---
title: "Create or update a domain"
method: PUT
path: "/organizations/{orgId}/environments/{envId}/domains"
tags: ["Domains"]
---

# Create or update a domain

`PUT /organizations/{orgId}/environments/{envId}/domains`

Idempotent create-or-update. Uses the key field in the body to identify the domain. On first apply the domain is created; subsequent applies update it. dataPlaneId is required at creation and immutable afterwards.

## Path parameters

- `orgId` string, required
- `envId` string, required

## Request body

- AutomationDomain — A security domain managed by the Automation API. The key field is the stable, immutable identity used for idempotent create-or-update. Certificates, identity providers, and reporters are not embedded; they are managed via the domain's sub-resource endpoints and referenced here by key.
  - `accountSettings` AutomationAccountSettings — User account settings for the domain: brute-force protection, registration, password reset, remember-me, and MFA challenge behavior.
    - `accountBlockedDuration` integer — Duration, in seconds, for which the account remains blocked after too many failed login attempts.
    - `autoLoginAfterRegistration` boolean — Whether the user is automatically logged in after completing registration.
    - `autoLoginAfterResetPassword` boolean — Whether the user is automatically logged in after a password reset.
    - `completeRegistrationWhenResetPassword` boolean — Whether resetting a password also completes a pending registration.
    - `defaultIdentityProviderForRegistration` string — Key of an identity provider that exists under this domain, used as the default for user registration. Resolved against the domain's identity providers when applied; a value that does not match an existing identity provider is rejected with a 400 response.
    - `deletePasswordlessDevicesAfterResetPassword` boolean — Whether passwordless (WebAuthn) devices are deleted when the password is reset.
    - `dynamicUserRegistration` boolean — Whether dynamic (self-service) user registration is enabled.
    - `inherited` boolean — Whether account settings are inherited from the parent (domain). When true, the other fields are ignored. Has no effect when applied to domains.
    - `loginAttemptsDetectionEnabled` boolean — Whether brute-force authentication attempts are detected and blocked.
    - `loginAttemptsResetTime` integer — Time, in seconds, after which the login attempt counter is reset when the maximum has not been reached.
    - `maxLoginAttempts` integer — Maximum number of failed login attempts before the account is blocked.
    - `mfaChallengeAttemptsDetectionEnabled` boolean — Whether failed MFA challenge attempts are detected and blocked.
    - `mfaChallengeAttemptsResetTime` integer — Time, in seconds, after which the MFA challenge attempt counter is reset.
    - `mfaChallengeMaxAttempts` integer — Maximum number of failed MFA challenge attempts before the user is blocked.
    - `mfaChallengeSendVerifyAlertEmail` boolean — Whether to send an alert email after too many failed MFA challenge attempts.
    - `redirectUriAfterRegistration` string — URL the user is redirected to after registration.
    - `redirectUriAfterResetPassword` string — URL the user is redirected to after a password reset.
    - `rememberMe` boolean — Whether users can remain logged in for a fixed duration (remember-me).
    - `rememberMeDuration` integer — Duration, in seconds, for which a remembered session stays valid.
    - `resetPasswordConfirmIdentity` boolean — Whether the user must confirm their identity before resetting a password.
    - `resetPasswordCustomForm` boolean — Whether a custom form is used for the password-reset step.
    - `resetPasswordCustomFormFields` FormField[] — Custom fields rendered on the password-reset form.
      - `key` string — Identifier of the field, mapped to a user attribute.
      - `label` string — Label displayed for the field.
      - `type` string — Input type of the field.
    - `resetPasswordInvalidateTokens` boolean — Whether existing tokens are invalidated when the password is reset.
    - `sendRecoverAccountEmail` boolean — Whether to send an account-recovery email.
    - `sendVerifyRegistrationAccountEmail` boolean — Whether to send a registration-verification email.
  - `alertEnabled` boolean — Whether alerting is enabled for the domain.
  - `certificateSettings` AutomationCertificateSettings — Domain-level certificate settings.
    - `fallbackCertificate` string — Key of a certificate managed under this domain, used as the fallback certificate when a client does not specify one. Must reference a certificate created via the domain's certificate endpoints.
  - `corsSettings` CorsSettings — Cross-Origin Resource Sharing configuration controlling which web origins may call the domain's endpoints from a browser.
    - `allowCredentials` boolean — Whether the browser may send credentials (cookies, authorization headers) with cross-origin requests.
    - `allowedHeaders` string[] — Request headers permitted on cross-origin requests.
    - `allowedMethods` string[] — HTTP methods permitted on cross-origin requests.
    - `allowedOrigins` string[] — Origins permitted to make cross-origin requests. Use "*" to allow any origin.
    - `enabled` boolean — Whether CORS handling is enabled for the domain.
    - `maxAge` integer — How long, in seconds, a browser may cache the result of a preflight request.
