Application Developer API
IDaaS provides the Application Developer API for application developers to call.
You can use this API to synchronize accounts and organizational units to IDaaS and manage employee lifecycle events such as onboarding, offboarding, and role changes.
IDaaS administrators have the highest application management permissions. They can specify whether the API is enabled for an application and define its access scope.
Enable the API
You can enable or disable API calls for a specified application on the Developer API tab.
The page contains a toggle to enable or disable the Developer API. A message at the top of the page directs you to Developer API Guide for applications (a blue link).
After you enable the API, provide the application developer with the client_id and client_secret from the General Settings tab. After the permissions are correctly configured, the developer can call the APIs.
API permissions
Administrators can assign a specified application the permissions for the APIs that it can call.
Note: Unlike Alibaba Cloud OpenAPI, the IDaaS Developer API depends on the credentials of the application in IDaaS. API call permissions are assigned in IDaaS application management. Developer API permissions do not depend on RAM.
On the Developer API tab, select use cases. The APIs that correspond to the selected use cases become available for calls.
The account and organizational unit use case includes the following permissions: Query account information (permission value urn:alibaba:idaas:scope:user:read_all, corresponding to the GetUser, GetUserIdByExternalId, ListUsers, and GetUserPasswordPolicy APIs); Manage users (permission value urn:alibaba:idaas:scope:user:manage_all, corresponding to the CreateUser, PatchUser, and DeleteUser APIs); Query organizational unit information (permission value urn:alibaba:idaas:scope:organizational_unit:read_all, corresponding to the GetOrganizationalUnit, GetOrganizationalUnitIdByExternalId, ListOrganizationalUnits, and ListOrganizationalUnitParentIds APIs); and Manage organizational units (permission value urn:alibaba:idaas:scope:organizational_unit:manage_all, corresponding to the CreateOrganizationalUnit, PatchOrganizationalUnit, and DeleteOrganizationalUnit APIs). Select the permissions that your business requires.
Data permissions
The Synchronization Scope configured on the Account Synchronization tab also takes effect and limits the scope of data that can be operated on.
In this example, Synchronization Scope is set to Alibaba Cloud IDaaS.
When an application calls the APIs to perform operations such as creating or querying, it can operate only within the specified Synchronization Scope.
To manage the Synchronization Scope, go to the Account Synchronization tab.
API integration
For integration documentation, see Developer API Guide for applications.
IDaaS provides SDKs in multiple languages. On the Alibaba Cloud OpenAPI Developer Portal, you can download or view call samples and try calling the APIs directly to see the results.