/
HI
hikyo-org
/
Hikyo API
Search skmtc…
⌘K
Changes
Docs
Sign in
Docs
History
Schema
Filter operations
access
42
accounts
1
adapters
26
approvals
7
audit
6
auth
51
definitions
7
delivery
6
dynamic
12
environments
2
hierarchy
24
identities
15
instance
55
post
/api/v1/instance/mail/test
Send one test using the active mail configuration.
get
/api/v1/instance/mail
Read the static active mailer predicate.
get
/api/v1/instance/oidc-providers
List configured OIDC providers.
get
/api/v1/instance/oidc-providers/{slug}
Read one OIDC provider.
put
/api/v1/instance/oidc-providers/{slug}
Create or reconfigure an OIDC provider.
delete
/api/v1/instance/oidc-providers/{slug}
Delete an OIDC provider.
get
/api/v1/instance/oauth2-providers
List configured OAuth2 providers.
get
/api/v1/instance/oauth2-providers/{slug}
Read one OAuth2 provider.
put
/api/v1/instance/oauth2-providers/{slug}
Create or reconfigure an OAuth2 provider.
delete
/api/v1/instance/oauth2-providers/{slug}
Delete an OAuth2 provider.
get
/api/v1/instance/retention-health
Read payload-pruner health.
get
/api/v1/instance/update-status
Read the configured release channel and available update.
post
/api/v1/instance/update
Refuse legacy remote apply while preserving authenticated audit evidence.
get
/api/v1/instance/updates/{job}
Read one local updater job and reconcile its terminal audit outcome.
get
/api/v1/instance/saml-providers
List configured SAML providers.
get
/api/v1/instance/saml-providers/{slug}
Read one SAML provider.
put
/api/v1/instance/saml-providers/{slug}
Create or reconfigure a SAML provider from pinned metadata.
delete
/api/v1/instance/saml-providers/{slug}
Remove a SAML provider.
patch
/api/v1/instance/saml-providers/{slug}
Partially update SAML provider policy or disable the provider.
post
/api/v1/instance/saml-providers/{slug}/refresh-metadata
Refresh and explicitly confirm a SAML provider's metadata diff.
get
/api/v1/instance/saml-sp-keys
List SAML SP signing-key lifecycle state.
post
/api/v1/instance/saml-sp-keys/rotate
Rotate the active SAML SP signing key with an overlap window.
delete
/api/v1/instance/saml-sp-keys/{fingerprint}
Retire and erase an overlap-retiring SAML SP key.
post
/api/v1/instance/saml-sp-keys/{fingerprint}/compromise-retire
Immediately erase and replace a compromised active SAML SP key.
get
/api/v1/instance/config
Read this owner instance configuration status.
get
/api/v1/instance/config/adoption
Preview one-time adoption without disclosing values.
post
/api/v1/instance/config/adoption
Adopt the exact previewed effective configuration.
post
/api/v1/instance/config/apply
Apply one published revision on this logical instance.
post
/api/v1/instance/config/mail/test
Send one test message using exactly the selected revision.
get
/api/v1/instance/credential-policy
Read the instance credential lifetime controls.
put
/api/v1/instance/credential-policy
Move the instance credential lifetime controls.
get
/api/v1/instance/federation-issuers
List the configured OIDC federation issuers.
post
/api/v1/instance/federation-issuers
Configure an OIDC federation issuer.
delete
/api/v1/instance/federation-issuers/{issuer}
Remove an issuer configuration.
patch
/api/v1/instance/federation-issuers/{issuer}
Move an issuer's JWKS source or refused audiences.
get
/api/v1/instance/directory
This instance's directory listing, as served to a connected instance.
get
/api/v1/instance/remotes
The directory of connected instances.
post
/api/v1/instance/remotes
Add a connection entry, verified by one authenticated fetch.
get
/api/v1/instance/remotes/{remote}
One connection entry, full detail, fetched on view.
delete
/api/v1/instance/remotes/{remote}
Destroy an entry, its stored credential and its snapshot.
patch
/api/v1/instance/remotes/{remote}
Change an entry's display name.
get
/api/v1/instance/connections
The connection credentials this instance has minted.
post
/api/v1/instance/connections
Mint a connection principal and its one credential.
get
/api/v1/instance/connections/{connection}
One connection's metadata.
delete
/api/v1/instance/connections/{connection}
Revoke the credential and retire its principal with it.
get
/api/v1/instance/workspace-origins
The origin allowlist — which UI origins may run the handoff.
post
/api/v1/instance/workspace-origins
Consent to one exact UI origin.
delete
/api/v1/instance/workspace-origins
De-allowlist an origin and kill every session bound to it.
post
/api/v1/instance/rotate-token-key
Rotate the root change-token key.
post
/api/v1/instance/rotate-dek
Append a new DEK version for one project or the instance scope.
post
/api/v1/instance/reencrypt
Walk the instance credential ciphertext onto the active DEK version.
post
/api/v1/instance/rotate-master-key
Generate a new master key and re-wrap every tier-3 key under it.
post
/api/v1/instance/rotate-root-key
Run one phase of the crash-safe root-key rotation.
post
/api/v1/orgs/{org}/projects/{project}/reencrypt
Walk a project's ciphertext onto the active DEK version.
post
/api/v1/instance/rotate-scanning-key
Rotate the secret-scanning fingerprint key.
keys
14
meta
2
orgs
2
pki
24
revisions
12
scim
14
scim-protocol
19
ssh
17
transit
15
values
15
instance
Copy Markdown
Copied
Copy failed
Changes to Read one OAuth2 provider.
get
/api/v1/instance/oauth2-providers/{slug}
Oct 2, 2026
8a6e250b7105
Revision changes
info
endpoint added