  - `createdAt` string, date-time — Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only.
  - `dataPlaneId` string, required — Identifier of the data plane this domain is connected to. Required at creation and immutable afterwards; included in the desired-state document but never re-applied on update.
  - `description` string — Human-readable description of the domain.
  - `enabled` boolean — Whether the domain handles incoming authentication and authorization requests.
  - `key` string, required — Stable, immutable identifier for the domain within its environment. Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric character. Used to identify the domain on create-or-update.
  - `loginSettings` LoginSettings — Configuration of the domain's login flow and the features offered on the sign-in page.
    - `certificateBasedAuthEnabled` boolean — Whether certificate-based authentication is offered.
    - `certificateBasedAuthUrl` string — URL used for certificate-based authentication.
    - `forgotPasswordEnabled` boolean — Whether users can initiate a forgot-password flow from the login page.
    - `hideForm` boolean — Whether the login form is hidden (for example when only social or identifier-first login is offered).
    - `identifierFirstEnabled` boolean — Whether identifier-first login is enabled, prompting for the username before the password.
    - `inherited` boolean — Whether these login settings are inherited from a parent scope rather than defined here. When true, the other fields are ignored.
    - `magicLinkAuthEnabled` boolean — Whether magic-link authentication is offered.
    - `passwordlessDeviceNamingEnabled` boolean — Whether users can name their passwordless devices.
    - `passwordlessEnabled` boolean — Whether passwordless (WebAuthn) authentication is offered.
    - `passwordlessEnforcePasswordEnabled` boolean — Whether a password is still required alongside passwordless authentication.
    - `passwordlessEnforcePasswordMaxAge` integer — Period, in seconds, after which the user's credentials must be re-entered to keep using passwordless authentication.
    - `passwordlessRememberDeviceEnabled` boolean — Whether a passwordless device can be remembered to skip future challenges.
    - `registerEnabled` boolean — Whether users can self-register from the login page.
    - `rememberMeEnabled` boolean — Whether the login page offers a remember-me option.
    - `resetPasswordOnExpiration` boolean — Whether the user is forced to reset their password once it expires.
  - `master` boolean — Whether this is the master domain of its environment. A master domain may perform cross-domain token introspection.
  - `name` string, required — Human-readable name of the domain.
  - `oidc` AutomationOidcSettings — OpenID Connect settings for the domain. CIMD (client identity metadata document) settings are not exposed by the Automation API and are reset on update.
    - `cibaSettings` AutomationCIBASettings — Client-Initiated Backchannel Authentication (CIBA) settings for the domain. CIBA lets a relying party initiate end-user authentication from a separate consumption device, without redirecting the user through the browser. Authentication device notifiers are not managed by the Automation API and are not exposed here.
      - `authReqExpiry` integer — Default validity period, in seconds, of the issued auth_req_id.
      - `bindingMessageLength` integer — Maximum number of characters accepted for the binding_message parameter.
      - `enabled` boolean — Whether Client-Initiated Backchannel Authentication is enabled for the domain.
      - `tokenReqInterval` integer — Minimum delay, in seconds, that a client must wait between two polls of the token endpoint for the same auth_req_id (POLL or PING delivery mode).
    - `clientRegistrationSettings` AutomationClientRegistrationSettings — OpenID Connect Dynamic Client Registration configuration for the domain.
      - `allowHttpSchemeRedirectUri` boolean — Whether the unsecured http scheme is permitted in redirect URIs.
      - `allowLocalhostRedirectUri` boolean — Whether localhost is permitted as a redirect URI host.
      - `allowRedirectUriParamsExpressionLanguage` boolean — Whether expression language is permitted in redirect URI parameters.
      - `allowWildCardRedirectUri` boolean — Whether wildcards are permitted in redirect URIs.
      - `allowedScopes` string[] — Scopes permitted on client registration requests when the allowed list is enabled.
      - `allowedScopesEnabled` boolean — Whether registered client scopes are restricted to an allowed list.
      - `clientTemplateEnabled` boolean — Whether a client may be used as a template for dynamic client registration.
      - `defaultScopes` string[] — Default scopes added to every client registration request.
      - `dynamicClientRegistrationEnabled` boolean — Whether Dynamic Client Registration is enabled for the domain.
      - `openDynamicClientRegistrationEnabled` boolean — Whether open (unauthenticated) Dynamic Client Registration is enabled for the domain.
    - `postLogoutRedirectUris` string[] — URLs the user may be redirected to after sign-out (post_logout_redirect_uri).
    - `redirectUriStrictMatching` boolean — Whether redirect_uri and post_logout_redirect_uri values are matched strictly during OpenID Connect flows.
    - `requestUris` string[] — Allowed request_uri values for passing OpenID Connect request objects by reference.
    - `securityProfileSettings` SecurityProfileSettings — Financial-grade API (FAPI) security profile configuration for the domain.
