Authentication API schema

service.auth.graphqls

To authenticate API requests, you’ll need an API token. Learn how to generate an access token.

See usage examples in the cloudbeaver-graphql-examples repository.

You can try queries in the built-in GraphQL console, available on your server at https://your-server-address/api/gql/console. This tool lets you test requests directly from your browser.

For a live example, see the demo GraphQL console.

API Endpoints
https://your-server-address/api/gql

Queries

activeUser

Description

Active user information. null is no user was authorized within session

Response

Returns a UserInfo

Example

Query
query activeUser {
  activeUser {
    userId
    displayName
    authRole
    authTokens {
      ...UserAuthTokenFragment
    }
    linkedAuthProviders
    metaParameters
    configurationParameters
    teams {
      ...UserTeamInfoFragment
    }
    isAnonymous
  }
}
Response
{
  "data": {
    "activeUser": {
      "userId": "<id>",
      "displayName": "<string>",
      "authRole": "<id>",
      "authTokens": [UserAuthToken],
      "linkedAuthProviders": ["<string>"],
      "metaParameters": "<object>",
      "configurationParameters": "<object>",
      "teams": [UserTeamInfo],
      "isAnonymous": "<boolean>"
    }
  }
}
Queries

authChangeLocalPassword

Description

Changes the local password of the current user

Response

Returns a Boolean!

Arguments
Name Description
oldPassword - String!
newPassword - String!

Example

Query
query authChangeLocalPassword(
  $oldPassword: String!,
  $newPassword: String!
) {
  authChangeLocalPassword(
    oldPassword: $oldPassword,
    newPassword: $newPassword
  )
}
Variables
{"oldPassword": "<string>", "newPassword": "<string>"}
Response
{
  "data": {
    "authChangeLocalPassword": "<boolean>"
  }
}
Queries

authLogin

Description

Authorizes the user using specified auth provider. Associates new credentials with the active user when linkUser=true. Kills another user sessions if forceSessionsLogout=true.

Response

Returns an AuthInfo!

Arguments
Name Description
provider - ID!
configuration - ID
credentials - Object
linkUser - Boolean
forceSessionsLogout - Boolean

Example

Query
query authLogin(
  $provider: ID!,
  $configuration: ID,
  $credentials: Object,
  $linkUser: Boolean,
  $forceSessionsLogout: Boolean
) {
  authLogin(
    provider: $provider,
    configuration: $configuration,
    credentials: $credentials,
    linkUser: $linkUser,
    forceSessionsLogout: $forceSessionsLogout
  ) {
    redirectLink
    authId
    authStatus
    userTokens {
      ...UserAuthTokenFragment
    }
  }
}
Variables
{
  "provider": "<id>",
  "configuration": "<id>",
  "credentials": "<object>",
  "linkUser": "<boolean>",
  "forceSessionsLogout": "<boolean>"
}
Response
{
  "data": {
    "authLogin": {
      "redirectLink": "<string>",
      "authId": "<string>",
      "authStatus": "SUCCESS",
      "userTokens": [UserAuthToken]
    }
  }
}
Queries

authLogout

use authLogoutExtended instead
Description

Same as authLogoutExtended but without additional information

Response

Returns a Boolean

Arguments
Name Description
provider - ID
configuration - ID

Example

Query
query authLogout(
  $provider: ID,
  $configuration: ID
) {
  authLogout(
    provider: $provider,
    configuration: $configuration
  )
}
Variables
{"provider": "<id>", "configuration": "<id>"}
Response
{"data": {"authLogout": "<boolean>"}}
Queries

authLogoutExtended

Description

Logouts user. If provider not specified then all authorizations are revoked from session. Contains additional information

Response

Returns a LogoutInfo!

Arguments
Name Description
provider - ID
configuration - ID

Example

Query
query authLogoutExtended(
  $provider: ID,
  $configuration: ID
) {
  authLogoutExtended(
    provider: $provider,
    configuration: $configuration
  ) {
    redirectLinks
  }
}
Variables
{"provider": "<id>", "configuration": "<id>"}
Response
{"data": {"authLogoutExtended": {"redirectLinks": ["<string>"]}}}
Queries

authProviders

Description

Returns list of all available auth providers

Response

Returns [AuthProviderInfo!]!

