Skip to content
Authrim

Get tenant-scoped settings for a category.

GET
/api/admin/tenants/{tenantId}/settings/{category}
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/tenants/example/settings/example \
  --header 'Authorization: Bearer <token>'

Get Setting settings in the Tenants area. Use this operation to retrieve setting data without mutating tenant state. The account-lifecycle category exposes account-lifecycle.guest.deletion_enabled (boolean, default false), account-lifecycle.guest.deletion_after_days (integer 1-3650, default 30), account-lifecycle.guest.upgrade_enabled (boolean, default true), and account-lifecycle.guest.upgrade_hold_minutes (integer 1-60, default 10). Authentication-methods settings include authentication-methods.guest.login_enabled (default false), authentication-methods.passkey.guest_upgrade_enabled and authentication-methods.email_otp.guest_upgrade_enabled (both default true). authentication-methods.did.login_enabled (default false) lets accounts with a linked DID sign in with it; linking, listing and unlinking DIDs do not depend on it. authentication-methods.invitation.email_verification (optional or required, default optional) decides, for an invitation that names an email, whether a sign-up must prove it: a passkey or authenticator-app sign-up by a code sent to that email first, an external IdP sign-up by the provider reporting the email verified (an email-code sign-up always proves it). The rate-limit category includes rate_limit.totp_max_requests (integer 1-100, default 10) and rate_limit.totp_window (seconds 60-3600, default 900): how many authenticator-app sign-in and re-authentication starts are allowed per identifier and IP address, and how many sign-up code checks per sign-up and IP address, per window. The rate limit profile override (loadTest) does not raise them; a conformance run raises them for its tenant here and restores them afterwards.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
tenantId
required
string
category
required
string

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Settings v2 read response.

Media type application/json

Settings v2 category read result returned by the settings manager. A value comes from the requested scope, else from the scopes it inherits from (a client’s tenant, then the platform, where the category allows those scopes), else from the deployment’s environment variable, else from the built-in default. sources says where each value came from, and inherited gives what each setting would be if the requested scope set nothing.

object
category
string
scope
object
key
additional properties
version

Version of the requested scope’s document, for optimistic concurrency.

string
values

Effective value of each setting at the requested scope.

object
key
additional properties
sources

Where each value came from. kv means it is set at the requested scope; tenant and platform mean it is inherited from that scope.

object
key
additional properties
string
Allowed values: kv tenant platform env default
inherited

What each setting would be if the requested scope set nothing.

object
values
required
object
key
additional properties
sources
required
object
key
additional properties
string
Allowed values: tenant platform env default
key
additional properties
Example 
{
  "category": "oauth",
  "scope": {
    "type": "client",
    "id": "client_123",
    "tenantId": "tenant_123"
  },
  "values": {
    "oauth.access_token_expiry": 300,
    "oauth.id_token_expiry": 900
  },
  "sources": {
    "oauth.access_token_expiry": "kv",
    "oauth.id_token_expiry": "tenant"
  },
  "inherited": {
    "values": {
      "oauth.access_token_expiry": 900,
      "oauth.id_token_expiry": 900
    },
    "sources": {
      "oauth.access_token_expiry": "tenant",
      "oauth.id_token_expiry": "tenant"
    }
  },
  "version": "v1"
}

Headers

Section titled “Headers ”
X-Authrim-Log-Consistency
string
Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries
integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete
boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}