      - `enableFapiBrazil` boolean — Whether the Open Banking Brasil Financial-grade API security profile (version 1.0) is applied.
      - `enablePlainFapi` boolean — Whether the standard Financial-grade API security profile (version 1.0) is applied.
    - `workloadIdentitySettings` SpiffeDomainSettings — Workload identity (SPIFFE) settings for the domain.
      - `allowPrivateIpAddress` boolean — Whether trust bundles can be fetched from private IP addresses.
      - `allowUnsecuredHttpUri` boolean — Whether trust bundles can be fetched over unsecured HTTP URIs.
      - `cacheMaxEntries` integer — Maximum number of trust bundle entries retained in the cache.
      - `cacheTtlSeconds` integer — Time-to-live, in seconds, for cached trust bundle entries.
      - `clockSkewSeconds` integer — Allowed clock skew, in seconds, when validating JWT temporal claims.
      - `defaultAllowedAlgorithms` string[] — Default allowlist of signature algorithms accepted for SPIFFE JWT validation.
      - `enabled` boolean — Whether SPIFFE workload identity support is enabled for the domain.
      - `fetchTimeoutMs` integer — Timeout, in milliseconds, for fetching trust bundles.
      - `maxJwtLifetimeSeconds` integer — Maximum accepted JWT lifetime, in seconds, computed as exp minus iat.
      - `maxResponseSizeKb` integer — Maximum trust bundle response size, in kilobytes.
  - `passwordSettings` PasswordSettings — Password policy applied to users of the domain: complexity requirements, expiry, and history.
    - `excludePasswordsInDictionary` boolean — Whether passwords found in a common-password dictionary are rejected.
    - `excludeUserProfileInfoInPassword` boolean — Whether passwords containing the user's profile information are rejected.
    - `expiryDuration` integer — Number of days after which a password expires and must be changed.
    - `includeNumbers` boolean — Whether a password must contain at least one number.
    - `includeSpecialCharacters` boolean — Whether a password must contain at least one special character.
    - `inherited` boolean — Whether these password settings are inherited from a parent scope rather than defined here. When true, the other fields are ignored.
    - `lettersInMixedCase` boolean — Whether a password must contain both uppercase and lowercase letters.
    - `maxConsecutiveLetters` integer — Maximum number of identical consecutive characters allowed in a password.
    - `maxLength` integer — Maximum number of characters a password may contain.
    - `minLength` integer — Minimum number of characters a password must contain.
    - `oldPasswords` integer — Number of previous passwords retained in history and barred from reuse.
    - `passwordHistoryEnabled` boolean — Whether password history is enforced to prevent reuse of recent passwords.
  - `path` string, required — Context path the domain is served under, relative to the gateway. Must start with a slash.
  - `saml` AutomationSamlSettings — Settings for the domain acting as a SAML 2.0 identity provider (IdP).
    - `certificate` string — Key of a certificate managed under this domain, used to sign SAML responses. Must reference a certificate created via the domain's certificate endpoints.
    - `enabled` boolean — Whether the domain exposes the SAML 2.0 IdP protocol.
    - `entityId` string — URL or URN that uniquely identifies this IdP (the SAML entity ID).
  - `scim` SCIMSettings — Configuration of the domain's SCIM 2.0 provisioning endpoints.
    - `enabled` boolean — Whether the SCIM provisioning API is enabled for the domain.
    - `idpSelectionEnabled` boolean — Whether an identity provider is selected for SCIM-provisioned users using a selection rule.
    - `idpSelectionRule` string — Expression that selects the identity provider for a SCIM-provisioned user.
  - `secretExpirationSettings` SecretExpirationSettings — Controls whether client secrets in the domain expire and after how long.
    - `enabled` boolean — Whether client-secret expiration is enabled.
    - `expiryTimeSeconds` integer — Lifetime, in seconds, of a client secret before it expires.
  - `selfServiceAccountManagementSettings` SelfServiceAccountManagementSettings — Controls whether end users can manage their own account (for example, reset their password) and the rules that apply.
    - `enabled` boolean — Whether self-service account management is enabled for end users.
    - `resetPassword` ResetPasswordSettings — Rules applied to a self-service password reset.
      - `oldPasswordRequired` boolean — Whether the user must supply their current password to set a new one.
      - `tokenAge` integer — Lifetime, in seconds, of the password-reset token.
  - `tags` string[] — Sharding tags that control which gateways deploy this domain.
  - `tokenExchangeSettings` TokenExchangeSettings — OAuth 2.0 Token Exchange (RFC 8693) configuration for the domain, covering impersonation and delegation.
    - `allowDelegation` boolean — Whether delegation is allowed, where an actor acts on behalf of the subject and an "act" claim is added to the issued token. At least one of allowImpersonation or allowDelegation must be enabled.
    - `allowImpersonation` boolean — Whether impersonation is allowed, where the issued token represents the subject directly. At least one of allowImpersonation or allowDelegation must be enabled.
