Zones

Create zone

Creates a new zone for the authenticated organization. A zone is an isolated environment for IAM resources.

post/zones

Request body

namestring safe-text required

Human-readable name. Must not contain HTML tags (e.g. <script>, <div>) or control characters.

descriptionstring safe-text nullable

Human-readable description. Must not contain HTML tags (e.g. <script>, <div>) or control characters.

organization_idstring

Target organization ID. Required for platform principals (whose tokens carry no organization claim); for organization-scoped principals it is optional and must match the authenticated organization if supplied.

requires_invitationboolean

Whether the zone requires an invitation for email/password registration, only applies when user_identity_provider_id is not set. Defaults to true.

default_mcp_gateway_applicationboolean

Assign a default MCP Gateway application to the zone

Response

A zone for organizing resources within an organization

idstring required

Unique identifier of the zone

organization_idstring required

Organization that owns this zone

slugstring required

URL-safe identifier, unique within the zone

namestring required

Human-readable name

descriptionstring nullable

Human-readable description

user_identity_provider_idstring

Provider ID configured for user login

requires_invitationboolean

Whether the zone requires an invitation for email/password registration, only applies when user_identity_provider_id is not set

default_mcp_gateway_application_idstring

Application ID configured as the default MCP Gateway for the zone

default_resource_idstring

Resource ID configured as the default resource for the zone

permissionsIamPermissions

Permissions granted to the authenticated principal. Only populated when expand[]=permissions query parameter is provided. Keys are resource types, values are objects mapping action names to boolean values.

owner_type'platform' | 'customer' required

Who owns this zone. Platform-owned zones cannot be modified via API.

created_atstring date-time required

Entity creation timestamp

updated_atstring date-time required

Entity update timestamp

Example response

{
  "permissions": {
    "zones": {
      "read": true,
      "update": true,
      "delete": false,
      "create": false
    },
    "applications": {
      "read": true,
      "list": true,
      "create": false
    }
  }
}

Changes

Changed in 7 of the 23 revisions of this API.2610

Jun 9, 20267e0e4fa2e16f1See the full diff
- ○
  added the required property owner_type to the response with the 200 status
  response-required-property-added
May 18, 20262861899ae69e23See the full diff
- ●
  removed the request property login_flow
  request-property-removed
- ●
  removed the optional property login_flow from the response with the 200 status
  response-optional-property-removed
- ○
  added the new optional request property organization_id
  new-optional-request-property
- ○
  added the new optional request property protocols/oauth2/cimd
  new-optional-request-property
- ○
  added the required property protocols/oauth2/cimd to the response with the 200 status
  response-required-property-added
Apr 20, 2026932699a5ea162See the full diff
- ▲
  the description request property type/format changed from string/ to string/safe-text
  request-property-type-changed
- ▲
  the name request property type/format changed from string/ to string/safe-text
  request-property-type-changed
Apr 2, 2026aee6e66de0d31See the full diff
- ○
  added the optional property default_resource_id to the response with the 200 status
  response-optional-property-added
Mar 16, 2026d3d69f45bfed3See the full diff
- ○
  the endpoint scheme security OAuth2 was added to the API
  api-security-added
- ○
  the endpoint scheme security bearerAuth was added to the API
  api-security-added
- ○
  the endpoint scheme security iam_bearerAuth was removed from the API
  api-security-removed
This revision also has 8 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Mar 9, 2026cb43483cd1b322See the full diff
- ●
  removed the request property directory_open_signups_enabled
  request-property-removed
- ●
  removed the optional property directory_open_signups_enabled from the response with the 200 status
  response-optional-property-removed
- ○
  added the new optional request property requires_invitation
  new-optional-request-property
- ○
  added the optional property requires_invitation to the response with the 200 status
  response-optional-property-added
Feb 6, 2026edd1b760a9892See the full diff
- ●
  removed the request property cname
  request-property-removed
- ●
  removed the optional property cname from the response with the 200 status
  response-optional-property-removed
This revision also has 82 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history