PingOne Advanced Identity Cloud

Create and modify managed object types

If the default managed object types in Advanced Identity Cloud don’t meet your needs, you can create custom managed object types or modify existing ones. You can do this using the Advanced Identity Cloud admin console or the REST API.

Don’t delete the default managed object types in your tenant when using the REST API. Deleting them can break your tenant.

Create a managed object type using the admin console

Learn more in Create and modify managed object types and Customize managed object types.

Create a managed object type using the REST API

  1. Get the current managed object configuration:

    curl \
--header "Authorization: Bearer <access-token>" \
--header "Accept-API-Version: resource=1.0"  \
--request GET \
"https://<tenant-env-fqdn>/openidm/config/managed"
{
  "_id": "managed",
  "objects": [ {managed-config-object} ]
}

  2. Make changes and replace the managed object configuration:

    curl \
--header "Authorization: Bearer <access-token>" \
--header "Content-type: application/json" \
--header "Accept-API-Version: resource=1.0"  \
--request PUT \
--data '{
  "_id": "managed",
  "objects": [ {managed-config-object} ]
}' \
"https://<tenant-env-fqdn>/openidm/config/managed"
{
  "_id": "managed",
  "objects": [ {managed-config-object} ]
}

Typical managed object property definition fields

The schema of a managed object describes the properties associated with that object.

  • Avoid using the dash character in property names (like last-name) because dashes in names make JavaScript syntax more complex. Instead, use "camel case" (lastName). If you can’t avoid dash characters, write source['last-name'] instead of source.last-name in your JavaScript.

  • Managed object properties that contain an underscore (_) are reserved for internal use. Do not create new properties that contain underscores, and do not include these properties in update requests.
title

The name of the property, in human-readable language, used to display the property in the UI.

description

A brief description of the property.

viewable

Specifies whether this property is viewable in the object’s profile in the UI. Boolean, true or false (true by default).

searchable

Specifies whether this property can be searched in the UI. A searchable property is visible in the end-user UI.

Boolean, true or false (false by default).

Do not modify the searchable setting on properties in the default managed object schema, unless otherwise noted in documentation.
userEditable

Specifies whether users can edit the property value in the UI. This property applies in the context of the End User UI, where users are able to edit certain properties of their own accounts. Boolean, true or false (false by default).

pattern

Any specific pattern to which the value of the property must adhere. For example, a property whose value is a date might require a specific date format.

policies

Any policy validation that must be applied to the property.

required

Specifies whether the property must be supplied when an object of this type is created. Boolean, true or false.

To set a property as required, use the admin console. Learn more in Manage custom properties.

The required policy is assessed only during object creation, not when a managed object is updated. You can effectively bypass the policy by updating the managed object and supplying an empty value for that property. To prevent this inconsistency, set both required and notEmpty to true for required properties. This configuration indicates that the property must exist, and must have a value.
type

The data type for the property value; can be string, array, boolean, integer, number, object, Resource Collection, or null.

If any user might not have a value for a specific property (such as a telephoneNumber), you must include null as one of the property types. You can set a null property type in the admin console. Learn more in Manage custom properties.
isVirtual

Specifies whether the property takes a static value, or whether its value is calculated "on the fly" as the result of a script. Boolean, true or false.

returnByDefault

For non-core attributes (virtual attributes and relationship fields), specifies whether the property is returned in the results of a query on an object of this type if it is not explicitly requested. Virtual attributes and relationship fields are not returned by default. Boolean, true or false. When the property is in an array within a relationship, always set to false.

default

Specifies a default value if the object is created without passing a value. Default values are available for the following data types, and arrays of those types:

  • boolean

  • number

  • object

  • string

Advanced Identity Cloud assumes all default values are valid for the schema.
enum

Restricts a field’s possible values to a defined set of options. enum is supported for string and number types, and for array types containing strings or numbers.

To define enum values, add the enum property to the field’s schema definition. You can do this using an API PUT request to the /openidm/config/managed endpoint or in the admin console. Learn more in Property settings reference.

In the following examples, the string type shows the JSON hierarchy of the property, while the others truncate everything except the property itself.

  • string

  • number

  • array of strings

{
  "_id": "managed",
  "objects": [
    {
      ...
      "schema": {
        ...
        "properties": [
          ...
          {
            "favoriteColor": {
              "enum": [
                "red",
                "green",
                "blue"
              ],
              "title": "Favorite Color",
              "type": "string",
              "viewable": true,
              "searchable": false,
              "userEditable": true,
              "description": "Choose your favorite color",
              "format": null,
              "isVirtual": false
            },
            ...
{
  "custom_enum_single_number": {
    "title": "Rating",
    "description": "Select the best number",
    "type": "number",
    "viewable": true,
    "userEditable": true,
    "enum": [
      4,
      8,
      15,
      16,
      23,
      42
    ]
  }
}
{
  "custom_enum_array_string": {
    "title": "Preferred Colors",
    "description": "Choose your preferred colors",
    "type": "array",
    "viewable": true,
    "userEditable": true,
    "items": {           (1)
      "type": "string",
      "enum": [
        "red",
        "green",
        "blue",
        "yellow"
      ]
    }
  }
}
1 The enum definition must be placed within the items object.

String values are matched against the defined enum values without regard to case. When you create, update, or patch an object, a submitted value that matches an enum value except for its case is rewritten to the exact case defined in the schema before it’s stored. For example, with "enum": ["active", "inactive"], submitting "Active" stores "active". If the schema defines multiple enum values that differ only in case, the first value listed is used. A value that doesn’t match any enum value is rejected by the valid-enum-value policy check. Existing values that differ from the schema only in case are rewritten the next time the object is updated.[1]

Enum-typed properties aren’t intended for searching. When you add an enum definition to a property, set searchable to false so the property doesn’t appear in search results.

Labels and translations for enum values are not set within the managed object schema. They must be configured using the translation override feature using API POST requests to the /openidm/config/uilocale/<locale> endpoint.

Default values

You can specify default values in the managed object schema. If you omit a value when creating an object, the default value is automatically applied to the object type. You can have default values for the following data types, and arrays of those types:

  • boolean

  • number

  • object

  • string

For example, the default managed object schema includes a default value that makes accountStatus:active, which effectively replaces the onCreate script that was previously used to achieve the same result. The following excerpt from the managed object schema displays the default value for accountStatus:

"accountStatus" : {
    "title" : "Status",
    "description" : "Status",
    "viewable" : true,
    "type" : "string",
    "searchable" : true,
    "userEditable" : false,
    "usageDescription" : "",
    "isPersonal" : false,
    "policies" : [
        {
            "policyId": "regexpMatches",
            "params": {
                "regexp": "^(active|inactive)$"
            }
        }
    ],
    "default" : "active"
}
Advanced Identity Cloud assumes all default values are valid for the schema.
1. Not available in the Advanced Identity Cloud regular channel yet. Currently included in the rapid channel for sandbox environments.