    - `allowedActorTokenTypes` string[] — Token types accepted as the actor token when delegating.
    - `allowedRequestedTokenTypes` string[] — Token types that may be requested as the result of an exchange.
    - `allowedSubjectTokenTypes` string[] — Token types accepted as the subject token in an exchange.
    - `enabled` boolean — Whether token exchange is enabled for the domain.
    - `maxDelegationDepth` integer — Maximum depth of the delegation chain (nested "act" claims). Clamped to the range 1–100.
    - `tokenExchangeOAuthSettings` TokenExchangeOAuthSettings — OAuth-specific token-exchange behavior, such as how scopes are handled, with optional inheritance from domain defaults.
      - `inherited` boolean — Whether these settings are inherited from the domain defaults rather than defined here.
      - `scopeHandling` 'downscoping' | 'permissive' — How scopes are handled when issuing the exchanged token. DOWNSCOPING restricts the issued token to a subset of the original scopes.
    - `trustedIssuers` TrustedIssuer[] — External issuers whose JWTs may be accepted as subject or actor tokens. When unset, only domain-issued tokens are accepted.
      - `certificate` string — PEM-encoded X.509 certificate. Required when keyResolutionMethod is PEM.
      - `issuer` string — Expected value of the "iss" claim in the external JWT.
      - `jwksUri` string — JWKS endpoint URL. Required when keyResolutionMethod is JWKS_URL.
      - `keyResolutionMethod` 'jwks_url' | 'pem' — How the issuer's signing key is resolved. JWKS_URL fetches keys from a JWKS endpoint; PEM uses an inline X.509 certificate.
      - `scopeMappings` object — One-to-one mapping from external scope to domain scope. Unmapped issuer scopes are dropped (fail-closed).
      - `userBindingCriteria` UserBindingCriterion[] — Criteria used to locate a domain user when user binding is enabled. All criteria are combined with AND.
        - `attribute` string — Domain user attribute used for the lookup. Must match a field supported by the user repository search.
        - `expression` string — Expression evaluated against the validated token claims (variable "token") to produce the value to match.
      - `userBindingEnabled` boolean — Whether the external JWT subject is resolved to a single domain user using the user binding criteria. When false, a virtual user is built from the token claims only.
  - `uma` UMASettings — Configuration of the domain's User-Managed Access (UMA 2.0) authorization features.
    - `enabled` boolean — Whether User-Managed Access is enabled for the domain.
  - `updatedAt` string, date-time — Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only.
  - `vhostMode` boolean — Whether the domain is exposed through its virtual hosts rather than the default context path. When true, vhosts must be supplied.
  - `vhosts` VirtualHost[] — Virtual hosts the domain is exposed on, overriding the default context path.
    - `host` string — Hostname the domain is served on.
    - `overrideEntrypoint` boolean — Whether this virtual host overrides the organization entry point.
    - `path` string — Context path the domain is served under on this host.
  - `webAuthnSettings` WebAuthnSettings — WebAuthn (FIDO2) relying-party configuration governing passwordless and multi-factor authentication for the domain.
    - `attestationConveyancePreference` 'none' | 'indirect' | 'direct' — Relying-party preference for attestation conveyance during credential creation. NONE requests no attestation, INDIRECT allows anonymized attestation, and DIRECT requests the authenticator's attestation statement.
    - `authenticatorAttachment` 'cross_platform' | 'platform' — Preferred authenticator attachment. PLATFORM selects authenticators bound to the device (such as a fingerprint reader); CROSS_PLATFORM selects roaming authenticators (such as a security key).
    - `certificates` object — Trusted device-attestation X.509 certificates, keyed by name.
    - `enforceAuthenticatorIntegrity` boolean — Whether to periodically re-verify that registered authenticators remain valid against the FIDO2 Metadata Service.
    - `enforceAuthenticatorIntegrityMaxAge` integer — Maximum elapsed time, in seconds, since an authenticator was last verified before it is re-checked on the next passwordless login.
    - `forceRegistration` boolean — Whether to reject registration of a credential already registered to a different user.
    - `origin` string — Relying-party origin; must match the browser's window.location.origin during registration and authentication ceremonies.
    - `relyingPartyId` string — Relying-party identifier: a domain string that scopes credentials to this entity. A credential can only be used with the relying party it was registered against.
    - `relyingPartyName` string — Human-readable relying-party name shown to users during ceremonies.
    - `requireResidentKey` boolean — Whether the authenticator must create a client-side resident (discoverable) credential.
    - `userVerification` 'required' | 'preferred' | 'discouraged' — Relying-party requirement regarding user verification during a ceremony. REQUIRED enforces verification, PREFERRED requests it when available, and DISCOURAGED avoids it.

