ReferenceAdmin Centre API

Single sign-on apps

"Sign in with Bramble" for other applications (OpenID Connect). Register an app to get its client ID and secret, choose who may use it, and optionally show it in the app launcher. Bramble's own platform apps can be switched on or off for the organisation.

Method	Path	Summary
GET	`/v1/admin/tenant/oidc`	Get OIDC SSO status and the tenant's registered OIDC clients
POST	`/v1/admin/tenant/oidc/enable`	Enable or disable OIDC SSO for the tenant
POST	`/v1/admin/tenant/oidc/clients`	Register a single sign-on app
PATCH	`/v1/admin/tenant/oidc/clients/:id`	Update an OIDC client's settings
POST	`/v1/admin/tenant/oidc/clients/:id/rotate-secret`	Rotate an OIDC client's secret
DELETE	`/v1/admin/tenant/oidc/clients/:id`	Delete an OIDC client
GET	`/v1/admin/tenant/oidc/clients/:id/access`	Get an OIDC client's access-restriction settings and allow-listed subjects
POST	`/v1/admin/tenant/oidc/clients/:id/access/toggle`	Toggle whether an OIDC client's access is restricted to an allow-list
POST	`/v1/admin/tenant/oidc/clients/:id/access`	Add a user or group to an OIDC client's access allow-list
DELETE	`/v1/admin/tenant/oidc/clients/:id/access/:accessId`	Remove a subject from an OIDC client's access allow-list
GET	`/v1/admin/tenant/oidc/platform-apps`	List Bramble's own platform apps
POST	`/v1/admin/tenant/oidc/platform-apps/:clientId/enable`	Opt the tenant into a platform OIDC app
POST	`/v1/admin/tenant/oidc/platform-apps/:clientId/disable`	Opt the tenant out of a platform OIDC app
POST	`/v1/admin/tenant/oidc/clients/:id/icon`	Upload a drawer/rail icon for an OIDC client
DELETE	`/v1/admin/tenant/oidc/clients/:id/icon`	Remove an OIDC client's uploaded icon
GET	`/v1/admin/tenant/oidc/icons/:id`	Serve an uploaded OIDC client icon

#Get OIDC SSO status and the tenant's registered OIDC clients

GET/v1/admin/tenant/oidc

Get OIDC SSO status and the tenant's registered OIDC clients. Requires the GLOBAL_ADMIN role. Client secrets are never returned here.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Response 200

Field	Type	Description
`enabled`	boolean
`clients`	array of any

Example response

JSON

{
  "enabled": true,
  "clients": []
}

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc' -Headers $headers

#Enable or disable OIDC SSO for the tenant

POST/v1/admin/tenant/oidc/enable

Enable or disable OIDC SSO for the tenant. Requires the GLOBAL_ADMIN role.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/enable
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Request body JSON

Name	Type	Description
`enabled`	boolean

Response 200

Field	Type	Description
`success`	boolean
`enabled`	boolean

Example response

JSON

{
  "success": true,
  "enabled": true
}

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/enable' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/enable', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"enabled":true}),
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/enable",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"enabled":True},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"enabled":true}'
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/enable' -Headers $headers -ContentType 'application/json' -Body $body

#Register a single sign-on app

POST/v1/admin/tenant/oidc/clients

Returns the new app's client_id and client_secret. The secret is shown only once; rotate it if it's lost.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Request body JSON

Name	Type	Description
`name`required	string	The app's name, shown on the consent screen.
`redirect_uris`required	array of any	Every address the app may return to after sign-in (http or https).
`launch_url`required	string	Where the launcher opens the app. Required to show it in the launcher.
`icon_url`	string	An image for its launcher icon.
`show_in_drawer`	any	Show the app in people's launcher.

Response 201

Field	Type	Description
`success`	boolean
`client`	object
`client.id`	integer
`client.client_id`	integer
`client.client_secret`	any
`client.name`	string
`client.redirect_uris`	any
`client.launch_url`	string, or null
`client.icon_url`	string, or null
`client.show_in_drawer`	integer
`client.is_active`	integer

Example response

JSON

{
  "success": true,
  "client": {
    "id": 42,
    "client_id": 7,
    "client_secret": null,
    "name": "Example name",
    "redirect_uris": null,
    "launch_url": "https://example.com/…",
    "icon_url": "https://example.com/…",
    "show_in_drawer": 1,
    "is_active": 1
  }
}

Errors

Status	Message
400	name and at least one redirect_uri are required
400	redirect_uris must be valid http(s) URLs
400	launch_url must be a valid http(s) URL
400	icon_url must be a valid http(s) URL
400	launch_url is required to show this app in the drawer

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…"}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…"}),
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…"},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…"}'
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients' -Headers $headers -ContentType 'application/json' -Body $body

#Update an OIDC client's settings

PATCH/v1/admin/tenant/oidc/clients/:id

Update an OIDC client's settings. Requires the GLOBAL_ADMIN role. All fields optional. groups_claim_name lets the claim key be renamed from the default (e.g. to "roles"); pass an empty string to reset it.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Request body JSON

Name	Type	Description
`name`	string
`redirect_uris`required	array of any
`launch_url`	string
`icon_url`	string
`show_in_drawer`	any
`groups_claim_name`	string	Name of the claim that carries the person's groups (default `groups`).
`is_active`	boolean	Turn the app on or off.

