Kinde Management API

openapi: 3.0.0
info:
  version: '1'
  title: Kinde Management API
  description: |

    Provides endpoints to manage your Kinde Businesses.

    ## Intro

    ## How to use

    1. [Set up and authorize a machine-to-machine (M2M) application](https://docs.kinde.com/developer-tools/kinde-api/connect-to-kinde-api/).

    2. [Generate a test access token](https://docs.kinde.com/developer-tools/kinde-api/access-token-for-api/)

    3. Test request any endpoint using the test token
  termsOfService: https://docs.kinde.com/trust-center/agreements/terms-of-service/
  contact:
    name: Kinde Support Team
    email: [email protected]
    url: https://docs.kinde.com
servers:
  - url: https://{subdomain}.kinde.com
    variables:
      subdomain:
        default: your_kinde_subdomain
        description: The subdomain generated for your business on Kinde.
tags:
  - name: API Keys
    x-displayName: API Keys
  - name: APIs
    x-displayName: APIs
  - name: Applications
    x-displayName: Applications
  - name: Billing Entitlements
    x-displayName: Billing Entitlements
  - name: Billing Agreements
    x-displayName: Billing Agreements
  - name: Billing Meter Usage
    x-displayName: Billing Meter Usage
  - name: Business
    x-displayName: Business
  - name: Industries
    x-displayName: Industries
  - name: Timezones
    x-displayName: Timezones
  - name: Callbacks
    x-displayName: Callbacks
  - name: Connected Apps
    x-displayName: Connected Apps
  - name: Connections
    x-displayName: Connections
  - name: Directories
    x-displayName: Directories
  - name: Environments
    x-displayName: Environments
  - name: Environment variables
    x-displayName: Environment variables
  - name: Feature Flags
    x-displayName: Feature Flags
  - name: Identities
    x-displayName: Identities
  - name: Organizations
    x-displayName: Organizations
  - name: MFA
    x-displayName: MFA
  - name: Permissions
    x-displayName: Permissions
  - name: Properties
    x-displayName: Properties
  - name: Property Categories
    x-displayName: Property Categories
  - name: Roles
    x-displayName: Roles
  - name: Search
    x-displayName: Search
  - name: Subscribers
    x-displayName: Subscribers
  - name: Users
    x-displayName: Users
  - name: Webhooks
    x-displayName: Webhooks
paths:
  /api/v1/api_keys:
    servers: []
    get:
      tags:
        - API Keys
      operationId: getApiKeys
      x-scope: read:api_keys
      summary: Get API keys
      description: |
        Returns a list of API keys.

        <div>
          <code>read:api_keys</code>
        </div>
      parameters:
        - name: page_size
          in: query
          description: Number of results per page. Defaults to 50 if parameter not sent.
          schema:
            type: integer
            nullable: true
        - name: starting_after
          in: query
          description: The ID of the API key to start after.
          schema:
            type: string
            nullable: true
        - name: key_type
          in: query
          description: Filter by API key type (organization or user).
          schema:
            type: string
            enum:
              - organization
              - user
            nullable: true
        - name: status
          in: query
          description: Filter by API key status (active, inactive, revoked).
          schema:
            type: string
            enum:
              - active
              - inactive
              - revoked
            nullable: true
        - name: user_id
          in: query
          description: Filter by user ID to get API keys associated with a specific user.
          schema:
            type: string
            nullable: true
        - name: org_code
          in: query
          description: Filter by organization code to get API keys associated with a specific organization.
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: API keys successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_api_keys_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    post:
      tags:
        - API Keys
      operationId: createApiKey
      x-scope: create:api_keys
      summary: Create API key
      description: |
        Create a new API key.