Example

Query
query authProviders {
  authProviders {
    id
    label
    icon
    description
    defaultProvider
    trusted
    private
    authHidden
    supportProvisioning
    configurable
    federated
    configurations {
      ...AuthProviderConfigurationFragment
    }
    templateConfiguration {
      ...AuthProviderConfigurationFragment
    }
    credentialProfiles {
      ...AuthProviderCredentialsProfileFragment
    }
    requiredFeatures
    required
  }
}
Response
{
  "data": {
    "authProviders": [
      {
        "id": "<id>",
        "label": "<string>",
        "icon": "<id>",
        "description": "<string>",
        "defaultProvider": "<boolean>",
        "trusted": "<boolean>",
        "private": "<boolean>",
        "authHidden": "<boolean>",
        "supportProvisioning": "<boolean>",
        "configurable": "<boolean>",
        "federated": "<boolean>",
        "configurations": [AuthProviderConfiguration],
        "templateConfiguration": AuthProviderConfiguration,
        "credentialProfiles": [
          AuthProviderCredentialsProfile
        ],
        "requiredFeatures": ["<string>"],
        "required": "<boolean>"
      }
    ]
  }
}
Queries

authUpdateStatus

No longer supported
Response

Returns an AuthInfo!

Arguments
Name Description
authId - ID!
linkUser - Boolean

Example

Query
query authUpdateStatus(
  $authId: ID!,
  $linkUser: Boolean
) {
  authUpdateStatus(
    authId: $authId,
    linkUser: $linkUser
  ) {
    redirectLink
    authId
    authStatus
    userTokens {
      ...UserAuthTokenFragment
    }
  }
}
Variables
{"authId": "<id>", "linkUser": "<boolean>"}
Response
{
  "data": {
    "authUpdateStatus": {
      "redirectLink": "<string>",
      "authId": "<string>",
      "authStatus": "SUCCESS",
      "userTokens": [UserAuthToken]
    }
  }
}
Queries

federatedAuthTaskResult

Description

Returns result of federated authentication task

Response

Returns a FederatedAuthResult!

Arguments
Name Description
taskId - String!

Example

Query
query federatedAuthTaskResult($taskId: String!) {
  federatedAuthTaskResult(taskId: $taskId) {
    userTokens {
      ...UserAuthTokenFragment
    }
  }
}
Variables
{"taskId": "<string>"}
Response
{
  "data": {
    "federatedAuthTaskResult": {
      "userTokens": [UserAuthToken]
    }
  }
}
Queries

listUserProfileProperties

Description

Returns properties that can be shown in user profile

Response

Returns [ObjectPropertyInfo!]!

Example

Query
query listUserProfileProperties {
  listUserProfileProperties {
    id
    displayName
    description
    hint
    category
    dataType
    value
    validValues
    defaultValue
    length
    features
    order
    supportedConfigurationTypes
    required
    scopes
    conditions {
      ...ConditionFragment
    }
  }
}
Response
{
  "data": {
    "listUserProfileProperties": [
      {
        "id": "<string>",
        "displayName": "<string>",
        "description": "<string>",
        "hint": "<string>",
        "category": "<string>",
        "dataType": "<string>",
        "value": "<object>",
        "validValues": ["<object>"],
        "defaultValue": "<object>",
        "length": "TINY",
        "features": ["<string>"],
        "order": "<int>",
        "supportedConfigurationTypes": ["<string>"],
        "required": "<boolean>",
        "scopes": ["<string>"],
        "conditions": [Condition]
      }
    ]
  }
}

Mutations

federatedLogin

Description

Creates async task for federated login. Returns redirect link to the task info page.

Response

Returns a FederatedAuthInfo!

