> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Export Scope
> This API call returns the managed Scope through a Scope ID.
## OpenAPI
````json GET /api/1.0/scopes/{envId}/{scopeId}
{
"openapi": "3.0.3",
"info": {
"title": "Management APIs",
"version": "1.0.0",
"contact": {
"name": "PlainID",
"url": "https://plainid.com",
"email": "contact@plainid.com"
},
"license": {
"name": "Commercial",
"url": "https://plainid.com/license"
},
"termsOfService": "https://www.plainid.com/terms/",
"description": "
The PlainID Authorization Platform provides Management capabilities through the APIs below.
To access the Management APIs, make sure to enter your dedicated domain according to your PlainID Tenant Location:
Region
Base URL
United States (US)
https://api.us1.plainid.io
Canada (CA)
https://api.ca1.plainid.io
Europe (EU)
https://api.eu1.plainid.io
Local PAA
https://api.plainid.local
"
},
"servers": [
{
"description": "United States",
"url": "https://api.us1.plainid.io"
},
{
"description": "Europe",
"url": "https://api.eu1.plainid.io"
},
{
"description": "Canada",
"url": "https://api.ca1.plainid.io"
},
{
"description": "Local PAA",
"url": "https://api.plainid.local"
}
],
"tags": [
{
"name": "access-file-authorizer-oas",
"description": "access-file-authorizer-oas"
},
{
"name": "authz-packager-oas",
"description": "authz-packager-oas"
},
{
"name": "SQL Database Authorizer",
"description": "API for modifying SQL queries based on authorization policies"
},
{
"name": "delegated-admin-oas",
"description": "delegated-admin-oas"
},
{
"name": "Discovery",
"description": "Discovery APIs"
},
{
"name": "Enrichment",
"description": "Enrichment APIs"
},
{
"name": "env-mgmt-oas",
"description": "env-mgmt-oas"
},
{
"name": "hybrid-commander-oas",
"description": "hybrid-commander-oas"
},
{
"name": "auth-keys",
"description": "Auth key operations"
},
{
"name": "components",
"description": "Component operations"
},
{
"name": "paas",
"description": "PAA operations"
},
{
"name": "paa-groups",
"description": "PAA group operations"
},
{
"name": "packages",
"description": "Package configuration operations"
},
{
"name": "secret-stores",
"description": "Secret store operations"
},
{
"name": "Table Mapping",
"description": "Table Mapping"
},
{
"name": "Column Mapping",
"description": "Column Mapping"
},
{
"name": "Api Mapping",
"description": "Api Mapping"
},
{
"name": "notifier-oas",
"description": "notifier-oas"
},
{
"name": "shadow-tracker",
"description": "Shadow tracker SSE stream"
},
{
"name": "orchestrator-oas",
"description": "orchestrator-oas"
},
{
"name": "POP",
"description": "pop operations"
},
{
"name": "org-mgmt-oas",
"description": "org-mgmt-oas"
},
{
"name": "pip-mgmt-oas",
"description": "pip-mgmt-oas"
},
{
"name": "monitor-loggers",
"description": "monitor-loggers"
},
{
"name": "Policy Management APIs",
"description": "Policy Management APIs"
},
{
"name": "Policy Management APIs 1.0",
"description": "Policy Management APIs 1.0"
},
{
"name": "Policy Management APIs 2.0",
"description": "Policy Management APIs 2.0"
},
{
"name": "Policy Building Blocks Management APIs 2.0",
"description": "Policy Building Blocks Management APIs 2.0"
},
{
"name": "Audit",
"description": "Audit"
},
{
"name": "Asset Template",
"description": "Asset Template"
},
{
"name": "Application",
"description": "Application"
},
{
"name": "Api Mapper",
"description": "Api Mapper"
},
{
"name": "Identity Template",
"description": "Identity Template"
},
{
"name": "Identity Sources",
"description": "Identity Sources"
},
{
"name": "Mapper Sets",
"description": "Mapper Sets"
},
{
"name": "Identity Template V2",
"description": "Identity Template V2"
},
{
"name": "PAA Sources",
"description": "PAA Sources"
},
{
"name": "PAA Views",
"description": "PAA Views"
},
{
"name": "PAA Groups",
"description": "PAA Groups"
},
{
"name": "Scope",
"description": "Managed Scope APIs"
},
{
"name": "Authentication for Management APIs",
"description": "Authentication for Management APIs"
},
{
"name": "runtime",
"description": "runtime"
},
{
"name": "Cache Management",
"description": "Cache invalidation operations for Runtime service"
}
],
"externalDocs": {
