NNO Documentation

Identity and Access Management — authentication, roles, permissions, API keys, and service tokens.

List role→permission mappings for an organization

Query Parameters

orgId*string

Length1 <= length

Response Body

`application/json`

curl -X GET "https://iam.svc.nno.app/api/nno/roles?orgId=string"

curl -X GET "https://iam.svc.nno.app/api/nno/roles?orgId=string"

null

null

Upsert a role→permission mapping for an organization

Request Body

application/json

orgId*string

Length1 <= length

role*string

Length1 <= length

permissions*array<string>

Items0 <= items

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/roles" \
  -H "Content-Type: application/json" \
  -d '{
    "orgId": "string",
    "role": "string",
    "permissions": [
      "string"
    ]
  }'

curl -X POST "https://iam.svc.nno.app/api/nno/roles" \  -H "Content-Type: application/json" \  -d '{    "orgId": "string",    "role": "string",    "permissions": [      "string"    ]  }'

null

null

null

Remove a role→permission mapping

Path Parameters

orgId*string

role*string

Response Body

`application/json`

curl -X DELETE "https://iam.svc.nno.app/api/nno/roles/string/string"

curl -X DELETE "https://iam.svc.nno.app/api/nno/roles/string/string"

Empty

null

List permission grants for an organization

Query Parameters

orgId*string

Length1 <= length

userId?string

Response Body

`application/json`

curl -X GET "https://iam.svc.nno.app/api/nno/grants?orgId=string"

curl -X GET "https://iam.svc.nno.app/api/nno/grants?orgId=string"

null

null

Create a per-user permission grant or denial

Request Body

application/json

userId*string

Length1 <= length

orgId*string

Length1 <= length

permission*string

Length1 <= length

granted*boolean

grantedBy*string

Length1 <= length

expiresAt?integer

Range0 < value

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/grants" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "string",
    "orgId": "string",
    "permission": "string",
    "granted": true,
    "grantedBy": "string"
  }'

curl -X POST "https://iam.svc.nno.app/api/nno/grants" \  -H "Content-Type: application/json" \  -d '{    "userId": "string",    "orgId": "string",    "permission": "string",    "granted": true,    "grantedBy": "string"  }'

null

null

Remove a permission grant

Path Parameters

id*string

Response Body

`application/json`

curl -X DELETE "https://iam.svc.nno.app/api/nno/grants/string"

curl -X DELETE "https://iam.svc.nno.app/api/nno/grants/string"

Empty

null

Create a Better Auth organization for a tenant

Request Body

application/json

name*string

Length1 <= length <= 100

slug*string

Match^[a-z0-9-]+$

Length1 <= length <= 63

ownerId*string

Length1 <= length

orgType?string

Default"tenant"

Value in"nno-operator" | "tenant"

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/organizations" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string",
    "slug": "string",
    "ownerId": "string"
  }'

curl -X POST "https://iam.svc.nno.app/api/nno/organizations" \  -H "Content-Type: application/json" \  -d '{    "name": "string",    "slug": "string",    "ownerId": "string"  }'

null

null

null

null

Look up an organization by slug

Path Parameters

slug*string

Response Body

`application/json`

curl -X GET "https://iam.svc.nno.app/api/nno/organizations/string"

curl -X GET "https://iam.svc.nno.app/api/nno/organizations/string"

null

null

Bootstrap the NNO operator org

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/bootstrap"

curl -X POST "https://iam.svc.nno.app/api/nno/bootstrap"

null

null

null

null

Validate a raw API key

Request Body

application/json

key*string

Length1 <= length

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/apikey/validate" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "string"
  }'

curl -X POST "https://iam.svc.nno.app/api/nno/apikey/validate" \  -H "Content-Type: application/json" \  -d '{    "key": "string"  }'

null

null

null

Issue a short-lived service-to-service JWT

Request Body

application/json

serviceId*string

Length1 <= length

targetService*string

Length1 <= length

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/api/nno/service-token" \
  -H "Content-Type: application/json" \
  -d '{
    "serviceId": "string",
    "targetService": "string"
  }'

curl -X POST "https://iam.svc.nno.app/api/nno/service-token" \  -H "Content-Type: application/json" \  -d '{    "serviceId": "string",    "targetService": "string"  }'

null

null

null

null

Update platform suspension status

Request Body

application/json

platformId*string

Length1 <= length

status*string

Value in"suspended" | "active"

Response Body

`application/json`

curl -X POST "https://iam.svc.nno.app/internal/platform-status" \
  -H "Content-Type: application/json" \
  -d '{
    "platformId": "string",
    "status": "suspended"
  }'

curl -X POST "https://iam.svc.nno.app/internal/platform-status" \  -H "Content-Type: application/json" \  -d '{    "platformId": "string",    "status": "suspended"  }'

null

null

null

Get the current user's profile

Response Body

`application/json`

curl -X GET "https://iam.svc.nno.app/api/auth/profile"

curl -X GET "https://iam.svc.nno.app/api/auth/profile"

null

null

null

Update the current user's profile

Request Body

application/json

name?string

Length1 <= length

image?string|null

Formaturi

Response Body

`application/json`

curl -X PATCH "https://iam.svc.nno.app/api/auth/profile" \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X PATCH "https://iam.svc.nno.app/api/auth/profile" \  -H "Content-Type: application/json" \  -d '{}'

null

null

null

NNO IAM Service API

200application/json

400application/json

200application/json

201application/json

400application/json

204

404application/json

200application/json

400application/json

201application/json

400application/json

204

404application/json

201application/json

400application/json

404application/json

409application/json

200application/json

404application/json

201application/json

401application/json

409application/json

500application/json

200application/json

400application/json

401application/json

200application/json

400application/json

401application/json

500application/json

200application/json

400application/json

401application/json

200application/json

401application/json

404application/json

200application/json

400application/json

401application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`