration by name.

    • getNamespace

      public CompletableFuture<NamespaceResponse> getNamespace(String namespace, GetNamespaceRequest request, RequestOptions requestOptions)
      Retrieves a single scope-namespace registration by name.

    • updateNamespace

      public CompletableFuture<NamespaceResponse> updateNamespace(String namespace, NamespaceRequest body)
      Updates the mutable fields (entityBacked, defaultSchemaId, specificityRank) of a registered namespace. The namespace name and its contextId (which row is selected) are both immutable. Requires a root API key. org and client are updatable like any other namespace — there is no reserved-built-in exception.

    • updateNamespace

      public CompletableFuture<NamespaceResponse> updateNamespace(String namespace, NamespaceRequest body, RequestOptions requestOptions)
      Updates the mutable fields (entityBacked, defaultSchemaId, specificityRank) of a registered namespace. The namespace name and its contextId (which row is selected) are both immutable. Requires a root API key. org and client are updatable like any other namespace — there is no reserved-built-in exception.

    • updateNamespace

      public CompletableFuture<NamespaceResponse> updateNamespace(String namespace, UpdateNamespaceRequest request)
      Updates the mutable fields (entityBacked, defaultSchemaId, specificityRank) of a registered namespace. The namespace name and its contextId (which row is selected) are both immutable. Requires a root API key. org and client are updatable like any other namespace — there is no reserved-built-in exception.

    • updateNamespace

      public CompletableFuture<NamespaceResponse> updateNamespace(String namespace, UpdateNamespaceRequest request, RequestOptions requestOptions)
      Updates the mutable fields (entityBacked, defaultSchemaId, specificityRank) of a registered namespace. The namespace name and its contextId (which row is selected) are both immutable. Requires a root API key. org and client are updatable like any other namespace — there is no reserved-built-in exception.

    • deleteNamespace

      public CompletableFuture<Void> deleteNamespace(String namespace)
      Deletes a registered scope namespace. Requires a root API key. org and client are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.

    • deleteNamespace

      public CompletableFuture<Void> deleteNamespace(String namespace, RequestOptions requestOptions)
      Deletes a registered scope namespace. Requires a root API key. org and client are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.

    • deleteNamespace

      public CompletableFuture<Void> deleteNamespace(String namespace, DeleteNamespaceRequest request)
      Deletes a registered scope namespace. Requires a root API key. org and client are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.

    • deleteNamespace

      public CompletableFuture<Void> deleteNamespace(String namespace, DeleteNamespaceRequest request, RequestOptions requestOptions)
      Deletes a registered scope namespace. Requires a root API key. org and client are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.

    • listNamespaces

      public CompletableFuture<NamespacePage> listNamespaces()
      Returns the scope namespaces registered in your account. Returns a {data, nextCursor} envelope.

    • listNamespaces

      public CompletableFuture<NamespacePage> listNamespaces(RequestOptions requestOptions)
      Returns the scope namespaces registered in your account. Returns a {data, nextCursor} envelope.

    • listNamespaces

      public CompletableFuture<NamespacePage> listNamespaces(ListNamespacesRequest request)
      Returns the scope namespaces registered in your account. Returns a {data, nextCursor} envelope.

    • listNamespaces

      public CompletableFuture<NamespacePage> listNamespaces(ListNamespacesRequest request, RequestOptions requestOptions)
      Returns the scope namespaces registered in your account. Returns a {data, nextCursor} envelope.

    • registerNamespace

      public CompletableFuture<NamespaceResponse> registerNamespace(NamespaceRequest body)
      Registers a new scope namespace and declares whether its values resolve to identity entities (entityBacked). Also requires specificityRank, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and contextId is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). org and client are reserved names, registered the same way as any other namespace.

    • registerNamespace

      public CompletableFuture<NamespaceResponse> registerNamespace(NamespaceRequest body, RequestOptions requestOptions)
      Registers a new scope namespace and declares whether its values resolve to identity entities (entityBacked). Also requires specificityRank, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and contextId is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). org and client are reserved names, registered the same way as any other namespace.