Arguments
Name Description
provider - ID!
configuration - ID
linkUser - Boolean
forceSessionsLogout - Boolean

Example

Query
mutation federatedLogin(
  $provider: ID!,
  $configuration: ID,
  $linkUser: Boolean,
  $forceSessionsLogout: Boolean
) {
  federatedLogin(
    provider: $provider,
    configuration: $configuration,
    linkUser: $linkUser,
    forceSessionsLogout: $forceSessionsLogout
  ) {
    redirectLink
    taskInfo {
      ...AsyncTaskInfoFragment
    }
  }
}
Variables
{
  "provider": "<id>",
  "configuration": "<id>",
  "linkUser": "<boolean>",
  "forceSessionsLogout": "<boolean>"
}
Response
{
  "data": {
    "federatedLogin": {
      "redirectLink": "<string>",
      "taskInfo": AsyncTaskInfo
    }
  }
}
Mutations

setUserConfigurationParameter

Description

Set user config parameter. If parameter value is null then removes the parameter

Response

Returns a Boolean!

Arguments
Name Description
name - String!
value - Object

Example

Query
mutation setUserConfigurationParameter(
  $name: String!,
  $value: Object
) {
  setUserConfigurationParameter(
    name: $name,
    value: $value
  )
}
Variables
{"name": "<string>", "value": "<object>"}
Response
{
  "data": {
    "setUserConfigurationParameter": "<boolean>"
  }
}
Mutations

setUserPreferences

Description

Updates user preferences

Response

Returns a UserInfo!

Arguments
Name Description
preferences - Object!

Example

Query
mutation setUserPreferences($preferences: Object!) {
  setUserPreferences(preferences: $preferences) {
    userId
    displayName
    authRole
    authTokens {
      ...UserAuthTokenFragment
    }
    linkedAuthProviders
    metaParameters
    configurationParameters
    teams {
      ...UserTeamInfoFragment
    }
    isAnonymous
  }
}
Variables
{"preferences": "<object>"}
Response
{
  "data": {
    "setUserPreferences": {
      "userId": "<id>",
      "displayName": "<string>",
      "authRole": "<id>",
      "authTokens": [UserAuthToken],
      "linkedAuthProviders": ["<string>"],
      "metaParameters": "<object>",
      "configurationParameters": "<object>",
      "teams": [UserTeamInfo],
      "isAnonymous": "<boolean>"
    }
  }
}

Types

AsyncTaskInfo

Description

Async types

Fields
Field Name Description
id - String! Task unique identifier
name - String Async task name
running - Boolean! Indicates if the task is currently running
status - String Current status of the async task
error - ServerError Error information if the task failed
taskResult - Object Task result. Can be some kind of identifier to obtain real result using another API function
Example
{
  "id": "<string>",
  "name": "<string>",
  "running": "<boolean>",
  "status": "<string>",
  "error": ServerError,
  "taskResult": "<object>"
}
Types

AuthCredentialEncryption

Values
Enum Value Description

none

plain

hash
Example
"none"
Types

AuthCredentialInfo

Fields
Field Name Description
id - ID!
displayName - String!
description - String
admin - Boolean! This field must be shown in admin panel
user - Boolean! This field must be shown in login form
identifying - Boolean! This field can be used as user identifier
possibleValues - [String]
encryption - AuthCredentialEncryption
Example
{
  "id": "<id>",
  "displayName": "<string>",
  "description": "<string>",
  "admin": "<boolean>",
  "user": "<boolean>",
  "identifying": "<boolean>",
  "possibleValues": ["<string>"],
  "encryption": "none"
}
Types

AuthInfo

Fields
Field Name Description
redirectLink - String No longer supported
authId - String No longer supported
authStatus - AuthStatus! No longer supported
userTokens - [UserAuthToken!]
Example
{
  "redirectLink": "<string>",
  "authId": "<string>",
  "authStatus": "SUCCESS",
  "userTokens": [UserAuthToken]
}
Types