        <div>
          <code>create:api_keys</code>
        </div>
      requestBody:
        description: API key details.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  description: The name of the API key.
                  type: string
                  nullable: false
                type:
                  description: The entity type that will use this API key.
                  type: string
                  enum:
                    - user
                    - organization
                    - environment
                  nullable: false
                api_id:
                  description: The ID of the API this key is associated with.
                  type: string
                  nullable: false
                scope_ids:
                  description: Array of scope IDs to associate with this API key.
                  type: array
                  items:
                    type: string
                  nullable: true
                user_id:
                  description: The ID of the user to associate with this API key (for user-level keys).
                  type: string
                  nullable: true
                org_code:
                  description: The organization code to associate with this API key (for organization-level keys).
                  type: string
                  nullable: true
              required:
                - name
                - api_id
                - type
      responses:
        '201':
          description: API key successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/create_api_key_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/api_keys/{key_id}:
    servers: []
    get:
      tags:
        - API Keys
      operationId: getApiKey
      x-scope: read:api_keys
      summary: Get API key
      description: |
        Retrieve API key details by ID.

        <div>
          <code>read:api_keys</code>
        </div>
      parameters:
        - name: key_id
          in: path
          description: The ID of the API key.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: API key successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_api_key_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    delete:
      tags:
        - API Keys
      operationId: deleteApiKey
      x-scope: delete:api_keys
      summary: Delete API key
      description: |
        Delete an API key.

        <div>
          <code>delete:api_keys</code>
        </div>
      parameters:
        - name: key_id
          in: path
          description: The ID of the API key.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: API key successfully deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/success_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    put:
      tags:
        - API Keys
      operationId: rotateApiKey
      x-scope: update:api_keys
      summary: Rotate API key
      description: |
        Rotate an API key to generate a new key while maintaining the same permissions and associations.

        <div>
          <code>update:api_keys</code>
        </div>
      parameters:
        - name: key_id
          in: path
          description: The ID of the API key to rotate.
          required: true
          schema:
            type: string
      responses:
        '201':
          description: API key successfully rotated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rotate_api_key_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/api_keys/verify:
    servers: []
    post:
      tags:
        - API Keys
      operationId: verifyApiKey
      summary: Verify API key
      description: |
        Verify an API key (public endpoint, no authentication required).
      requestBody:
        description: API key verification details.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                api_key:
                  description: The API key to verify.
                  type: string
                  nullable: false
              required:
                - api_key
      responses:
        '200':
          description: API key verification result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/verify_api_key_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '401':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis:
    servers: []
    get:
      tags:
        - APIs
      operationId: getAPIs
      x-scope: read:apis
      summary: Get APIs
      description: |
        Returns a list of your APIs. The APIs are returned sorted by name.

        <div>
          <code>read:apis</code>
        </div>
      parameters:
        - name: expand
          in: query
          description: 'Additional data to include in the response. Allowed value: "scopes".'
          required: false
          schema:
            type: string
            nullable: true
            enum:
              - scopes
      responses:
        '200':
          description: A list of APIs.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_apis_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    post:
      tags:
        - APIs
      operationId: addAPIs
      x-scope: create:apis
      summary: Create API
      description: |
        Register a new API. For more information read [Register and manage APIs](https://docs.kinde.com/developer-tools/your-apis/register-manage-apis/).

        <div>
          <code>create:apis</code>
        </div>
      externalDocs:
        url: https://docs.kinde.com/developer-tools/your-apis/register-manage-apis
        description: Register and manage APIs
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: The name of the API. (1-64 characters).
                  example: Example API
                audience:
                  type: string
                  description: A unique identifier for the API - commonly the URL. This value will be used as the `audience` parameter in authorization claims. (1-64 characters)
                  example: https://api.example.com
              required:
                - name
                - audience
      responses:
        '200':
          description: APIs successfully updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/create_apis_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis/{api_id}:
    servers: []
    parameters:
      - $ref: '#/components/parameters/api_id'
    get:
      tags:
        - APIs
      operationId: getAPI
      x-scope: read:apis
      summary: Get API
      description: |
        Retrieve API details by ID.

        <div>
          <code>read:apis</code>
        </div>
      responses:
        '200':
          description: API successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_api_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    delete:
      tags:
        - APIs
      operationId: deleteAPI
      x-scope: delete:apis
      summary: Delete API
      description: |
        Delete an API you previously created.

        <div>
          <code>delete:apis</code>
        </div>
      responses:
        '200':
          description: API successfully deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/delete_api_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis/{api_id}/scopes:
    servers: []
    get:
      tags:
        - APIs
      operationId: getAPIScopes
      x-scope: read:api_scopes
      summary: Get API scopes
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
      description: |
        Retrieve API scopes by API ID.