    • registerNamespace

      public CompletableFuture<NamespaceResponse> registerNamespace(RegisterNamespaceRequest request)
      Registers a new scope namespace and declares whether its values resolve to identity entities (entityBacked). Also requires specificityRank, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and contextId is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). org and client are reserved names, registered the same way as any other namespace.

    • registerNamespace

      public CompletableFuture<NamespaceResponse> registerNamespace(RegisterNamespaceRequest request, RequestOptions requestOptions)
      Registers a new scope namespace and declares whether its values resolve to identity entities (entityBacked). Also requires specificityRank, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and contextId is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). org and client are reserved names, registered the same way as any other namespace.

    • listUsers

      public CompletableFuture<UserPage> listUsers()
      Returns a paginated list of the users in your account. Pass externalId to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply type and field together with one lookup mode: value (exact match), from+to (range), or prefix. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • listUsers

      public CompletableFuture<UserPage> listUsers(RequestOptions requestOptions)
      Returns a paginated list of the users in your account. Pass externalId to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply type and field together with one lookup mode: value (exact match), from+to (range), or prefix. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • listUsers

      public CompletableFuture<UserPage> listUsers(ListUsersRequest request)
      Returns a paginated list of the users in your account. Pass externalId to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply type and field together with one lookup mode: value (exact match), from+to (range), or prefix. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • listUsers

      public CompletableFuture<UserPage> listUsers(ListUsersRequest request, RequestOptions requestOptions)
      Returns a paginated list of the users in your account. Pass externalId to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply type and field together with one lookup mode: value (exact match), from+to (range), or prefix. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • createUser

      public CompletableFuture<UserResponse> createUser(UserRequest body)
      Creates a user identity in your account. The operation is idempotent on externalId: if a user with the same externalId already exists, the existing record is returned instead of creating a duplicate. The response's created field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set ?upsert=true (this also requires the users:u scope). Requires the users:c scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the users:r scope — a credential holding users:c alone receives a 400 ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with ?upsert=true, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform 400 instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to ?upsert=true.

    • createUser

      public CompletableFuture<UserResponse> createUser(UserRequest body, RequestOptions requestOptions)
      Creates a user identity in your account. The operation is idempotent on externalId: if a user with the same externalId already exists, the existing record is returned instead of creating a duplicate. The response's created field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set ?upsert=true (this also requires the users:u scope). Requires the users:c scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the users:r scope — a credential holding users:c alone receives a 400 ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with ?upsert=true, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform 400 instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to ?upsert=true.

    • createUser

      public CompletableFuture<UserResponse> createUser(CreateUserRequest request)
      Creates a user identity in your account. The operation is idempotent on externalId: if a user with the same externalId already exists, the existing record is returned instead of creating a duplicate. The response's created field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set ?upsert=true (this also requires the users:u scope). Requires the users:c scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the users:r scope — a credential holding users:c alone receives a 400 ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with ?upsert=true, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform 400 instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to ?upsert=true.

    • createUser

      public CompletableFuture<UserResponse> createUser(CreateUserRequest request, RequestOptions requestOptions)
      Creates a user identity in your account. The operation is idempotent on externalId: if a user with the same externalId already exists, the existing record is returned instead of creating a duplicate. The response's created field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set ?upsert=true (this also requires the users:u scope). Requires the users:c scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the users:r scope — a credential holding users:c alone receives a 400 ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with ?upsert=true, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform 400 instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to ?upsert=true.

    • getUser

      public CompletableFuture<UserResponse> getUser(String id)
      Retrieves a single user by its Vectros-assigned ID. Requires the users:r scope.

    • getUser

      public CompletableFuture<UserResponse> getUser(String id, RequestOptions requestOptions)
      Retrieves a single user by its Vectros-assigned ID. Requires the users:r scope.