AuthProviderConfiguration

Fields
Field Name Description
id - ID!
displayName - String!
disabled - Boolean!
authRoleProvided - Boolean
iconURL - String
description - String
signInLink - String URL to external authentication service. If specified then it is external authentication provider (SSO). Otherwise authLogin function must be called.
signOutLink - String
redirectLink - String
metadataLink - String
acsLink - String
entityIdLink - String
Example
{
  "id": "<id>",
  "displayName": "<string>",
  "disabled": "<boolean>",
  "authRoleProvided": "<boolean>",
  "iconURL": "<string>",
  "description": "<string>",
  "signInLink": "<string>",
  "signOutLink": "<string>",
  "redirectLink": "<string>",
  "metadataLink": "<string>",
  "acsLink": "<string>",
  "entityIdLink": "<string>"
}
Types

AuthProviderCredentialsProfile

Fields
Field Name Description
id - String
label - String
description - String
credentialParameters - [AuthCredentialInfo!]!
Example
{
  "id": "<string>",
  "label": "<string>",
  "description": "<string>",
  "credentialParameters": [AuthCredentialInfo]
}
Types

AuthProviderInfo

Fields
Field Name Description
id - ID!
label - String!
icon - ID
description - String
defaultProvider - Boolean!
trusted - Boolean!
private - Boolean!
authHidden - Boolean!
supportProvisioning - Boolean!
configurable - Boolean! Configurable providers must be configured first. See configurations field.
federated - Boolean! Federated providers means authorization must occur asynchronously through redirects.
configurations - [AuthProviderConfiguration!] Provider configurations (applicable only if configurable=true)
templateConfiguration - AuthProviderConfiguration!
credentialProfiles - [AuthProviderCredentialsProfile!]!
requiredFeatures - [String!]!
required - Boolean!
Example
{
  "id": "<id>",
  "label": "<string>",
  "icon": "<id>",
  "description": "<string>",
  "defaultProvider": "<boolean>",
  "trusted": "<boolean>",
  "private": "<boolean>",
  "authHidden": "<boolean>",
  "supportProvisioning": "<boolean>",
  "configurable": "<boolean>",
  "federated": "<boolean>",
  "configurations": [AuthProviderConfiguration],
  "templateConfiguration": AuthProviderConfiguration,
  "credentialProfiles": [AuthProviderCredentialsProfile],
  "requiredFeatures": ["<string>"],
  "required": "<boolean>"
}
Types

AuthStatus

Values
Enum Value Description

SUCCESS

IN_PROGRESS

ERROR
Example
"SUCCESS"
Types

Boolean

Description

The Boolean scalar type represents true or false.

Example
"<boolean>"
Types

Condition

Description

Represents a dynamic condition for a property, such as visibility or read-only state

Fields
Field Name Description
expression - String! The logical expression that defines when the condition applies
conditionType - ConditionType! The type of condition (e.g., HIDE or READ_ONLY)
Example
{"expression": "<string>", "conditionType": "HIDE"}
Types

ConditionType

Values
Enum Value Description

HIDE

 hiding property condition

READ_ONLY

 restriction for setting a property value
Example
"HIDE"
Types

DateTime

Description

Date/Time

Example
"<datetime>"
Types

FederatedAuthInfo

Fields
Field Name Description
redirectLink - String!
taskInfo - AsyncTaskInfo!
Example
{"redirectLink": "<string>", "taskInfo": AsyncTaskInfo}
Types

FederatedAuthResult

Fields
Field Name Description
userTokens - [UserAuthToken!]!
Example
{"userTokens": [UserAuthToken]}
Types

ID

Description

The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.

