TrueCaaS is a customer access control platform that helps B2B SaaS teams manage customer identity, enterprise federation, tenant-aware authorization, backend entitlement checks, and explainable access decisions in one product-aware control plane.

Who is TrueCaaS built for?

TrueCaaS is built for B2B SaaS teams, partner portals, API platforms, and agent-era applications that need external user access, customer administrators, tenant boundaries, and auditable authorization decisions.

Which authentication and federation patterns does TrueCaaS support?

TrueCaaS is designed for hosted login, OIDC, OAuth2, SAML, LDAP, Active Directory, passkeys, TOTP MFA, email MFA, and SMS MFA depending on the deployment and plan.

How does TrueCaaS handle authorization?

TrueCaaS models tenants, environments, applications, users, roles, privileges, policy context, and entitlement checks so product teams can enforce access at app, API, service, and AI-agent boundaries.

What deployment models does TrueCaaS support?

TrueCaaS supports three deployment paths: hosted SaaS, managed private deployment, and licensed or offline-capable deployment for regulated or infrastructure-controlled environments.

What audit and decision visibility does TrueCaaS provide?

TrueCaaS is designed to emit audit trails, webhook events, entitlement outcomes, and IRP-backed decision records so engineering, security, support, and customers can understand why access was allowed or denied.

API reference

The public shape of the TrueCaaS V1 externalized API.

Review the tenant-routed API surface that TrueCaaS exposes to customer applications. This is a shape-only public reference: tenant IDs, app IDs, client secrets, internal operations APIs, and executable examples stay inside the authenticated product.

Externalized only

Only /api/v1 paths and tenant OIDC discovery are represented here.

Authentication required

Real calls require a tenant context and bearer token from the configured TrueCaaS issuer.

No tenant wiring exposed

This page does not publish tenant IDs, application IDs, redirect URIs, or secrets.

Server template

https://{tenant-host}

Replace {tenant-host} with the hosted-auth domain or tenant API host supplied inside an active TrueCaaS tenant.

Download YAML Start with a tenant

Endpoint families

116

Externalized operations represented

API version shape

Identity and login context

Resolve the current subject, available applications, licensing context, and OIDC discovery for a tenant-routed host.

GET/.well-known/openid-configurationTenant OIDC discovery document

GET/api/v1/auth/resolve-login-contextResolve hosted-login routing context

GET/api/v1/meCurrent authenticated subject

GET/api/v1/me/applicationsApplications available to the current subject

GET/api/v1/me/licensingLicense posture visible to the current subject

Tenant administration

Manage tenant profile, security posture, licensing refreshes, and user-facing notifications inside a paid or trial tenant.

GET/api/v1/tenant/{tenantId}Read tenant profile

PATCH/api/v1/tenant/{tenantId}Update tenant profile

GET/api/v1/tenant/{tenantId}/settings/securityRead tenant security settings

PATCH/api/v1/tenant/{tenantId}/settings/securityUpdate tenant security settings

GET/api/v1/tenant/{tenantId}/licensingRead tenant licensing state

POST/api/v1/tenant/{tenantId}/licensing/refreshRefresh tenant licensing state

GET/api/v1/tenant/{tenantId}/notificationsList tenant notifications

POST/api/v1/tenant/{tenantId}/notifications/readMark tenant notifications as read

Tenant users and migration

Create, import, update, credential-reset, and inspect tenant-level users and identity migration workflows.

GET/api/v1/tenant/{tenantId}/usersList tenant users

POST/api/v1/tenant/{tenantId}/usersCreate tenant user

POST/api/v1/tenant/{tenantId}/users/importImport tenant users

POST/api/v1/tenant/{tenantId}/users/import/directoryImport tenant users from directory data

GET/api/v1/tenant/{tenantId}/users/{userId}Read tenant user

PATCH/api/v1/tenant/{tenantId}/users/{userId}Update tenant user

DELETE/api/v1/tenant/{tenantId}/users/{userId}Delete tenant user

POST/api/v1/tenant/{tenantId}/users/{userId}/reset-passwordIssue tenant user password reset

POST/api/v1/tenant/{tenantId}/users/{userId}/reset-mfaReset tenant user MFA state

GET/api/v1/tenant/{tenantId}/users/{userId}/access-visualizerInspect tenant user access context

GET/api/v1/tenant/{tenantId}/migrations/identity/adaptersList identity migration adapters

POST/api/v1/tenant/{tenantId}/migrations/identity/dry-runPreview identity migration impact

POST/api/v1/tenant/{tenantId}/migrations/identity/applyApply identity migration batch

Environments and applications

Model environments, applications, public registration settings, and app readiness for tenant-owned products.

GET/api/v1/tenant/{tenantId}/environmentsList environments

POST/api/v1/tenant/{tenantId}/environmentsCreate environment

GET/api/v1/tenant/{tenantId}/environments/{env}Read environment

PATCH/api/v1/tenant/{tenantId}/environments/{env}Update environment

DELETE/api/v1/tenant/{tenantId}/environments/{env}Delete environment

GET/api/v1/tenant/{tenantId}/environments/{env}/applicationsList applications

POST/api/v1/tenant/{tenantId}/environments/{env}/applicationsCreate application

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Read application

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Update application

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}Delete application

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/securityRead application security settings

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/securityUpdate application security settings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/public-registrationRead public registration settings

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/settings/public-registrationUpdate public registration settings

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/readinessRead application readiness

App users and RBAC

Manage application users, roles, privileges, assignments, and effective access inside a specific tenant environment.