## Response `200`

The created or updated domain

- AutomationDomain — A security domain managed by the Automation API. The key field is the stable, immutable identity used for idempotent create-or-update. Certificates, identity providers, and reporters are not embedded; they are managed via the domain's sub-resource endpoints and referenced here by key.
  - `accountSettings` AutomationAccountSettings — User account settings for the domain: brute-force protection, registration, password reset, remember-me, and MFA challenge behavior.
    - `accountBlockedDuration` integer — Duration, in seconds, for which the account remains blocked after too many failed login attempts.
    - `autoLoginAfterRegistration` boolean — Whether the user is automatically logged in after completing registration.
    - `autoLoginAfterResetPassword` boolean — Whether the user is automatically logged in after a password reset.
    - `completeRegistrationWhenResetPassword` boolean — Whether resetting a password also completes a pending registration.
    - `defaultIdentityProviderForRegistration` string — Key of an identity provider that exists under this domain, used as the default for user registration. Resolved against the domain's identity providers when applied; a value that does not match an existing identity provider is rejected with a 400 response.
    - `deletePasswordlessDevicesAfterResetPassword` boolean — Whether passwordless (WebAuthn) devices are deleted when the password is reset.
    - `dynamicUserRegistration` boolean — Whether dynamic (self-service) user registration is enabled.
    - `inherited` boolean — Whether account settings are inherited from the parent (domain). When true, the other fields are ignored. Has no effect when applied to domains.
    - `loginAttemptsDetectionEnabled` boolean — Whether brute-force authentication attempts are detected and blocked.
    - `loginAttemptsResetTime` integer — Time, in seconds, after which the login attempt counter is reset when the maximum has not been reached.
    - `maxLoginAttempts` integer — Maximum number of failed login attempts before the account is blocked.
    - `mfaChallengeAttemptsDetectionEnabled` boolean — Whether failed MFA challenge attempts are detected and blocked.
    - `mfaChallengeAttemptsResetTime` integer — Time, in seconds, after which the MFA challenge attempt counter is reset.
    - `mfaChallengeMaxAttempts` integer — Maximum number of failed MFA challenge attempts before the user is blocked.
    - `mfaChallengeSendVerifyAlertEmail` boolean — Whether to send an alert email after too many failed MFA challenge attempts.
    - `redirectUriAfterRegistration` string — URL the user is redirected to after registration.
    - `redirectUriAfterResetPassword` string — URL the user is redirected to after a password reset.
    - `rememberMe` boolean — Whether users can remain logged in for a fixed duration (remember-me).
    - `rememberMeDuration` integer — Duration, in seconds, for which a remembered session stays valid.
    - `resetPasswordConfirmIdentity` boolean — Whether the user must confirm their identity before resetting a password.
    - `resetPasswordCustomForm` boolean — Whether a custom form is used for the password-reset step.
    - `resetPasswordCustomFormFields` FormField[] — Custom fields rendered on the password-reset form.
      - `key` string — Identifier of the field, mapped to a user attribute.
      - `label` string — Label displayed for the field.
      - `type` string — Input type of the field.
    - `resetPasswordInvalidateTokens` boolean — Whether existing tokens are invalidated when the password is reset.
    - `sendRecoverAccountEmail` boolean — Whether to send an account-recovery email.
    - `sendVerifyRegistrationAccountEmail` boolean — Whether to send a registration-verification email.
  - `alertEnabled` boolean — Whether alerting is enabled for the domain.
  - `certificateSettings` AutomationCertificateSettings — Domain-level certificate settings.
    - `fallbackCertificate` string — Key of a certificate managed under this domain, used as the fallback certificate when a client does not specify one. Must reference a certificate created via the domain's certificate endpoints.
  - `corsSettings` CorsSettings — Cross-Origin Resource Sharing configuration controlling which web origins may call the domain's endpoints from a browser.
    - `allowCredentials` boolean — Whether the browser may send credentials (cookies, authorization headers) with cross-origin requests.
    - `allowedHeaders` string[] — Request headers permitted on cross-origin requests.
    - `allowedMethods` string[] — HTTP methods permitted on cross-origin requests.
    - `allowedOrigins` string[] — Origins permitted to make cross-origin requests. Use "*" to allow any origin.
    - `enabled` boolean — Whether CORS handling is enabled for the domain.
    - `maxAge` integer — How long, in seconds, a browser may cache the result of a preflight request.
  - `createdAt` string, date-time — Creation timestamp (ISO-8601 / RFC 3339, UTC). Read-only.
  - `dataPlaneId` string, required — Identifier of the data plane this domain is connected to. Required at creation and immutable afterwards; included in the desired-state document but never re-applied on update.
  - `description` string — Human-readable description of the domain.
  - `enabled` boolean — Whether the domain handles incoming authentication and authorization requests.
  - `key` string, required — Stable, immutable identifier for the domain within its environment. Lowercase alphanumeric and hyphens, starting and ending with an alphanumeric character. Used to identify the domain on create-or-update.