Response 200

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
400	redirect_uris must be an array of valid http(s) URLs
400	launch_url must be a valid http(s) URL
400	icon_url must be a valid http(s) URL
400	launch_url is required to show this app in the drawer
400	groups_claim_name must be a valid claim key (letters, numbers, underscore)
404	Client not found

Example request

Bash

curl -X PATCH 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…","groups_claim_name":"Example groups claim name","is_active":true}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42', {
  method: 'PATCH',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…","groups_claim_name":"Example groups claim name","is_active":true}),
});
const data = await res.json();

Python

import os, requests

r = requests.patch(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…","groups_claim_name":"Example groups claim name","is_active":True},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"name":"Example name","redirect_uris":[],"launch_url":"https://example.com/…","icon_url":"https://example.com/…","show_in_drawer":"…","groups_claim_name":"Example groups claim name","is_active":true}'
Invoke-RestMethod -Method PATCH -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42' -Headers $headers -ContentType 'application/json' -Body $body

#Rotate an OIDC client's secret

POST/v1/admin/tenant/oidc/clients/:id/rotate-secret

Rotate an OIDC client's secret. Requires the GLOBAL_ADMIN role. Invalidates the old secret immediately. The new client_secret is returned only in this response, never again.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/rotate-secret
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Response 200

Field	Type	Description
`success`	boolean
`client_secret`	any

Example response

JSON

{
  "success": true,
  "client_secret": null
}

Errors

Status	Message
404	Client not found

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/rotate-secret' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/rotate-secret', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/rotate-secret",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/rotate-secret' -Headers $headers

#Delete an OIDC client

DELETE/v1/admin/tenant/oidc/clients/:id

Delete an OIDC client. Requires the GLOBAL_ADMIN role.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Response 200

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
404	Client not found

Example request

Bash

curl -X DELETE 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42', {
  method: 'DELETE',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.delete(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method DELETE -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42' -Headers $headers

#Get an OIDC client's access-restriction settings and allow-listed subjects

GET/v1/admin/tenant/oidc/clients/:id/access

Get an OIDC client's access-restriction settings and allow-listed subjects. Requires the GLOBAL_ADMIN role.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/access
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Response 200

Field	Type	Description
`restrict_access`	boolean
`entries`	array of object
`entries[].id`	integer
`entries[].subject_type`	string: "user" \| "group" \| "tenant"
`entries[].subject_id`	integer
`entries[].label`	boolean

Example response

JSON

{
  "restrict_access": false,
  "entries": [
    {
      "id": 42,
      "subject_type": "user",
      "subject_id": 7,
      "label": false
    }
  ]
}

Errors

Status	Message
404	Client not found

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access' -Headers $headers

#Toggle whether an OIDC client's access is restricted to an allow-list

POST/v1/admin/tenant/oidc/clients/:id/access/toggle

Toggle whether an OIDC client's access is restricted to an allow-list. Requires the GLOBAL_ADMIN role.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/access/toggle
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Request body JSON

Name	Type	Description
`restrict_access`	boolean	`true`: only the people and groups on its access list may use it.

Response 200

Field	Type	Description
`success`	boolean
`restrict_access`	boolean

Example response

JSON

{
  "success": true,
  "restrict_access": false
}

Errors

Status	Message
404	Client not found

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/toggle' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"restrict_access":false}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/toggle', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"restrict_access":false}),
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/toggle",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"restrict_access":False},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"restrict_access":false}'
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/toggle' -Headers $headers -ContentType 'application/json' -Body $body

#Add a user or group to an OIDC client's access allow-list

POST/v1/admin/tenant/oidc/clients/:id/access

Add a user or group to an OIDC client's access allow-list. Requires the GLOBAL_ADMIN role. Validates the subject belongs to the caller's tenant; uses INSERT IGNORE so re-adding an existing entry is a no-op.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/access
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Request body JSON

Name	Type	Description
`subject_type`	string: "user" \| "group"
`subject_id`required	integer