"url": "https://docs.plainid.io/apidocs/policy-management-apis"
},
"paths": {
"/api/1.0/scopes/{envId}/{scopeId}": {
"get": {
"tags": [
"Scope"
],
"summary": "Export Scope",
"description": "This API call returns the managed Scope through a Scope ID.",
"operationId": "getScope",
"parameters": [
{
"name": "envId",
"in": "path",
"required": "true",
"description": "The Environment ID can be found under the Details Tab in the Environment Settings.",
"schema": {
"type": "string",
"format": "uuid"
},
"example": "550e8400-e29b-41d4-a716-446655440000"
},
{
"name": "scopeId",
"in": "path",
"required": "true",
"description": "The Scope ID can be found in the Scope Details in the Platform Environment Settings.",
"schema": {
"type": "string",
"pattern": "^[a-zA-Z0-9_:.-]+$",
"maxLength": "128"
},
"example": "customer-api"
}
],
"responses": {
"200": {
"description": "Scope",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ManagedScopeResponse"
}
}
}
},
"400": {
"description": "Invalid request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
}
}
}
},
"403": {
"description": "Missing permission for the environment.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
}
}
}
},
"404": {
"description": "Scope not found.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
}
}
}
},
"500": {
"description": "Internal Server Error"
}
}
}
}
},
"components": {
"schemas": {
"ManagedScopeResponse": {
"type": "object",
"description": "Managed scope response envelope.",
"properties": {
"data": {
"$ref": "#/components/schemas/ManagedScope"
}
}
},
"ErrorResponse": {
"type": "object",
"properties": {
"code": {
"type": "string"
},
"message": {
"type": "string"
},
"details": {
"type": "string"
}
}
},
"ManagedScope": {
"allOf": [
{
"$ref": "#/components/schemas/ManagedScopeImportRequest"
},
{
"type": "object",
"description": "Managed scope response",
"properties": {
"secretKeys": {
"type": "array",
"description": "Secret keys declared for this scope. The value field is omitted in get/list/import responses.",
"items": {
"$ref": "#/components/schemas/ManagedSecretKeyResponse"
}
}
}
}
]
},
"ManagedScopeImportRequest": {
"type": "object",
"description": "Managed scope import/update request. Secret key values are not accepted; use the regenerate operation to receive a plaintext value.",
"additionalProperties": "false",
"required": [
"scopeId"
],
"properties": {
"scopeId": {
"type": "string",
"description": "Scope identifier (name). This can either be found in the Scope Settings in the Platform.",
"pattern": "^[a-zA-Z0-9_:.-]+$",
"maxLength": "128",
"example": "customer-api"
},
"description": {
"type": "string",
"nullable": "true",
"description": "Optional scope description.",
"example": "Scope used by the customer API"
},
"clientId": {
"type": "string",
"nullable": "true",
"description": "OAuth client identifier used by this scope.",
"example": "A1B2C3D4E5F6G7H8I9J0K"
},
"responseCache": {
"type": "integer",
"nullable": "true",
"description": "Response cache duration in seconds.",
"example": "0"
},
"authMethodType": {
"type": "string",
"nullable": "true",
"description": "Authentication method used by this scope.",
"enum": [
"CLIENT_SECRET_REQUEST",
"CLIENT_SECRET_HEADER",
"AUTHORIZATION_JWT"
],
"example": "CLIENT_SECRET_HEADER"
},
"identityMatchingType": {
"type": "string",
"nullable": "true",
"description": "Identity matching mode used by this scope. The Identity Matching Type which determines the Identity Template and Entity ID to be used for Authorization Decisions.",
"enum": [
"REQUEST",
"MATCHERS"
],
"example": "REQUEST"
},
"claimAttributeName": {
"type": "string",
"nullable": "true",
"description": "Claim attribute name used for identity matching.",
"example": "sub"
},
"responseTemplate": {
"type": "string",
"nullable": "true",
"description": "Response template returned by the scope.",
"example": "{\"decision\":\"{{decision}}\"}"
},
"itemsSeparator": {
"type": "string",
"nullable": "true",
"description": "Separator used for multi-value response items.",
"example": ","
},
"isIdpJwtContentIncluded": {
"type": "boolean",
"nullable": "true",
"description": "Sets whether IDP JWT content is included in the response.",
"example": "false"