  - `loginSettings` LoginSettings — Configuration of the domain's login flow and the features offered on the sign-in page.
    - `certificateBasedAuthEnabled` boolean — Whether certificate-based authentication is offered.
    - `certificateBasedAuthUrl` string — URL used for certificate-based authentication.
    - `forgotPasswordEnabled` boolean — Whether users can initiate a forgot-password flow from the login page.
    - `hideForm` boolean — Whether the login form is hidden (for example when only social or identifier-first login is offered).
    - `identifierFirstEnabled` boolean — Whether identifier-first login is enabled, prompting for the username before the password.
    - `inherited` boolean — Whether these login settings are inherited from a parent scope rather than defined here. When true, the other fields are ignored.
    - `magicLinkAuthEnabled` boolean — Whether magic-link authentication is offered.
    - `passwordlessDeviceNamingEnabled` boolean — Whether users can name their passwordless devices.
    - `passwordlessEnabled` boolean — Whether passwordless (WebAuthn) authentication is offered.
    - `passwordlessEnforcePasswordEnabled` boolean — Whether a password is still required alongside passwordless authentication.
    - `passwordlessEnforcePasswordMaxAge` integer — Period, in seconds, after which the user's credentials must be re-entered to keep using passwordless authentication.
    - `passwordlessRememberDeviceEnabled` boolean — Whether a passwordless device can be remembered to skip future challenges.
    - `registerEnabled` boolean — Whether users can self-register from the login page.
    - `rememberMeEnabled` boolean — Whether the login page offers a remember-me option.
    - `resetPasswordOnExpiration` boolean — Whether the user is forced to reset their password once it expires.
  - `master` boolean — Whether this is the master domain of its environment. A master domain may perform cross-domain token introspection.
  - `name` string, required — Human-readable name of the domain.
  - `oidc` AutomationOidcSettings — OpenID Connect settings for the domain. CIMD (client identity metadata document) settings are not exposed by the Automation API and are reset on update.
    - `cibaSettings` AutomationCIBASettings — Client-Initiated Backchannel Authentication (CIBA) settings for the domain. CIBA lets a relying party initiate end-user authentication from a separate consumption device, without redirecting the user through the browser. Authentication device notifiers are not managed by the Automation API and are not exposed here.
      - `authReqExpiry` integer — Default validity period, in seconds, of the issued auth_req_id.
      - `bindingMessageLength` integer — Maximum number of characters accepted for the binding_message parameter.
      - `enabled` boolean — Whether Client-Initiated Backchannel Authentication is enabled for the domain.
      - `tokenReqInterval` integer — Minimum delay, in seconds, that a client must wait between two polls of the token endpoint for the same auth_req_id (POLL or PING delivery mode).
    - `clientRegistrationSettings` AutomationClientRegistrationSettings — OpenID Connect Dynamic Client Registration configuration for the domain.
      - `allowHttpSchemeRedirectUri` boolean — Whether the unsecured http scheme is permitted in redirect URIs.
      - `allowLocalhostRedirectUri` boolean — Whether localhost is permitted as a redirect URI host.
      - `allowRedirectUriParamsExpressionLanguage` boolean — Whether expression language is permitted in redirect URI parameters.
      - `allowWildCardRedirectUri` boolean — Whether wildcards are permitted in redirect URIs.
      - `allowedScopes` string[] — Scopes permitted on client registration requests when the allowed list is enabled.
      - `allowedScopesEnabled` boolean — Whether registered client scopes are restricted to an allowed list.
      - `clientTemplateEnabled` boolean — Whether a client may be used as a template for dynamic client registration.
      - `defaultScopes` string[] — Default scopes added to every client registration request.
      - `dynamicClientRegistrationEnabled` boolean — Whether Dynamic Client Registration is enabled for the domain.
      - `openDynamicClientRegistrationEnabled` boolean — Whether open (unauthenticated) Dynamic Client Registration is enabled for the domain.
    - `postLogoutRedirectUris` string[] — URLs the user may be redirected to after sign-out (post_logout_redirect_uri).
    - `redirectUriStrictMatching` boolean — Whether redirect_uri and post_logout_redirect_uri values are matched strictly during OpenID Connect flows.
    - `requestUris` string[] — Allowed request_uri values for passing OpenID Connect request objects by reference.
    - `securityProfileSettings` SecurityProfileSettings — Financial-grade API (FAPI) security profile configuration for the domain.
      - `enableFapiBrazil` boolean — Whether the Open Banking Brasil Financial-grade API security profile (version 1.0) is applied.
      - `enablePlainFapi` boolean — Whether the standard Financial-grade API security profile (version 1.0) is applied.
    - `workloadIdentitySettings` SpiffeDomainSettings — Workload identity (SPIFFE) settings for the domain.
      - `allowPrivateIpAddress` boolean — Whether trust bundles can be fetched from private IP addresses.