    • getUser

      public CompletableFuture<UserResponse> getUser(String id, GetUserRequest request)
      Retrieves a single user by its Vectros-assigned ID. Requires the users:r scope.

    • getUser

      public CompletableFuture<UserResponse> getUser(String id, GetUserRequest request, RequestOptions requestOptions)
      Retrieves a single user by its Vectros-assigned ID. Requires the users:r scope.

    • updateUser

      public CompletableFuture<UserResponse> updateUser(String id, UpdateUserRequest request)
      Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The type field is immutable after creation, and email cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries inviteToken, externalSubject, and emailVerifiedAttestation=true completes the invitation. externalSubject set this way is NOT an authentication binding and does not enable sign-in anywhere — not the Vectros DevPortal/Admin App/web apps, and not /v1/auth/token/exchange either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem inviteToken themselves at /v1/auth/token/exchange with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the users:u scope.

    • updateUser

      public CompletableFuture<UserResponse> updateUser(String id, UpdateUserRequest request, RequestOptions requestOptions)
      Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The type field is immutable after creation, and email cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries inviteToken, externalSubject, and emailVerifiedAttestation=true completes the invitation. externalSubject set this way is NOT an authentication binding and does not enable sign-in anywhere — not the Vectros DevPortal/Admin App/web apps, and not /v1/auth/token/exchange either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem inviteToken themselves at /v1/auth/token/exchange with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the users:u scope.

    • deleteUser

      public CompletableFuture<Void> deleteUser(String id)
      Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the users:d scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.

    • deleteUser

      public CompletableFuture<Void> deleteUser(String id, RequestOptions requestOptions)
      Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the users:d scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.

    • deleteUser

      public CompletableFuture<Void> deleteUser(String id, DeleteUserRequest request)
      Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the users:d scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.

    • deleteUser

      public CompletableFuture<Void> deleteUser(String id, DeleteUserRequest request, RequestOptions requestOptions)
      Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the users:d scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.

    • lookupUsers

      public CompletableFuture<UserPage> lookupUsers(IdentityLookupRequest request)
      Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • lookupUsers

      public CompletableFuture<UserPage> lookupUsers(IdentityLookupRequest request, RequestOptions requestOptions)
      Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.

    • userExistsByEmail

      public CompletableFuture<UserExistsResponse> userExistsByEmail()
      Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. exists is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the contextId you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns {exists, userId, status} — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a userId, without paging through the full context membership. Requires the users:r scope.

    • userExistsByEmail

      public CompletableFuture<UserExistsResponse> userExistsByEmail(RequestOptions requestOptions)
      Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. exists is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the contextId you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns {exists, userId, status} — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a userId, without paging through the full context membership. Requires the users:r scope.

    • userExistsByEmail

      public CompletableFuture<UserExistsResponse> userExistsByEmail(UserExistsByEmailRequest request)
      Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. exists is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the contextId you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns {exists, userId, status} — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a userId, without paging through the full context membership. Requires the users:r scope.

    • userExistsByEmail

      public CompletableFuture<UserExistsResponse> userExistsByEmail(UserExistsByEmailRequest request, RequestOptions requestOptions)
      Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. exists is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the contextId you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns {exists, userId, status} — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a userId, without paging through the full context membership. Requires the users:r scope.

    • getUserVersions

      public CompletableFuture<ModelDataVersionPage> getUserVersions(String id)
      Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope.

    • getUserVersions

      public CompletableFuture<ModelDataVersionPage> getUserVersions(String id, RequestOptions requestOptions)
      Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope.

    • getUserVersions

      public CompletableFuture<ModelDataVersionPage> getUserVersions(String id, GetUserVersionsRequest request)
      Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope.

    • getUserVersions

      public CompletableFuture<ModelDataVersionPage> getUserVersions(String id, GetUserVersionsRequest request, RequestOptions requestOptions)
      Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the {data, nextCursor} envelope. Requires the users:r scope.