        <div>
          <code>read:api_scopes</code>
        </div>
      responses:
        '200':
          description: API scopes successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_api_scopes_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    post:
      tags:
        - APIs
      operationId: addAPIScope
      x-scope: create:api_scopes
      summary: Create API scope
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
      description: |
        Create a new API scope.

        <div>
          <code>create:api_scopes</code>
        </div>
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                key:
                  type: string
                  description: The key reference for the scope (1-64 characters, no white space).
                  example: read:logs
                description:
                  type: string
                  description: Description of the api scope purpose.
                  example: Scope for reading logs.
              required:
                - key
      responses:
        '200':
          description: API scopes successfully created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/create_api_scopes_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis/{api_id}/scopes/{scope_id}:
    servers: []
    get:
      tags:
        - APIs
      operationId: getAPIScope
      summary: Get API scope
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
        - name: scope_id
          in: path
          description: Scope ID
          required: true
          schema:
            type: string
            nullable: false
            example: api_scope_019391daf58d87d8a7213419c016ac95
      description: |
        Retrieve API scope by API ID.

        <div>
          <code>read:api_scopes</code>
        </div>
      responses:
        '200':
          description: API scope successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_api_scope_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    patch:
      tags:
        - APIs
      operationId: updateAPIScope
      summary: Update API scope
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
        - name: scope_id
          in: path
          description: Scope ID
          required: true
          schema:
            type: string
            nullable: false
            example: api_scope_019391daf58d87d8a7213419c016ac95
      description: |
        Update an API scope.

        <div>
          <code>update:api_scopes</code>
        </div>
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  description: Description of the api scope purpose.
                  example: Scope for reading logs.
      responses:
        '200':
          description: API scope successfully updated
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    delete:
      tags:
        - APIs
      operationId: deleteAPIScope
      summary: Delete API scope
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
        - name: scope_id
          in: path
          description: Scope ID
          required: true
          schema:
            type: string
            nullable: false
            example: api_scope_019391daf58d87d8a7213419c016ac95
      description: |
        Delete an API scope you previously created.

        <div>
          <code>delete:apis_scopes</code>
        </div>
      responses:
        '200':
          description: API scope successfully deleted.
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis/{api_id}/applications:
    servers: []
    parameters:
      - $ref: '#/components/parameters/api_id'
    patch:
      tags:
        - APIs
      operationId: updateAPIApplications
      summary: Authorize API applications
      description: |
        Authorize applications to be allowed to request access tokens for an API

        <div>
          <code>update:apis</code>
        </div>
      requestBody:
        description: The applications you want to authorize.
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - applications
              properties:
                applications:
                  type: array
                  items:
                    type: object
                    required:
                      - id
                    properties:
                      id:
                        description: The application's Client ID.
                        type: string
                        example: d2db282d6214242b3b145c123f0c123
                      operation:
                        description: Optional operation, set to 'delete' to revoke authorization for the application. If not set, the application will be authorized.
                        type: string
                        example: delete
      responses:
        '200':
          description: Authorized applications updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authorize_app_api_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/apis/{api_id}/applications/{application_id}/scopes/{scope_id}:
    servers: []
    post:
      tags:
        - APIs
      operationId: addAPIApplicationScope
      summary: Add scope to API application
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
        - name: application_id
          in: path
          description: Application ID
          required: true
          schema:
            type: string
            nullable: false
            example: 7643b487c97545aab79257fd13a1085a
        - name: scope_id
          in: path
          description: Scope ID
          required: true
          schema:
            type: string
            nullable: false
            example: api_scope_019391daf58d87d8a7213419c016ac95
      description: |
        Add a scope to an API application.