      - `allowUnsecuredHttpUri` boolean — Whether trust bundles can be fetched over unsecured HTTP URIs.
      - `cacheMaxEntries` integer — Maximum number of trust bundle entries retained in the cache.
      - `cacheTtlSeconds` integer — Time-to-live, in seconds, for cached trust bundle entries.
      - `clockSkewSeconds` integer — Allowed clock skew, in seconds, when validating JWT temporal claims.
      - `defaultAllowedAlgorithms` string[] — Default allowlist of signature algorithms accepted for SPIFFE JWT validation.
      - `enabled` boolean — Whether SPIFFE workload identity support is enabled for the domain.
      - `fetchTimeoutMs` integer — Timeout, in milliseconds, for fetching trust bundles.
      - `maxJwtLifetimeSeconds` integer — Maximum accepted JWT lifetime, in seconds, computed as exp minus iat.
      - `maxResponseSizeKb` integer — Maximum trust bundle response size, in kilobytes.
  - `passwordSettings` PasswordSettings — Password policy applied to users of the domain: complexity requirements, expiry, and history.
    - `excludePasswordsInDictionary` boolean — Whether passwords found in a common-password dictionary are rejected.
    - `excludeUserProfileInfoInPassword` boolean — Whether passwords containing the user's profile information are rejected.
    - `expiryDuration` integer — Number of days after which a password expires and must be changed.
    - `includeNumbers` boolean — Whether a password must contain at least one number.
    - `includeSpecialCharacters` boolean — Whether a password must contain at least one special character.
    - `inherited` boolean — Whether these password settings are inherited from a parent scope rather than defined here. When true, the other fields are ignored.
    - `lettersInMixedCase` boolean — Whether a password must contain both uppercase and lowercase letters.
    - `maxConsecutiveLetters` integer — Maximum number of identical consecutive characters allowed in a password.
    - `maxLength` integer — Maximum number of characters a password may contain.
    - `minLength` integer — Minimum number of characters a password must contain.
    - `oldPasswords` integer — Number of previous passwords retained in history and barred from reuse.
    - `passwordHistoryEnabled` boolean — Whether password history is enforced to prevent reuse of recent passwords.
  - `path` string, required — Context path the domain is served under, relative to the gateway. Must start with a slash.
  - `saml` AutomationSamlSettings — Settings for the domain acting as a SAML 2.0 identity provider (IdP).
    - `certificate` string — Key of a certificate managed under this domain, used to sign SAML responses. Must reference a certificate created via the domain's certificate endpoints.
    - `enabled` boolean — Whether the domain exposes the SAML 2.0 IdP protocol.
    - `entityId` string — URL or URN that uniquely identifies this IdP (the SAML entity ID).
  - `scim` SCIMSettings — Configuration of the domain's SCIM 2.0 provisioning endpoints.
    - `enabled` boolean — Whether the SCIM provisioning API is enabled for the domain.
    - `idpSelectionEnabled` boolean — Whether an identity provider is selected for SCIM-provisioned users using a selection rule.
    - `idpSelectionRule` string — Expression that selects the identity provider for a SCIM-provisioned user.
  - `secretExpirationSettings` SecretExpirationSettings — Controls whether client secrets in the domain expire and after how long.
    - `enabled` boolean — Whether client-secret expiration is enabled.
    - `expiryTimeSeconds` integer — Lifetime, in seconds, of a client secret before it expires.
  - `selfServiceAccountManagementSettings` SelfServiceAccountManagementSettings — Controls whether end users can manage their own account (for example, reset their password) and the rules that apply.
    - `enabled` boolean — Whether self-service account management is enabled for end users.
    - `resetPassword` ResetPasswordSettings — Rules applied to a self-service password reset.
      - `oldPasswordRequired` boolean — Whether the user must supply their current password to set a new one.
      - `tokenAge` integer — Lifetime, in seconds, of the password-reset token.
  - `tags` string[] — Sharding tags that control which gateways deploy this domain.
  - `tokenExchangeSettings` TokenExchangeSettings — OAuth 2.0 Token Exchange (RFC 8693) configuration for the domain, covering impersonation and delegation.
    - `allowDelegation` boolean — Whether delegation is allowed, where an actor acts on behalf of the subject and an "act" claim is added to the issued token. At least one of allowImpersonation or allowDelegation must be enabled.
    - `allowImpersonation` boolean — Whether impersonation is allowed, where the issued token represents the subject directly. At least one of allowImpersonation or allowDelegation must be enabled.
    - `allowedActorTokenTypes` string[] — Token types accepted as the actor token when delegating.
    - `allowedRequestedTokenTypes` string[] — Token types that may be requested as the result of an exchange.
    - `allowedSubjectTokenTypes` string[] — Token types accepted as the subject token in an exchange.
    - `enabled` boolean — Whether token exchange is enabled for the domain.