},
"isMultipleIdentitiesCombination": {
"type": "boolean",
"nullable": "true",
"default": "false",
"description": "Enables combining multiple Identities of different Entity Types in a single authorization request for this Scope.",
"example": "false"
},
"audience": {
"type": "string",
"nullable": "true",
"description": "JWT audience.",
"example": "customer-api"
},
"expireJwtInSec": {
"type": "integer",
"minimum": "1",
"maximum": "2147483647",
"nullable": "true",
"description": "JWT expiration in seconds.",
"example": "3600"
},
"x509Certificate": {
"type": "string",
"nullable": "true",
"description": "X.509 certificate used by the scope.",
"example": "-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----"
},
"secretStoreId": {
"type": "string",
"nullable": "true",
"description": "Secret store identifier.",
"example": "vault-prod"
},
"secretStoreKeyPath": {
"type": "string",
"nullable": "true",
"description": "Secret store key path.",
"example": "/plainid/customer-api"
},
"secretStoreKeyName": {
"type": "string",
"nullable": "true",
"description": "Secret store key name.",
"example": "client-secret"
},
"applicationIds": {
"type": "array",
"description": "Application IDs linked to this Scope. At least one is required when creating a new scope.",
"items": {
"type": "string"
},
"example": [
"customer-portal"
]
},
"identityMapperSets": {
"type": "array",
"description": "Identity Mapper Sets linked to this Scope. Select at least one. Ensure that if choosing multiple, that they do not originate from the same Template ID.",
"items": {
"$ref": "#/components/schemas/ManagedScopeIdentityMapperSetReference"
},
"example": [
{
"templateId": "customer",
"mapperSetId": "customer-api-mappers"
}
]
},
"secretKeys": {
"type": "array",
"description": "Secret keys declared for this scope. Only keyId is accepted in import/update requests. At least one is required when creating a new scope.",
"items": {
"$ref": "#/components/schemas/ManagedSecretKeyRequest"
}
},
"jwtSettings": {
"type": "array",
"description": "JWT validation settings declared for this scope.",
"items": {
"$ref": "#/components/schemas/ManagedJwtSetting"
}
}
}
},
"ManagedSecretKeyResponse": {
"type": "object",
"description": "Secret key metadata returned by managed scope get/list/import responses.",
"additionalProperties": "false",
"properties": {
"keyId": {
"type": "string",
"description": "Secret key identifier.",
"example": "Key_1"
}
}
},
"ManagedScopeIdentityMapperSetReference": {
"type": "object",
"description": "Identity mapper set reference scoped by identity template.",
"additionalProperties": "false",
"required": [
"templateId",
"mapperSetId"
],
"properties": {
"templateId": {
"type": "string",
"description": "Identity template ID that manages the Mapper Set.",
"example": "customer"
},
"mapperSetId": {
"type": "string",
"description": "Mapper Set ID.",
"example": "customer-api-mappers"
}
}
},
"ManagedSecretKeyRequest": {
"type": "object",
"description": "Secret key identifier in managed scope import/update requests.",
"additionalProperties": "false",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "Secret key identifier.",
"pattern": "^[a-zA-Z0-9_:.-]+$",
"maxLength": "128",
"example": "Key_1"
}
}
},
"ManagedJwtSetting": {
"type": "object",
"additionalProperties": "false",
"required": [
"settingId"
],
"properties": {
"settingId": {
"type": "string",
"description": "JWT setting identifier. The JWT settingID can be found in the Manage JWT Settings section in the relevant Scope when the Scope Auth Method is set to Authorization JWT. Required when the `authMethodType` is `AUTHORIZATION_JWT`.",
"pattern": "^[a-zA-Z0-9_:.-]+$",
"maxLength": "128",
"example": "customer-jwks"
},
"jwksUrl": {
"type": "string",
"nullable": "true",
"description": "JWKS URL.",
"example": "https://idp.example.com/.well-known/jwks.json"
},
"claims": {
"type": "object",
"nullable": "true",
"description": "Claims expected from the JWT.",
"example": {
"iss": "https://idp.example.com"
}
},
"keysRefreshInterval": {
"type": "integer",
"minimum": "1",
"maximum": "24",
"nullable": "true",
"description": "Keys refresh interval in hours.",
"example": "6"
}
}
}
}
}
}
````