        <div>
          <code>create:api_application_scopes</code>
        </div>
      responses:
        '200':
          description: API scope successfully added to API application
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    delete:
      tags:
        - APIs
      operationId: deleteAPIApplicationScope
      summary: Delete API application scope
      parameters:
        - name: api_id
          in: path
          description: API ID
          required: true
          schema:
            type: string
            nullable: false
            example: 838f208d006a482dbd8cdb79a9889f68
        - name: application_id
          in: path
          description: Application ID
          required: true
          schema:
            type: string
            nullable: false
            example: 7643b487c97545aab79257fd13a1085a
        - name: scope_id
          in: path
          description: Scope ID
          required: true
          schema:
            type: string
            nullable: false
            example: api_scope_019391daf58d87d8a7213419c016ac95
      description: |
        Delete an API application scope you previously created.

        <div>
          <code>delete:apis_application_scopes</code>
        </div>
      responses:
        '200':
          description: API scope successfully deleted.
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/applications:
    servers: []
    get:
      tags:
        - Applications
      operationId: getApplications
      x-scope: read:applications
      summary: Get applications
      description: |
        Get a list of applications / clients.

        <div>
          <code>read:applications</code>
        </div>
      parameters:
        - name: sort
          in: query
          description: Field and order to sort the result by.
          schema:
            type: string
            nullable: true
            enum:
              - name_asc
              - name_desc
        - name: page_size
          in: query
          description: Number of results per page. Defaults to 10 if parameter not sent.
          schema:
            type: integer
            nullable: true
        - name: next_token
          in: query
          description: A string to get the next page of results if there are more results.
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: A successful response with a list of applications or an empty list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_applications_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    post:
      tags:
        - Applications
      operationId: createApplication
      x-scope: create:applications
      summary: Create application
      description: |
        Create a new client.

        <div>
          <code>create:applications</code>
        </div>
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  description: The application's name.
                  type: string
                  example: React Native app
                type:
                  description: The application's type. Use `reg` for regular server rendered applications, `spa` for single-page applications, `m2m` for machine-to-machine applications, and `device` for devices and IoT.
                  type: string
                  enum:
                    - reg
                    - spa
                    - m2m
                    - device
                org_code:
                  description: Scope an M2M application to an org (Plus plan required).
                  type: string
                  example: org_1234567890abcdef
                  nullable: true
              required:
                - name
                - type
      responses:
        '201':
          description: Application successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/create_application_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
  /api/v1/applications/{application_id}:
    servers: []
    get:
      tags:
        - Applications
      operationId: getApplication
      summary: Get application
      description: |
        Gets an application given the application's ID.

        <div>
          <code>read:applications</code>
        </div>
      parameters:
        - name: application_id
          in: path
          description: The identifier for the application.
          required: true
          schema:
            type: string
            nullable: false
            example: 20bbffaa4c5e492a962273039d4ae18b
      responses:
        '200':
          description: Application successfully retrieved.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/get_application_response'
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    patch:
      tags:
        - Applications
      operationId: updateApplication
      summary: Update Application
      description: |
        Updates a client's settings. For more information, read [Applications in Kinde](https://docs.kinde.com/build/applications/about-applications)

        <div>
          <code>update:applications</code>
        </div>
      parameters:
        - name: application_id
          in: path
          description: The identifier for the application.
          required: true
          schema:
            type: string
            example: 20bbffaa4c5e492a962273039d4ae18b
      requestBody:
        description: Application details.
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  description: The application's name.
                  type: string
                language_key:
                  description: The application's language key.
                  type: string
                logout_uris:
                  description: The application's logout uris.
                  type: array
                  items:
                    type: string
                redirect_uris:
                  description: The application's redirect uris.
                  type: array
                  items:
                    type: string
                login_uri:
                  description: The default login route for resolving session issues.
                  type: string
                homepage_uri:
                  description: The homepage link to your application.
                  type: string
      responses:
        '200':
          description: Application successfully updated.
        '400':
          $ref: '#/components/responses/bad_request'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too_many_requests'
      security:
        - kindeBearerAuth: []
    delete:
      tags:
        - Applications
      operationId: deleteApplication
      summary: Delete application
      description: |
        Delete a client / application.

        <div>
          <code>delete:applications</code>
        </div>
      parameters:
        - name: application_id
          in: path
          description: The identifier for the application.
          req

# --- truncated at 32 KB (405 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kinde/refs/heads/main/openapi/kinde-management-api-openapi.yml