Management APIs-Identity as a Service(IDaaS)-阿里云帮助中心

Management APIs are called by user management systems of business applications to handle account information maintenance and lifecycle management. All Management APIs are protected by the management application access token.

Overview

Method	Endpoint	Description
GET	`/api/bff/v1.2/developer/ciam/management/token/check`	Verifies whether a server-side access token is valid
GET	`/api/bff/v1.2/developer/ciam/management/user`	Retrieves the details of a user by UUID
GET	`/api/bff/v1.2/developer/ciam/management/social/userinfo`	Retrieves user details by social account identifier
POST	`/api/bff/v1.2/developer/ciam/management/user`	Creates a new user
POST	`/api/bff/v1.2/developer/ciam/management/user/enable`	Enables a user account
POST	`/api/bff/v1.2/developer/ciam/management/user/disable`	Disables a user account
POST	`/api/bff/v1.2/developer/ciam/management/user/unlock`	Unlocks a locked user account
GET	`/api/bff/v1.2/developer/ciam/management/token/wechat_micro_program`	Retrieves the cached WeChat mini program access token

Token validity verification

Verifies whether a server-side access token is valid. Call this API from your application server to check token status before performing protected operations.

Request

GET /api/bff/v1.2/developer/ciam/management/token/check

No request parameters.

Response — valid token

Parameter	Type	Example	Description
`success`	boolean	`true`	Specifies whether the request succeeded.
`code`	string	`Operation.Success`	The result code.
`message`	string	`null`	Additional information.
`requestId`	string	`8D5CDDCF-C77A-4A0A-A8A6-16314E57847F`	The request ID.
`data`	JSON	`null`	The response payload.

Response — invalid token

Parameter	Type	Example	Description
`error`	string	`invalid_token`	The error type.
`error_description`	string	`Invalid access token: eyJhbGciOiJIU...WJferRYl0`	A description of the error.

Get user information

Retrieves the basic profile of a user by their unique identifier.

Request

GET /api/bff/v1.2/developer/ciam/management/user

Request parameters

Parameter	Type	Required	Description
`userUuid`	string	Yes	The unique identifier of the user.
`userType`	string	No	The user type. Defaults to regular user.

Response elements

Parameter	Type	Description
`userId`	string	The unique identifier of the user.
`displayName`	string	The display name.
`username`	string	The username.
`phoneNumber`	string	The phone number.
`phoneRegion`	string	The phone area code.
`email`	string	The email address.
`dataDictionaries`	array	Custom user attributes stored in IDaaS data dictionaries. Data dictionaries let administrators define and store custom account properties beyond the standard fields.
`remark`	string	The user source.
`uamParams`	map	Additional UAM parameters.
`locked`	boolean	Specifies whether the user account is locked.
`enabled`	boolean	Specifies whether the user account is enabled.
`createTime`	date	The time when the user registered.
`sourceApplicationUuid`	string	The ID of the application through which the user registered.

Get user information by social account ID

Retrieves user details by the user's unique identifier on a social platform. Use this API when you have a social login identifier and need to look up the corresponding IDaaS user.

Request

GET /api/bff/v1.2/developer/ciam/management/social/userinfo

Request parameters

Parameter	Type	Required	Description
`socialUserId`	string	Yes	The user's unique identifier on the social platform.
`socialId`	string	Yes	The social platform type, as defined by IDaaS.

Response elements

Parameter	Type	Description
`userUuid`	string	The unique identifier of the user in IDaaS.
`displayName`	string	The display name.
`username`	string	The username.
`phoneNumber`	string	The phone number.
`phoneRegion`	string	The phone area code.
`email`	string	The email address.
`dataDictionaries`	array	Custom user attributes stored in IDaaS data dictionaries. Data dictionaries let administrators define and store custom account properties beyond the standard fields.
`remark`	string	The user source.
`uamParams`	map	Additional UAM parameters.
`locked`	boolean	Specifies whether the user account is locked.
`enabled`	boolean	Specifies whether the user account is enabled.
`createTime`	date	The time when the user registered.
`sourceApplicationUuid`	string	The ID of the application through which the user registered.

Add user

Creates a new user in IDaaS.

Request

POST /api/bff/v1.2/developer/ciam/management/user

Request parameters

Parameter	Type	Required	Description
`username`	string	Yes	The username.
`password`	string	Yes	The password.
`phoneNumber`	string	Yes	The phone number.
`phoneRegion`	string	No	The phone area code.
`email`	string	No	The email address.
`userType`	string	No	The user type.
`externalId`	string	No	The external ID for mapping to a record in your system.
`dataDictionaries`	array	No	Custom attribute values to store with this user. Each entry must include `dictionaryCode` (the attribute key) and `value`.