    - `maxDelegationDepth` integer — Maximum depth of the delegation chain (nested "act" claims). Clamped to the range 1–100.
    - `tokenExchangeOAuthSettings` TokenExchangeOAuthSettings — OAuth-specific token-exchange behavior, such as how scopes are handled, with optional inheritance from domain defaults.
      - `inherited` boolean — Whether these settings are inherited from the domain defaults rather than defined here.
      - `scopeHandling` 'downscoping' | 'permissive' — How scopes are handled when issuing the exchanged token. DOWNSCOPING restricts the issued token to a subset of the original scopes.
    - `trustedIssuers` TrustedIssuer[] — External issuers whose JWTs may be accepted as subject or actor tokens. When unset, only domain-issued tokens are accepted.
      - `certificate` string — PEM-encoded X.509 certificate. Required when keyResolutionMethod is PEM.
      - `issuer` string — Expected value of the "iss" claim in the external JWT.
      - `jwksUri` string — JWKS endpoint URL. Required when keyResolutionMethod is JWKS_URL.
      - `keyResolutionMethod` 'jwks_url' | 'pem' — How the issuer's signing key is resolved. JWKS_URL fetches keys from a JWKS endpoint; PEM uses an inline X.509 certificate.
      - `scopeMappings` object — One-to-one mapping from external scope to domain scope. Unmapped issuer scopes are dropped (fail-closed).
      - `userBindingCriteria` UserBindingCriterion[] — Criteria used to locate a domain user when user binding is enabled. All criteria are combined with AND.
        - `attribute` string — Domain user attribute used for the lookup. Must match a field supported by the user repository search.
        - `expression` string — Expression evaluated against the validated token claims (variable "token") to produce the value to match.
      - `userBindingEnabled` boolean — Whether the external JWT subject is resolved to a single domain user using the user binding criteria. When false, a virtual user is built from the token claims only.
  - `uma` UMASettings — Configuration of the domain's User-Managed Access (UMA 2.0) authorization features.
    - `enabled` boolean — Whether User-Managed Access is enabled for the domain.
  - `updatedAt` string, date-time — Last-update timestamp (ISO-8601 / RFC 3339, UTC). Read-only.
  - `vhostMode` boolean — Whether the domain is exposed through its virtual hosts rather than the default context path. When true, vhosts must be supplied.
  - `vhosts` VirtualHost[] — Virtual hosts the domain is exposed on, overriding the default context path.
    - `host` string — Hostname the domain is served on.
    - `overrideEntrypoint` boolean — Whether this virtual host overrides the organization entry point.
    - `path` string — Context path the domain is served under on this host.
  - `webAuthnSettings` WebAuthnSettings — WebAuthn (FIDO2) relying-party configuration governing passwordless and multi-factor authentication for the domain.
    - `attestationConveyancePreference` 'none' | 'indirect' | 'direct' — Relying-party preference for attestation conveyance during credential creation. NONE requests no attestation, INDIRECT allows anonymized attestation, and DIRECT requests the authenticator's attestation statement.
    - `authenticatorAttachment` 'cross_platform' | 'platform' — Preferred authenticator attachment. PLATFORM selects authenticators bound to the device (such as a fingerprint reader); CROSS_PLATFORM selects roaming authenticators (such as a security key).
    - `certificates` object — Trusted device-attestation X.509 certificates, keyed by name.
    - `enforceAuthenticatorIntegrity` boolean — Whether to periodically re-verify that registered authenticators remain valid against the FIDO2 Metadata Service.
    - `enforceAuthenticatorIntegrityMaxAge` integer — Maximum elapsed time, in seconds, since an authenticator was last verified before it is re-checked on the next passwordless login.
    - `forceRegistration` boolean — Whether to reject registration of a credential already registered to a different user.
    - `origin` string — Relying-party origin; must match the browser's window.location.origin during registration and authentication ceremonies.
    - `relyingPartyId` string — Relying-party identifier: a domain string that scopes credentials to this entity. A credential can only be used with the relying party it was registered against.
    - `relyingPartyName` string — Human-readable relying-party name shown to users during ceremonies.
    - `requireResidentKey` boolean — Whether the authenticator must create a client-side resident (discoverable) credential.
    - `userVerification` 'required' | 'preferred' | 'discouraged' — Relying-party requirement regarding user verification during a ceremony. REQUIRED enforces verification, PREFERRED requests it when available, and DISCOURAGED avoids it.

## Other responses

- `400` — Invalid request: validation failure, an immutable field change, a key that already exists for a domain not managed by the Automation API, or an unknown defaultIdentityProviderForRegistration reference
- `403` — Permission denied

---

[API](https://skmtc.net/gravitee-io/apis/gravitee-io-am-automation-api.md) · [All operations](https://skmtc.net/gravitee-io/apis/gravitee-io-am-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gravitee-io/gravitee-io-am-automation-api/revisions/39ed35bd3858/schema)