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/usersList application users

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/usersCreate application user

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Read application user

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Update application user

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}Delete application user

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/reset-passwordIssue application user password reset

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/rolesList application roles

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/rolesCreate application role

PATCH/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}Update application role

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}Delete application role

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/privilegesList application privileges

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/privilegesCreate application privilege

PUT/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}/users/{appUserId}Assign user to role

DELETE/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/roles/{roleId}/users/{appUserId}Remove user from role

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/users/{appUserId}/privilegesRead effective user privileges

Entitlements and governed actions

Evaluate authorization decisions and coordinate governed action request, approval, consumption, and evidence flows.

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/entitlements/checkEvaluate entitlement decision

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/actionsList governed actions

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/actionsCreate governed action

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requestsList governed action requests

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requestsCreate governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/approveApprove governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/rejectReject governed action request

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/consumeConsume governed action approval

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/governed-actions/requests/{requestId}/evidenceAttach governed action evidence

Audit, reporting, and SIEM

Query authentication events, security audit streams, SIEM exports, IRP records, and generated report artifacts.

GET/api/v1/tenant/{tenantId}/eventsList tenant events

GET/api/v1/tenant/{tenantId}/audit/eventsList tenant audit events

GET/api/v1/tenant/{tenantId}/audit/siem/eventsExport SIEM-compatible audit events

GET/api/v1/tenant/{tenantId}/irp/recordsList IRP-backed decision records

GET/api/v1/tenant/{tenantId}/reports/jobsList report jobs

POST/api/v1/tenant/{tenantId}/reports/jobsCreate report job

GET/api/v1/tenant/{tenantId}/reports/jobs/{jobId}Read report job status

GET/api/v1/tenant/{tenantId}/reports/jobs/{jobId}/artifactDownload report artifact

Webhooks and outbound integrations

GET/api/v1/tenant/{tenantId}/webhooks/event-typesList webhook event types

GET/api/v1/tenant/{tenantId}/webhooks/subscriptionsList webhook subscriptions

POST/api/v1/tenant/{tenantId}/webhooks/subscriptionsCreate webhook subscription

GET/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Read webhook subscription

PATCH/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Update webhook subscription

DELETE/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}Delete webhook subscription

GET/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/secretRead webhook secret metadata

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/secretCreate webhook secret

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/rotateRotate webhook secret

POST/api/v1/tenant/{tenantId}/webhooks/subscriptions/{subId}/testSend webhook test delivery

GET/api/v1/tenant/{tenantId}/webhooks/deliveriesList webhook deliveries

Federation and MFA

Configure OIDC clients, SAML connections, LDAP connectors, and end-user MFA enrollment flows.

GET/api/v1/oauth2/clientsList OIDC clients

POST/api/v1/oauth2/clientsCreate OIDC client

PATCH/api/v1/oauth2/clients/{clientId}Update OIDC client

DELETE/api/v1/oauth2/clients/{clientId}Delete OIDC client

GET/api/v1/saml/connectionsList SAML connections

POST/api/v1/saml/connectionsCreate SAML connection

PATCH/api/v1/saml/connections/{connectionId}Update SAML connection

DELETE/api/v1/saml/connections/{connectionId}Delete SAML connection

GET/api/v1/tenant/{tenantId}/settings/ldapRead LDAP settings

PATCH/api/v1/tenant/{tenantId}/settings/ldapUpdate LDAP settings

GET/api/v1/tenant/{tenantId}/settings/ldap/connectorsList LDAP connectors

POST/api/v1/tenant/{tenantId}/settings/ldap/connectorsCreate LDAP connector

POST/api/v1/mfa/totp/enrollEnroll TOTP MFA

POST/api/v1/mfa/totp/enableEnable TOTP MFA

POST/api/v1/mfa/sms/enrollEnroll SMS MFA

POST/api/v1/mfa/passkeys/register/optionsCreate passkey registration options

POST/api/v1/mfa/passkeys/register/verifyVerify passkey registration

Managed tenants and messaging

Support account-managed tenants, bootstrap handoff, and tenant-scoped email/SMS messaging operations.

GET/api/v1/tenant/{tenantId}/managed-tenantsList managed tenants

POST/api/v1/tenant/{tenantId}/managed-tenantsCreate managed tenant

GET/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Read managed tenant

PATCH/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Update managed tenant

DELETE/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}Delete managed tenant

POST/api/v1/tenant/{tenantId}/managed-tenants/{managedTenantId}/bootstrapBootstrap managed tenant handoff

POST/api/v1/tenant/{tenantId}/messaging/email/sendSend tenant email

GET/api/v1/tenant/{tenantId}/messaging/email/logsList tenant email logs

GET/api/v1/tenant/{tenantId}/messaging/sms/logsList tenant SMS logs

GET/api/v1/tenant/{tenantId}/messaging/sms/ledgerRead tenant SMS ledger

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/sendSend app-scoped email

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/email/logsList app-scoped email logs

GET/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/messaging/sms/logsList app-scoped SMS logs

MCP integration surface

Invoke tenant-aware MCP paths where the tenant has enabled agent/tool integration patterns.

POST/api/v1/mcpInvoke root MCP endpoint

POST/api/v1/tenant/{tenantId}/environments/{env}/applications/{appId}/mcpInvoke app-scoped MCP endpoint