Response 201

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
400	subject_type ('user'\|'group') and subject_id are required
400	User not found on this tenant
400	Group not found on this tenant
404	Client not found

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access' \
  -H "X-API-Key: $BRAMBLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"subject_type":"user","subject_id":7}'

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({"subject_type":"user","subject_id":7}),
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
    json={"subject_type":"user","subject_id":7},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
$body = '{"subject_type":"user","subject_id":7}'
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access' -Headers $headers -ContentType 'application/json' -Body $body

#Remove a subject from an OIDC client's access allow-list

DELETE/v1/admin/tenant/oidc/clients/:id/access/:accessId

Remove a subject from an OIDC client's access allow-list. Requires the GLOBAL_ADMIN role.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/access/:accessId
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer
`accessId`required	integer

Response 200

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
404	Client not found
404	Access entry not found

Example request

Bash

curl -X DELETE 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/1' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/1', {
  method: 'DELETE',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.delete(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/1",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method DELETE -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/access/1' -Headers $headers

#List Bramble's own platform apps

GET/v1/admin/tenant/oidc/platform-apps

First-party apps (such as Bramble Sync) the organisation can switch on or off.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Response 200

Field	Type	Description
`id`	integer
`client_id`	string
`name`	string
`redirect_uris`	object
`is_public`	boolean
`enabled`	boolean

Example response

JSON

[
  {
    "id": 42,
    "client_id": "string",
    "name": "Example name",
    "redirect_uris": {},
    "is_public": true,
    "enabled": true
  }
]

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps' -Headers $headers

#Opt the tenant into a platform OIDC app

POST/v1/admin/tenant/oidc/platform-apps/:clientId/enable

Opt the tenant into a platform OIDC app. Requires the GLOBAL_ADMIN role. Adds a subject_type=tenant row to oidc_client_access for this platform-wide client.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/:clientId/enable
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`clientId`required	integer

Response 201

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
404	Platform app not found

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/enable' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/enable', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/enable",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/enable' -Headers $headers

#Opt the tenant out of a platform OIDC app

POST/v1/admin/tenant/oidc/platform-apps/:clientId/disable

Opt the tenant out of a platform OIDC app. Requires the GLOBAL_ADMIN role. Removes the tenant's oidc_client_access row. Already-issued sessions lose access within their access-token lifetime (~10 minutes) on next refresh, not instantly.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/:clientId/disable
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`clientId`required	integer

Response 200

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/disable' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/disable', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/disable",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/platform-apps/1/disable' -Headers $headers

#Upload a drawer/rail icon for an OIDC client

POST/v1/admin/tenant/oidc/clients/:id/icon

Upload a drawer/rail icon for an OIDC client. Requires the GLOBAL_ADMIN role. Multipart upload, field name "icon", 1 MB max, image mimetypes only. Stored as a BLOB in oidc_client_icons; sets the client's icon_url to the public GET /tenant/oidc/icons/{id} URL.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/icon
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Request body

multipart/form-data with the file.

Response 201

Field	Type	Description
`success`	boolean
`icon_url`	string

Example response

JSON

{
  "success": true,
  "icon_url": "https://example.com/…"
}

Errors

Status	Message
400	No image file provided
404	Client not found

Example request

Bash

curl -X POST 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.post(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method POST -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon' -Headers $headers

#Remove an OIDC client's uploaded icon

DELETE/v1/admin/tenant/oidc/clients/:id/icon

Remove an OIDC client's uploaded icon. Requires the GLOBAL_ADMIN role. Deletes the stored BLOB and clears icon_url.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/:id/icon
Requires: Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

Name	Type	Description
`id`required	integer

Response 200

Field	Type	Description
`success`	boolean

Example response

JSON

{
  "success": true
}

Errors

Status	Message
404	Client not found

Example request

Bash

curl -X DELETE 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon', {
  method: 'DELETE',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.delete(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method DELETE -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/clients/42/icon' -Headers $headers

#Serve an uploaded OIDC client icon

GET/v1/admin/tenant/oidc/icons/:id

Serve an uploaded OIDC client icon. Public, no authentication — embedded via img src from other apps' origins (Hub drawer/rail). Cached for one year.

Address: https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/icons/:id
Requires: None: public, or protected by a token in the address or body.

Path parameters

Name	Type	Description
`id`required	integer

Response

A body.

Example request

Bash

curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/icons/42' \
  -H "X-API-Key: $BRAMBLE_KEY"

JavaScript

const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/icons/42', {
  method: 'GET',
  headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();

Python

import os, requests

r = requests.get(
    "https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/icons/42",
    headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()

PowerShell

$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/oidc/icons/42' -Headers $headers

Was this page helpful?