OW Docs
APIs
Every service lives under your tenant host. Service APIs take a token from an Access web client whose Default audiences include the service's audience; Access's own configuration API takes an API client.
Users and credentials
Identity Store
Stores the identities (users) of a tenant and the schema that describes their attributes. Every other service that needs a user looks it up here.
/identity-store/api/v1 · audience identity-store · 18 operations
Password Store
Stores password hashes for identities and the policies that rule them: length, composition, expiry, history, lockout. Verifies and changes passwords at sign-in.
/password-store · audience password-store · 18 operations
FIDO / passkeys
The FIDO2 server of a tenant. It runs the passkey registration and sign-in ceremonies, stores each user's authenticators (passkeys) and holds the authenticator policies that decide which passkeys are accepted.
/fido2 · audience fido2_server · 17 operations
TOTP
Authenticator-app MFA: enrolls TOTP devices for an identity, validates their codes at sign-in, and holds the tenant's TOTP settings (algorithm, digits, period, issuer).
/totp-service/api/v1 · audience totp-service · 10 operations
Recovery codes
One-time backup codes for users who lose their authenticator. Generates, counts, validates and deletes an identity's codes, and holds the tenant's recovery code settings.
/recovery-code-service/api/v1 · audience recovery-code-service · 8 operations
Credential aggregator
not called live yetOne view of every sign-in method a user has: password, TOTP, SMS and email OTP, passkeys, recovery codes. It also keeps login history and the tenant's list of enabled methods. It reads events from the credential services; it doesn't hold the credentials themselves.
/credential-aggregation-service/api/v1 · audience credential-aggregation-service · 13 operations
Sign-in and verification
Action Challenge
Issues a one-time challenge to a user (a code by email or SMS, a magic link, or a token) and checks the answer. The challenge policy, picked by its alias, decides the type, length, lifetime and retries.
/action-challenge-service/api/v1 · audience action-challenge-service · 13 operations
Identity Broker
Federates sign-in to external identity providers: social logins, enterprise OIDC / OAuth / SAML, and national eIDs such as DigiD, eHerkenning and eIDAS. The management API configures those providers; the broker's OIDC endpoints are what Access and IO call at sign-in.
/broker · audience identity-broker · 53 operations
Identity Linking
Links an identity to its accounts at external identity providers. Each link maps an Identity Store id to an external subject under an IdP alias, so a federated sign-in can find the right user.
/identity-linking/api/v1 · audience identity-linking · 4 operations
Consent and delegation
Consent management
Keeps the documents users accept (privacy policy, terms) and the processing purposes they grant, with versions and translations, and records each user's consents in a ledger.
/consent-management/api/v1 · audience consent-management · 47 operations
Delegated User Management v2
Lets trusted people at customer and partner organizations manage their own users' access. DMv2 holds organizations, users, applications, permissions, access roles, admin roles, admin scopes and invitations. It is API-only: everything goes through the Correlation Layer API.
/dm/correlation/api · audience correlation-layer · 111 operations
B2C Helpdesk
not called live yetStores how the helpdesk screens look for a tenant: which filters, columns and search settings agents see, separately for B2C and B2B.
/helpdesk-management/api/v1 · audience helpdesk-management · 2 operations