Example
"<id>"
Types

Int

Description

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

Example
"<int>"
Types

LogoutInfo

Fields
Field Name Description
redirectLinks - [String!]!
Example
{"redirectLinks": ["<string>"]}
Types

Object

Description

Any object (JSON)

Example
"<object>"
Types

ObjectOrigin

Fields
Field Name Description
type - ID!
subType - ID
displayName - String!
icon - String
configuration - Object
details - [ObjectPropertyInfo!]
Example
{
  "type": "<id>",
  "subType": "<id>",
  "displayName": "<string>",
  "icon": "<string>",
  "configuration": "<object>",
  "details": [ObjectPropertyInfo]
}
Types

ObjectPropertyInfo

Description

Information about the object property used to generate its UI

Fields
Field Name Description
id - String Unique property identifier
displayName - String Human-readable name
description - String Property description
hint - String Usage hint for the property
category - String Property category (may be used if object has a lot of properties)
dataType - String Property data type (e.g., int, String)
value - Object Property value (can be resource-intensive for some properties, e.g., RowCount for tables)
validValues - [Object] List of allowed values (for enumerable properties)
defaultValue - Object Default property value
length - ObjectPropertyLength! Property value length
features - [String!]! List of supported features (e.g., system, hidden, inherited, foreign, expensive)
order - Int! Order position
supportedConfigurationTypes - [String!] Supported configuration types (for driver properties)
required - Boolean! Is the property required
scopes - [String!] List of preference scopes (e.g., global, user)
conditions - [Condition!] Dynamic conditions for the property (e.g., visibility or read-only)
Example
{
  "id": "<string>",
  "displayName": "<string>",
  "description": "<string>",
  "hint": "<string>",
  "category": "<string>",
  "dataType": "<string>",
  "value": "<object>",
  "validValues": ["<object>"],
  "defaultValue": "<object>",
  "length": "TINY",
  "features": ["<string>"],
  "order": "<int>",
  "supportedConfigurationTypes": ["<string>"],
  "required": "<boolean>",
  "scopes": ["<string>"],
  "conditions": [Condition]
}
Types

ObjectPropertyLength

Values
Enum Value Description

TINY

 1 character

SHORT

 20 characters

MEDIUM

 <= 64 characters

LONG

 Full line length. The default

MULTILINE

 Multi-line long text
Example
"TINY"
Types

ServerError

Description

Various server errors descriptor

Fields
Field Name Description
message - String Error message text
errorCode - String Retrieves the vendor-specific error code
errorType - String Type/category of the error
stackTrace - String Stack trace for debugging
causedBy - ServerError Nested error that caused this error (recursive)
Example
{
  "message": "<string>",
  "errorCode": "<string>",
  "errorType": "<string>",
  "stackTrace": "<string>",
  "causedBy": ServerError
}
Types

String

Description

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

Example
"<string>"
Types

UserAuthToken

Fields
Field Name Description
authProvider - ID! Auth provider used for authorization
authConfiguration - ID Auth provider configuration ID
loginTime - DateTime! Authorization time
userId - String! User identity (aka user name) specific to auth provider
displayName - String! User display name specific to auth provider
message - String Optional login message
origin - ObjectOrigin! Auth origin
Example
{
  "authProvider": "<id>",
  "authConfiguration": "<id>",
  "loginTime": "<datetime>",
  "userId": "<string>",
  "displayName": "<string>",
  "message": "<string>",
  "origin": ObjectOrigin
}
Types

UserInfo

Fields
Field Name Description
userId - ID! User unique identifier
displayName - String Human readable display name. It is taken from the first auth provider which was used for user login.
authRole - ID User auth role ID. Optional.
authTokens - [UserAuthToken!]! All authentication tokens used during current session
linkedAuthProviders - [String!]!
metaParameters - Object! User profile properties map
configurationParameters - Object! User configuration parameters
teams - [UserTeamInfo!]! User teams
isAnonymous - Boolean! Indicates whether the user is anonymous (not authenticated).
Example
{
  "userId": "<id>",
  "displayName": "<string>",
  "authRole": "<id>",
  "authTokens": [UserAuthToken],
  "linkedAuthProviders": ["<string>"],
  "metaParameters": "<object>",
  "configurationParameters": "<object>",
  "teams": [UserTeamInfo],
  "isAnonymous": "<boolean>"
}
Types

UserTeamInfo

Fields
Field Name Description
teamId - String!
teamName - String!
teamRole - String
Example
{"teamId": "<string>", "teamName": "<string>", "teamRole": "<string>"}
Documentation by Anvil SpectaQL