Sample request

{
  "username": "pftest125",
  "password": "Test123456",
  "phoneNumber": "178****1215",
  "email": "855******@qq.com",
  "externalId": "125",
  "dataDictionaries": [
    {
      "dictionaryCode": "languages",
      "value": "en"
    },
    {
      "dictionaryCode": "sex",
      "value": "male"
    }
  ]
}

Response elements

Parameter	Type	Example	Description
`userUuid`	string	`65********93926885`	The unique identifier assigned to the new user in IDaaS.

Sample response

{
    "success": true,
    "code": "Operation.Success",
    "message": "Operation.Success",
    "requestId": "1668062119444$c91e1df2-2450-c0ab-876c-dce7356fbc43",
    "data": {
        "userUuid": "65********93926885"
    }
}

Enable user

Enables a user account so the user can log on and use the system normally.

Request

POST /api/bff/v1.2/developer/ciam/management/user/enable
Content-Type: application/json

Request parameters

Parameter	Type	Required	Description
`userUuid`	string	Yes	The unique identifier of the user.
`userType`	string	No	The user type.

Response elements

Parameter	Type	Example	Description
`success`	boolean	`true`	Specifies whether the operation succeeded.
`code`	string	`Operation.Success`	The result code.
`message`	string	`null`	Additional information.
`requestId`	string	`8D5CDDCF-C77A-4A0A-A8A6-16314E57847F`	The request ID.
`data`	JSON	`null`	The response payload.

Error codes

Error code	Description
`Operation.Success`	The user was enabled successfully.
`Operation.Failure.User.Enabled`	The operation failed because the user is already enabled.

Disable user

Disables a user account. A disabled account cannot perform any operations or log on.

Request

POST /api/bff/v1.2/developer/ciam/management/user/disable
Content-Type: application/json

Request parameters

Parameter	Type	Required	Description
`userUuid`	string	Yes	The unique identifier of the user.
`userType`	string	No	The user type.

Response elements

Parameter	Type	Example	Description
`success`	boolean	`true`	Specifies whether the operation succeeded.
`code`	string	`Operation.Success`	The result code.
`message`	string	`null`	Additional information.
`requestId`	string	`8D5CDDCF-C77A-4A0A-A8A6-16314E57847F`	The request ID.
`data`	JSON	`null`	The response payload.

Error codes

Error code	Description
`Operation.Success`	The user was disabled successfully.
`Operation.Failure.User.Enabled`	The disable operation failed.

Unlock user

Unlocks a user account that was automatically locked after exceeding the failed log on attempt limit set by risk governance. Use this API to proactively restore access for a locked user.

Request

POST /api/bff/v1.2/developer/ciam/management/user/unlock
Content-Type: application/json

Request parameters

Parameter	Type	Required	Description
`userUuid`	string	Yes	The unique identifier of the user.
`userType`	string	No	The user type. Defaults to regular user.

Response elements

Parameter	Type	Example	Description
`success`	boolean	`true`	Specifies whether the operation succeeded.
`code`	string	`Operation.Success`	The result code.
`message`	string	`null`	Additional information.
`requestId`	string	`8D5CDDCF-C77A-4A0A-A8A6-16314E57847F`	The request ID.
`data`	JSON	`null`	The response payload.

Error codes

Error code	Description
`Operation.Success`	The user was unlocked successfully.
`Operation.Failure.User.Enabled`	The unlock operation failed.

Get WeChat mini program token

Retrieves the cached WeChat mini program access token managed by IDaaS.

WeChat mini program access tokens are application-scoped: obtaining a new token from WeChat invalidates the previous token for all applications sharing that mini program. IDaaS maintains a cached token on behalf of your application and automatically refreshes it from WeChat when the cache expires, preventing token conflicts across integrations.

Request

GET /api/bff/v1.2/developer/ciam/management/token/wechat_micro_program

Request parameters

Parameter	Type	Required	Description
`enterpriseAuthId`	string	Yes	The ID of the enterprise authentication source corresponding to the WeChat mini program.

Response elements

Parameter	Type	Example	Description
`access_token`	string	`C77A-4A0A-A8A6-16314E57847F`	The WeChat mini program access token.
`expires_in`	number	`3600`	The validity period of the token in seconds. Does not exceed 7200.
`errcode`	number	`1`	The WeChat error code.
`errmsg`	string	`null`	The WeChat error message.